Win11 Build 25951: Sysprep_Specialize_Bcd: There was an error setting firmware variable support reg key. Status=[0xC000003B]

[TheBobPony]

After following the Surface Duo WOA guide exactly for the Surface Duo 1, Windows 11 Build 25951 seems to boot up fine until it goes to the "Getting ready" phase where it stays there for a few mins then suddenly an error message pops up saying "Windows Setup couldn't configure Windows to run on this computer's hardware.".

OS Build used: Windows 11 Enterprise build 25951 (Canary Channel) ARM64

Looking into the setup error logs, it says the following:

2023-09-09 00:45:01, Error                 CONX   ApphelpDebug: ERROR,ApphelpChpeModSettingsFromQueryResult,892,SdbQueryResults was null or not the correct size.

2023-09-09 00:49:24, Error                 SYSPRP Sysprep_Specialize_Bcd: There was an error setting firmware variable support reg key. Status=[0xC000003B]
2023-09-09 00:49:24, Error                 SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'Sysprep_Online_Specialize_Bcd' from C:\Windows\System32\spbcd.dll; dwRet = 0xa1
2023-09-09 00:49:24, Error                 SYSPRP SysprepSession::ExecuteAction: Failed during sysprepModule operation; dwRet = 0xa1
2023-09-09 00:49:24, Error                 SYSPRP SysprepSession::ExecuteInternal: Error in executing action for Microsoft-Windows-Sysprep-SpBcd; dwRet = 0xa1
2023-09-09 00:49:24, Error                 SYSPRP SysprepSession::Execute: Error in executing actions from C:\Windows\System32\Sysprep\ActionFiles\Specialize.xml; dwRet = 0xa1
2023-09-09 00:49:24, Error                 SYSPRP RunPlatformActions:Failed while executing Sysprep session actions; dwRet = 0xa1
2023-09-09 00:49:24, Error      [0x0f0435] SYSPRP Callback_Specialize: An error occurred while either deciding if we need to specialize or while specializing; dwRet = 0xa1[gle=0x00000002]

I have also attached the original files (setupact.log and setuperr.log) to this issue, not too exactly sure if this is a Windows Insider build issue. I've tried searching online for the error code and came up with no results.

setupact.log setuperr.log

[gus33000]

Hi! thanks for the report! This seems to be a new issue with Canary Channel builds in particular. Noticed it occurring on build 25947 myself. Yet to investigate but it's a new code path it seems unique to ARM64 windows as well. I could not reproduce this in a virtual machine either with the same ISO image. Maybe give an iso for the dev channel or beta or release preview or production a shot and see how it goes? Please get back to us though if it still occurs on production isos, as this may indicate a new bug here. A bit busy today and tomorrow but i'll take a look over the weekend further for canary channel in particular.

Thank you! 🙂

[gus33000]

Ok so the issue is linked to specific errata detection code to discover ARM64 devices with read only uefi variable set implementations. A while back we implemented a workaround for an issue linked to blacklotus mitigations/secureboot db updates, this is what causes the failure in canary channel builds.

This commit reverts such mitigations and allows the os to run but brings back the secure boot update issue, that needs to be solved differently: https://github.com/WOA-Project/SurfaceDuoPkg/commit/8c1a724ed0d04c91b746bd37b1b15b1abdf8cbc6

[gus33000]

Got a working fix proof of concept, will try to get this fixed by tomorrow and merged in, and then released alongside some other fixes. Thanks again for the report!

[gus33000]

Fix has been made and is set to release tonight. Currently incubating the changes.

Tested functional on OEMEP (Surface Duo 1) and OEMZE (Surface Duo 2) on RS3/RS4/RS5/19H1/VB/MN/FE/CO/NI/CU/ZN/GE.

Needs more testing for the release due to other changes landing.

Thanks again!

[gus33000]

Fixed as part of the 2309.56 release, please let us know if it doesn't work if you can! https://github.com/WOA-Project/SurfaceDuoPkg/releases/tag/2309.56

[TheBobPony]

Fixed as part of the 2309.56 release, please let us know if it doesn't work if you can! https://github.com/WOA-Project/SurfaceDuoPkg/releases/tag/2309.56

Tested out the provided disabled secure boot uefi boot images, it instantly shows an error boot screen about a driver from the Surface Duo driver pack due to "digital signature", giving error code 0xc0000428.

But when using the provided uefi boot images that don't have the secure boot feature disabled, Windows 11 Canary boots up fine. Not sure if it's the Surface Duo driver pack requiring secure boot or something with Windows 11.

Anyways, thank you (and others) for the hard work on this project!