[Google Pixel 6 Pro] The MAZZTer:
I was able to root my Pixel 6 Pro on Project Fi. I had the Day 1 update applied. Wiping /data was required for the vbmeta thing (and was a good idea in general since I was downgrading the OS version).

My steps:

1. Download appropriate factory image for my device.

2. Download magisk canary (v23 stable fails to patch the boot.img).

3. Boot phone and run through OOB setup if needed, skip everything.

4. Enable developer options, then OEM unlock.

5. Reboot into bootloader.

6. Modify flash-all script in factory image ZIP and add --skip-reboot to the image flash command (remove the pause and exit commands in the BAT as well if you're using that). You need to keep the -w flag in to wipe /data or else the phone won't boot the rooted image. Normally you don't need to reflash everything but the latest version is not available as a factory image, and doing this ensures every partition is kept the same version. Plus you need to wipe /data anyway.

7. Connect your phone to PC via USB and run script.

8. Extract vbmeta.img and boot.img from the image ZIP.

9. Use fastboot to flash vbmeta.img with the flags listed above.

10. Reboot and unlock device. Go through OOB experience, you can set up your phone properly this time.

11. Push the boot.img and app_debug.apk (magisk) to your phone and install the APK., You can use ADB if you enable USB debugging or just find your phone in Windows Explorer and drag and drop (open APK in Files app and enable app install from Files).

12. Run magisk and patch the boot.img.

13. Use adb (or Explorer) to pull the patched magisk*.img down to your PC.

14. Reboot to bootloader

15. Use fastboot to flash the magisk'd magisk*.img to boot partition.

16. Boot device.

You should be rooted now. If something goes wrong go back to step 14 but flash the original boot.img on step 15 instead, that should get you back unrooted and you can see if things are working again (else go back to step 5 to start over).

Issues/comments:

1. Magisk Canary removes SafetyNet bypass as well as MagiskHide. Apps which check SafetyNet won't work now.

2. Magisk won't offer modules for install, not sure if this is normal canary behavior or if the modules aren't compatible due to magisk changes.

3. OTA updates won't install. I've had this issue with Magisk forever on other devices too. Some people say they should work but I've never seen them work.

4. Elevation dialog works EXCEPT if you use su from an adb shell. The dialog seems to try to display but it doesn't actually display; probably the overlay is being blocked due to android security thinking it's an uninvited popup, I speculate it's a magisk bug. Terminal won't show up in the list of superuser apps either in Magisk so you can't just toggle it on in there as a workaround. EDIT: I figured out if you Hide Magisk Manager the elevation dialog will no longer work. Unhide as a workaround and grant elevation forever to any apps you need, then rehide. Automatic elevation of whitelisted apps still works (and I assume you can still toggle in the Superuser tab.)

5. If I understand it correctly /data wipe should only have to happen once (reflashing vbmeta with the special flags still needs to happen whenever vbmeta is updated).

6. Magisk has added a "DenyList" which sounds like MagiskHide but a) it has a different name which suggests it's different and b) SafetyNet is sitll a problem. So not sure if it is doing anything since apps just check SafetyNet anyway.

7. I copied my /sdcard from my old phone to my new. I could not get Android to allow me to drop files in /sdcard/Android/data or /sdcard/Android/obb though. I think that is a new thing. Even with Solid Explorer getting permissions granted to write to those folders it was still denied. As said su in adb shell doesn't work so I couldn't try that.

8. I tried to install Universal SafetyNet Fix module but it wanted Riru installed first. That rabbit hole did not seem safe to go down so I aborted at that point; someone else can give it a go.

9. Gnirehtet and ScrCpy work fine if you like using those tools (you may need newer Android 12 compatible versions). However it's worth noting Play Store thinks you're on mobile data if Gnirehtet is active so it will pause installing apps if you do that in the OOB setup (eg apps from another device) and I couldn't get it to unpause without disabling Gnirehtet.

10. Titanium Backup works fine for restoring app data, so I can verify root works.

SafetyNet workaround would be appreciated if anyone has figured it out.