[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Well, I just tested it - errors are a bit different, but I am not sure, what we are trying to achieve here.

(bootloader) Rooting-status:<empty>
(bootloader) secure:<empty>

~ # cat /log.log
INIT: Thu Feb 18 12:25:16 1971
[ERROR @ qsee.c:33]:
Failed to start tzxflattest tz app. (-1)
[ERROR @ xflattest_int.c:39]:
could not find application
[ERROR @ xflattest_int.c:111]:
Failed to get secdata
[ERROR @ protocol_util.c:367]:
Failed to get rooting status: (-22)
[ERROR @ fastboot.c:3315]:
get_value failed for Rooting-status
[ERROR @ qsee.c:33]:
Failed to start tzxflattest tz app. (-1)
[ERROR @ xflattest_int.c:39]:
could not find application
[ERROR @ xflattest_int.c:111]:
Failed to get secdata
[ERROR @ protocol_util.c:409]:
Failed to get rooting status: (-22)
[ERROR @ fastboot.c:3315]:
get_value failed for secure
[ERROR @ qsee.c:33]:
Failed to start tzxflattest tz app. (-1)
[ERROR @ xflattest_int.c:39]:
could not find application
[ERROR @ qsee.c:33]:
Failed to start tzxflattest tz app. (-1)
[ERROR @ xflattest_int.c:39]:
could not find application
[ERROR @ qsee.c:33]:
Failed to start tzxflattest tz app. (-1)
[ERROR @ xflattest_int.c:39]:
could not find application
[ERROR @ authenticate.c:595]:
Failed to get key. (-1007)
[ERROR @ qsee.c:33]:
Failed to start tzxflattest tz app. (-1)
[ERROR @ xflattest_int.c:39]:
could not find application
[ERROR @ fastboot.c:3315]:
get_value failed for slot-suffixes
[ERROR @ fastboot.c:3315]:
get_value failed for current-slot
~ # dmesg | grep -v ': avc' | grep '^\[ 3'
[ 3252.180893] audit_printk_skb: 1104 callbacks suppressed
[ 3371.756688] init: couldn't write 724 to /dev/cpuset/system-background/tasks: No such file or directory
[ 3371.767281] logd: failed to set AID_LOGD uid
[ 3371.767353] logd: Cannot read /system/etc/event-log-tags
[ 3371.768387] logd.auditd: start
[ 3384.711076]
[ 3384.712355] ffs_data_put(): freeing
[ 3384.719921] read descriptors
[ 3384.720002] read strings
[ 3384.720480]
[ 3384.720843] configfs-gadget gadget: unbind function 'Function FS Gadget'/0000000000000000
[ 3384.721641] android_work: sent uevent USB_STATE=DISCONNECTED
[ 3384.727746] dwc3_gadget_suspend_interrupt(): state:0. Ignore SUSPEND.
[ 3385.138271] msm-dwc3 a800000.ssusb: Avail curr from USB = 100
[ 3385.138280] android_work: did not send uevent (0 0 0000000000000000)
[ 3385.247987] android_work: sent uevent USB_STATE=CONNECTED
[ 3385.251811] android_work: sent uevent USB_STATE=DISCONNECTED
[ 3385.407954] android_work: sent uevent USB_STATE=CONNECTED
[ 3385.409518] configfs-gadget gadget: high-speed config #1: b
[ 3385.409713] msm-dwc3 a800000.ssusb: Avail curr from USB = 500
[ 3385.409736] android_work: sent uevent USB_STATE=CONFIGURED
[ 3385.429394] QSEECOM: qseecom_load_app: App (tzloader) does'nt exist, loading apps for first time
[ 3385.462605] QSEECOM: qseecom_load_app: App with id 196611 (tzloader) now loaded
[ 3423.048126] logd: logdr: UID=0 GID=0 PID=756 b tail=0 logMask=19 pid=0 start=0ns timeout=0ns
[ 3430.314830] QSEECOM: qseecom_query_app_loaded: App id 131074 (tzxflattest) already exists
[ 3430.314842] QSEECOM: qseecom_query_app_loaded: munjeni: Try removing app_id 131074, hope it get reloaded
[ 3430.314846] QSEECOM: qseecom_query_app_loaded: munjeni: success unloading app_id 131074
[ 3430.316319] QSEECOM: qseecom_query_app_loaded: App id 131074 (tzxflattest) already exists
[ 3430.316324] QSEECOM: qseecom_query_app_loaded: munjeni: Try removing app_id 131074, hope it get reloaded
[ 3430.316329] QSEECOM: qseecom_query_app_loaded: munjeni: success unloading app_id 131074
[ 3430.325918] QSEECOM: qseecom_query_app_loaded: App id 131074 (tzxflattest) already exists
[ 3430.325925] QSEECOM: qseecom_query_app_loaded: munjeni: Try removing app_id 131074, hope it get reloaded
[ 3430.325929] QSEECOM: qseecom_query_app_loaded: munjeni: success unloading app_id 131074
[ 3430.332565] QSEECOM: qseecom_query_app_loaded: App id 131074 (tzxflattest) already exists
[ 3430.332570] QSEECOM: qseecom_query_app_loaded: munjeni: Try removing app_id 131074, hope it get reloaded
[ 3430.332572] QSEECOM: qseecom_query_app_loaded: munjeni: success unloading app_id 131074
[ 3430.339722] QSEECOM: qseecom_query_app_loaded: App id 131074 (tzxflattest) already exists
[ 3430.339726] QSEECOM: qseecom_query_app_loaded: munjeni: Try removing app_id 131074, hope it get reloaded
[ 3430.339729] QSEECOM: qseecom_query_app_loaded: munjeni: success unloading app_id 131074
[ 3430.347132] QSEECOM: qseecom_query_app_loaded: App id 131074 (tzxflattest) already exists
[ 3430.347136] QSEECOM: qseecom_query_app_loaded: munjeni: Try removing app_id 131074, hope it get reloaded
[ 3430.347139] QSEECOM: qseecom_query_app_loaded: munjeni: success unloading app_id 131074
~ #

In my opinion XFL works in different TZ api mode (or as guessed by [MENTION=7543898]Blu-eyes[/MENTION] in post#1298).

Most likely it is not possible to make the lilo/loader to work in normal android boot mode.

What I am rather interested to is finding a hole (possibly in XFL mode) which could be used to get code execution in TZ and/or bootloader relock and best case injecting custom verified boot keys.

For this we need some good reverse engineering of tz applets and bootloader components...