[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
device key restored on unlocked xz2: logs and TA for comparison

Here are the most interesting differences when comparing logs:

bootloader log comparison: locked vs unlocked-DK-lost

XBoot Init
Init XBootPALAPILib
Init TA API Lib
XBOOT (1310-7079_X_Boot_SDM845_LA2.0_P_118)
[B]+[WARNING @ ta_interface.c:109]:
+Unable to read TA unit 66667, error=4
+[ERROR @ xboot_glue.c:107]:
+read_ta returned err=-22
+[ERROR @ xboot_glue.c:526]:
+get_dk returned err=-22
[/B] Reading 321 bytes from RPMB, OK
Reading 321 bytes from RPMB, OK
XDeviceTreeAddrExtract start
no check attributes (Mode 3)
LoadImageAndAuth: 1343: CurrentSlot.Suffix=_a
load_and_verify_vbmeta:432: DEBUG: Loading vbmeta struct from partition 'vbmeta_a'.
-Loading Image Start : 2525 ms
-Loading Image Done : 2525 ms
+load_and_verify_hash_partition:186: DEBUG: boot_a: Loading entire partition.
+load_and_verify_hash_partition:242: ERROR: boot_a: Hash of data does not match digest in descriptor.
+load_and_verify_hash_partition:186: DEBUG: dtbo_a: Loading entire partition.
+Loading Image Start : 2695 ms
+Loading Image Done : 2695 ms
Total Image Read size : 4096 Bytes
@@ -302,46 +316,50 @@
Booting from slot (_a)
LoadImageAndAuth: 1343: CurrentSlot.Suffix=_a
load_and_verify_vbmeta:432: DEBUG: Loading vbmeta struct from partition 'vbmeta_a'.
[B]-VB2: Authenticate complete! boot state is: green[/B]
-VB2: boot state: green(0)
+load_and_verify_hash_partition:186: DEBUG: boot_a: Loading entire partition.
+load_and_verify_hash_partition:242: ERROR: boot_a: Hash of data does not match digest in descriptor.
+load_and_verify_hash_partition:186: DEBUG: dtbo_a: Loading entire partition.
+State: Unlocked, AvbSlotVerify returned ERROR_VERIFICATION, continue boot
[B]+VB2: Authenticate complete! boot state is: orange[/B]
+VB2: boot state: orange(1)
Reading 321 bytes from RPMB, OK
VB: RWDeviceState: Succeed using rpmb!
[B]+Device key is not set, setting to zero[/B]
Memory Base Address: 0x80000000

-> clearly ABL tries to load the device key from 66667 (0x1046B) TA unit and uses it for something.

bootloader log comparison: locked vs unlocked-DK-restored

@@ -251,20 +256,23 @@
no check attributes (Mode 3)
LoadImageAndAuth: 1343: CurrentSlot.Suffix=_a
load_and_verify_vbmeta:432: DEBUG: Loading vbmeta struct from partition 'vbmeta_a'.
-Loading Image Start : 2525 ms
-Loading Image Done : 2525 ms
+load_and_verify_hash_partition:186: DEBUG: boot_a: Loading entire partition.
+load_and_verify_hash_partition:242: ERROR: boot_a: Hash of data does not match digest in descriptor.
+load_and_verify_hash_partition:186: DEBUG: dtbo_a: Loading entire partition.
+Loading Image Start : 2655 ms
+Loading Image Done : 2655 ms
Total Image Read size : 4096 Bytes
@@ -302,46 +310,49 @@
Booting from slot (_a)
LoadImageAndAuth: 1343: CurrentSlot.Suffix=_a
load_and_verify_vbmeta:432: DEBUG: Loading vbmeta struct from partition 'vbmeta_a'.
[B]-VB2: Authenticate complete! boot state is: green[/B]
-VB2: boot state: green(0)
+load_and_verify_hash_partition:186: DEBUG: boot_a: Loading entire partition.
+load_and_verify_hash_partition:242: ERROR: boot_a: Hash of data does not match digest in descriptor.
+load_and_verify_hash_partition:186: DEBUG: dtbo_a: Loading entire partition.
+State: Unlocked, AvbSlotVerify returned ERROR_VERIFICATION, continue boot
[B]+VB2: Authenticate complete! boot state is: orange[/B]
+VB2: boot state: orange(1)
Reading 321 bytes from RPMB, OK
VB: RWDeviceState: Succeed using rpmb!
Memory Base Address: 0x80000000

-> note that there is no problem logged about not reading DK nor log about setting it to zero.

logcat comparison: locked vs unlocked-DK-lost-BLU-hiding-kernel

@@ -82,11 +80,11 @@
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2022
I libsuntory_static: utils_blob.cpp:400 found blob CKB
I libsuntory_static: utils_blob.cpp:424 match found at index 0
-I libsuntory_static: utils_blob.cpp:94 blob verisfication status: Blob OK
[B]+E libsuntory_static: utils_blob.cpp:324 SUNTORY_CMD_VERIFY_BLOB failed[/B]
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2023
I libsuntory_static: utils_blob.cpp:400 found blob WIDEVINE
I libsuntory_static: utils_blob.cpp:424 match found at index 1
-I libsuntory_static: utils_blob.cpp:94 blob verisfication status: Blob OK
[B]+E libsuntory_static: utils_blob.cpp:324 SUNTORY_CMD_VERIFY_BLOB failed[/B]
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2024
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2025
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2026
@@ -98,7 +96,13 @@
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2032
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2033
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2034
[B]+E libsuntory_static: utils_blob.cpp:457 blob with index 0 has failed verification
+E libsuntory_static: utils_blob.cpp:349 index 0 should be reportd in CS data
+E libsuntory_static: utils_blob.cpp:349 index 1 should be reportd in CS data
[/B]+I imsrcsd : Uce Service HAL is starting up...
+I imsrcsd : Uce Service HAL loading imsrcsbaseimpl
I installd: installd firing up
+I imsrcsd : Starting Service for First Time imsbaseimpl
I bs_updatemiscta: Version info filename defaulted to: /version
W bs_updatemiscta: read_sw_version_info_file: Can not open file: '/version'
I tad : MiscTA Unit 2202:
...
-D bs_usbeng: miscta_read_unit result: 5 (data: 0x00)
-D bs_usbeng: miscta_read_unit 2471 result: 5 (data: 0x00)
-E libsuntory_static: utils_blob.cpp:505 blob size does not exist
-E libsuntory: suntory_get_blob.cpp:80 get_suntory_blob failed to find a blob
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2022
+I libsuntory_static: utils_blob.cpp:400 found blob CKB
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2023
+I libsuntory_static: utils_blob.cpp:400 found blob WIDEVINE
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2024
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2025
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2026
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2027
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2028
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2029
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2030
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2031
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2032
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2033
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2034
+E libsuntory_static: utils_blob.cpp:457 blob with index 0 has failed verification
+E libsuntory_static: utils_blob.cpp:349 index 0 should be reportd in CS data
+E libsuntory_static: utils_blob.cpp:349 index 1 should be reportd in CS data
+E libsuntory: suntory_get_blob.cpp:85 get_suntory_blob failed
+I chatty : uid=1000(system) identical 1 line
+E libsuntory: suntory_get_blob.cpp:85 get_suntory_blob failed
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2022
+I libsuntory_static: utils_blob.cpp:400 found blob CKB
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2023
+I libsuntory_static: utils_blob.cpp:400 found blob WIDEVINE
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2024
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2025
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2026
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2027
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2028
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2029
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2030
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2031
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2032
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2033
+I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2034
+E libsuntory_static: utils_blob.cpp:457 blob with index 0 has failed verification
+E libsuntory_static: utils_blob.cpp:349 index 0 should be reportd in CS data
+E libsuntory_static: utils_blob.cpp:349 index 1 should be reportd in CS data
+E libsuntory: suntory_get_blob.cpp:85 get_suntory_blob failed
+E libsuntory: suntory_get_blob.cpp:85 get_suntory_blob failed
I SystemServer: InitBeforeStartServices
I SystemServer: Entered the Android system server!
I SystemServer: StartServices
...
-I android_os_HwBinder: HwBinder: Starting thread pool for default::vendor.somc.hardware.security.secd@1.0::IDeviceSecurity
-I secd@1.0-service: message 8 ok
-I android_os_HwBinder: HwBinder: Starting thread pool for default::vendor.somc.hardware.security.secd@1.0::IDeviceSecurity
-I secd@1.0-service: message 405 ok
+E secd@1.0-service: credmgr is not ready, please wait for 'vendor.keyprovd.suntory.prov' property
+E secd@1.0-service: message 202 failed, error code 4
+E secd@1.0-service: routine credmgr, caller service
+E secd@1.0-service: credmgr_get_credential failed: 4

logcat comparison: locked vs unlocked-DK-restored-BLUhiding-kernel

@@ -82,11 +80,11 @@
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2022
I libsuntory_static: utils_blob.cpp:400 found blob CKB
I libsuntory_static: utils_blob.cpp:424 match found at index 0
-I libsuntory_static: utils_blob.cpp:94 blob verisfication status: Blob OK
[B]+E libsuntory_static: utils_blob.cpp:324 SUNTORY_CMD_VERIFY_BLOB failed[/B]
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2023
I libsuntory_static: utils_blob.cpp:400 found blob WIDEVINE
I libsuntory_static: utils_blob.cpp:424 match found at index 1
-I libsuntory_static: utils_blob.cpp:94 blob verisfication status: Blob OK
[B]+E libsuntory_static: utils_blob.cpp:324 SUNTORY_CMD_VERIFY_BLOB failed[/B]
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2024
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2025
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2026
@@ -98,15 +96,25 @@
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2032
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2033
I libsuntory_static: utils_blob.cpp:372 process miscTA unit 2034
+E libsuntory_static: utils_blob.cpp:457 blob with index 0 has failed verification
+E libsuntory_static: utils_blob.cpp:349 index 0 should be reportd in CS data
+E libsuntory_static: utils_blob.cpp:349 index 1 should be reportd in CS data
...
-I android_os_HwBinder: HwBinder: Starting thread pool for default::vendor.somc.hardware.security.secd@1.0::IDeviceSecurity
-I secd@1.0-service: message 8 ok
-I android_os_HwBinder: HwBinder: Starting thread pool for default::vendor.somc.hardware.security.secd@1.0::IDeviceSecurity
-I secd@1.0-service: message 405 ok
+E secd@1.0-service: credmgr is not ready, please wait for 'vendor.keyprovd.suntory.prov' property
+E secd@1.0-service: message 202 failed, error code 4
+E secd@1.0-service: routine credmgr, caller service

-> so even with device key (locked TA) restored, logcat logs looks very similar as in case of DK lost.

Attached an archive with full logs and TA backup images with DK lost and DK present, including scripts to strip timing info for easier comparison: xz2-TA-locked-restored-comparison.7z (send me a PM for password), containing following files:

my-xz2-unlocked-DK-lost-TA.img
my-xz2-unlocked-DK-present-TA.img
sanitize-abllog.sh
sanitize-dmesg.sh
sanitize-logcat.sh
xz2-locked-8.131-abllog.log
xz2-locked-8.131-logcat.log
xz2-unlocked-DK-lost-bluh-8.131-abllog.log
xz2-unlocked-DK-lost-bluh-8.131-dmesg.log
xz2-unlocked-DK-lost-bluh-8.131-logcat.log
xz2-unlocked-DK-lost-stock-8.131-abllog.log
xz2-unlocked-DK-lost-stock-8.131-dmesg.log
xz2-unlocked-DK-lost-stock-8.131-logcat.log
xz2-unlocked-DK-present-bluh-8.131-abllog.log
xz2-unlocked-DK-present-bluh-8.131-dmesg.log
xz2-unlocked-DK-present-bluh-8.131-logcat.log
xz2-unlocked-DK-present-stock-8.131-abllog.log
xz2-unlocked-DK-present-stock-8.131-dmesg.log
xz2-unlocked-DK-present-stock-8.131-logcat.log

Attached screenshots show security screen of stock kernel (not hinding boot loader unlock) and BLU hiding kernel.

The security screen is the same regardless DK is present or lost, in both cases.