[Magisk] pndwal:
Yup... Seems you never actually lose Root of trust in hardware if Key Attestation app is actually intercepting the droidguard data as I suspect... Otherwise seems K A app must be intercepting the encrypted data w/ nonce etc output from gms which would suggest bugs in GM's which I doubt... or neither is true. (🤪)...

I'd be surprised if it's not certified... You can check w/ YASNAC. If that print passes S/N when root is hidden from gms processes etc, it's certified...

I think you'll find the need for older fingerprint is because most A11+ devices actually need a mismatch with some running ROM print data (API level? Date? Other?... but still must be a passing print and MHPC method helps ensure this by also setting Security patch level to match print) in order to allow/trigger Play Integrity hardware evaluation type enforcement bypass... It seems clear you actually need this bypass to allow deviceIntegrity pass which means that it is already collecting data using Basic (non HK) data as you are not using USNF (which is normally needed to trigger an exception when HKA is attempted by registering a fake keystore that causes HK devices to use Basic evaluation), but this fails as Hardware evaluation verdicts are still enforced until bypassed...

I put details of various enforcement bypass triggers, all prop mismatches, here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/post-87575455

Once deviceIntegrity is passing w/ a Basic evaluation, the strongIntegrity is allowed to pass also since it's also clearly now accepting at least some Basic evaluation type data...

The fact that Basic evaluation type is used out-of-the-box is the interesting thing for me...

If I were to hazzard a guess, I'd say fallback triggers are only seen by DroidGuard and in the ROG 3 case it's not even needed as all 3 verdict tiers are already erroneously locked to Basic evaluation types; this is the basic bug in the attestation mechanism AFAICS. Next, after receiving the needed Hardware evaluation type verdict enforcement bypass trigger the DroidGuard data is accepted by GMS to be sent to Google's Play server, and it seems this includes whatever strongIntegrity data is required...

It seems that if this is what's occurring however, GMS is not checking if Hardware Evaluation type is enforced (just taking DroidGuard's untrustworthy word for it), and it certainly should be for passing strongIntegrity... This seems strange to me and I'm now wondering if DroidGuard is actually signalling Hardware evaluation type is used despite something having causing a fallback to Basic...

*** Please could you post YASNAC result to confirm this; no need to change setup from fully passing... We already know Basic evaluation type is used, but if Hardware is actually reported it would also explain why gms is not challenging the data...

Nb. The theory above is only an extrapolation of what I know which isn't really that much... As such please view it as fluid / subject to (much?) revision...

Again, many thanks for helping with this... At the very least it should help our general understanding of gms's attestation/droidguard process and how DroidGuardVM itself processes attestation data... 😛 PW