[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Aqq123:
Hello [MENTION=4418980]j4nn[/MENTION]. I really appreciate all the work you put into this and the kernels. I hate to bother you but somehow I also ran into the same issue as [MENTION=9830462]Homer-J[/MENTION] did earlier (post #759 onwards), although in my case it's with the XZ Premium (G8141). That is, *#*#SERVICE#*#* → Service tests → Security reports:

Suntory blobs: Error

Keys: Not Provisioned

Credential Manager: Error

This does not change even with your kernel boot-G8141-47.1.A.16.20-hideunlock-magisk-19.1[-verity].img. The only thing that does is Rooting status, from DONE to NOT_DONE.

I started with the 47.1.A.16.20 CE1 firmware. It was freshly flashed and completely clean, nothing was modified or installed. I downgraded to 47.1.A.3.254 CE1 from the linked file, G8141_47.1.A.3.254_CE1.rar, ran the exploit to obtain privileged shell, backed up the TA partition, unlocked the bootloader, obtained superuser access again (via the same exploit) and restored the TA. At this point the issue was already showing in the service menu but since the camera was working I assumed it's something that will resolve itself fully once I boot or flash the kernel that hides the bootloader unlock. I then flashed the 47.1.A.16.20 CE1 again, booted and flashed your kernel too but the issue persisted.

I strictly followed the instructions with the exception of also having unpacked the partition.zip files into partition/partition-image-LUN*_X-FLASH-ALL-42E5.sin in both of the firmware versions I flashed, so I'm wondering if the problem I ran into has something to do with this, as this is the only reason I could think of at the moment: otherwise, the persist*.sin files were deleted before flashing, and there were no third-party modifications involved: it was just fresh stock firmware, all flashed directly with Newflasher version 13. In short, nothing out of the ordinary.

Considering the above, I'd really appreciate if you could shed some light on the following two questions:

1. How do I find out if the backup I made of the TA partition is indeed correct and complete? I understand, as per this post from another thread you linked to, that MiscTA Unit 66667 (TA_DEVICE_KEY) is the entry to look for. Is this the only entry that matters? How to verify if it is present or not? For the record, I made several dumps of the TA at different stages and none of them had the string CORRUPT, unlike [MENTION=9830462]Homer-J[/MENTION]'s.

2. If the TA somehow got corrupted before I managed to back it up, then I guess it's game over for me. However, assuming the backup I made is fine, I'd like to try the solution you mentioned in post #782 in this thread:

Could you please say specifically, which version would you recommend for me to flash as an attempt to fix this issue? Ideally I was hoping to end up with the latest Oreo, i.e. 47.1.A.16.20, which is why I flashed this one. Perhaps I should try some intermediate version instead? Or another variant rather than CE1?

Apologies for the long post but I wanted to describe everything in detail to avoid the need for follow-up questions, and also for the benefit of any future readers (if there is some merit to the suspicion that the problem is related to the partition files being flashed). Suggestions would be greatly appreciated.

Follow-up (I): I flashed back G8141_47.1.A.3.254_CE1.rar, this time leaving partition.zip intact (not sure if it matters), and only removing persist_X-FLASH-ALL-42E5.sin. The Suntory blobs still show an "error," and the keys (FIDO and Attest) are "not provisioned" but the DRM is reported as working, both ClearKey and Widevine (with security level L1). Credential Manager is also "active." Perhaps an unlock-hiding kernel would make the rest work as well but the 47.1.A.16.20 one does not boot with this firmware.

Follow-up (II): I tried flashing two different firmware releases (both without persist.sin). With 47.1.A.12.75 (CE1), the situation is just like with 47.1.A.3.254, as described above. However, with 47.1.A.16.20 (Germany), the DRM keys no longer appear in the Security test (DRM Info shows Widevine Security Level as "L3"), and the credential manager reports an error, so it is just like with the CE1 variant of the same version I originally tried. Not sure what to think of it all, suggestions would be welcome.