[Google Pixel 7] simplepinoi177:
Let me see if I can enlighten/clarify some things (on how I understand it)....

Safetynet & Play Integrity don't require a "working fingerprint", just passing certain integrity checks. The newer the device, passing the more advanced version of the integrity check is required for those services & apps that rely on Safetynet and Play Integrity (Wallet, Turo, but others to name of a few). So, for our new devices to get around this (with our unlocked bootloaders and/or root being revealed/alerting), we misrepresent our devices as older, so we can pass under the more "BASIC" integrity check (hence, "MEETS_BASIC_INTEGRITY"). We do this by changing/spoofing our device fingerprint to an older device -- but only spoofing in the instance a certain check called DroidGuard requires/requests it. I imagine Google must require this because it must still be backwards compatible to all older Android devices; lest a huge percentage of devices (OEMs; especially low budget ones that run on older almost outdated Android versions), services, and apps no longer will be able to function 100% and imagine the complaints they’d receive for that. And this has been the main idea & basic methodology since MHPC, then USNF, Displax MOD, and eventually PIF -- although MHPC actually changed the fingerprint system-wide, than simply when DroidGuard calls for it.

But Google has recently been flagging and "burning" the fingerprints we are misrepresenting -- through various methods we can only hypothesize; like too many of the same fingerprint of an old device requesting Play Integrity checks or too many of an old device using the same Play service. Since then, the community has been going from one fingerprint, getting it banned/burned, then going to another. That's why it's said you have to use a "working fingerprint", because older versions of PIF and/or some custom fingerprints have been recognized, flagged, and banned/burned and is no longer a viable "working" fingerprint.

This correct, and on top of all that (correct OTA update or compatible play store apps; hence why when a device is no longer passing the proper integrity checks, Play Store is uncertified and/or certain apps do not show up in results [Netflix, Turo]), but taking a step further is that as explained earlier in this post is that as we’re trying to spoof an older device fingerprint to pass more basic integrity checks, we’re not using the device fingerprint in such a simple, direct way of mere identification so apps and OTA’s are applied correctly…

Yes, and that’s sort of why there’s trouble – SafetyNet has been depreciated by Google for a while now (hence it being announced in June 2022 that there will be a full turn down eventually in January 2025). That’s why it’s Play Integrity API and why it’s Play Integrity Fix (PIF); instead/as-opposed-to Universal SafetyNet Fix (USNF). And yes, SafetyNet used to only really check for an unlocked bootloader for root detection, so that was merely enough when bypassing. USNF and PIF module I wouldn’t say “spoofs” bootloader unlocked status – as I understand, spoof is more akin of mis-identifying than bypassing by misrepresenting the status [vs. identity] – but it does do as earlier explained where “spoofs” an older device that can pass under more basic checks.

The “fingerprint” actually, itself, doesn’t hold any information on whether the device has its bootloader unlocked or not – or it would be very easy to just simply change that value from 1 to 0 or flagged/unflagged or triggered/untriggered. We most likely wouldn’t need to do the whole copying of certain fields and values; or even the whole rigorous search of finding proper devices and their fingerprints if it was as simple & easy as triggering the build.prop or pif.json to bootloader_locked=1 or bootloader_unlocked=0 (these are joke examples).

And it has been brought up many, numerous times from users concerned over what happens to the devices that we are spoofing – because thousands and upon thousands of devices are spoofing those devices and if Google really is banning those fingerprints, then any authentic and real users of those devices might be at risk of having their services/capabilities restricted as well. But it’s been determined that it seems Google actually has some further checks (that we can only theorize on, and I believe that if we can figure out these further checks and bypass them, then we don’t have to worry about fingerprints) that will check & match further if a device is merely spoofing or if it matches/verifies that the fingerprint it’s representing is also on the actual literal physical device. That’s why, as we’ve burned through 2 or 3 device fingerprints in the last month, we haven’t heard those same devices (because it’s easy for us to see the fingerprint we’re spoofing) complain that they aren’t passing their integrity checks either!

Hopefully this illuminates and further, better explains all of this – and just as hopefully in at least an understandable (albeit extensive and wordy) manner.