For debian:

[  109.000033] TEST-70-TPM2.sh[1555]: Got message type=method_return sender=org.freedesktop.systemd1 destination=n/a path=n/a interface=n/a member=n/a  cookie=745 reply_cookie=1 signature=n/a error-name=n/a error-message=n/a
[  109.000282] TEST-70-TPM2.sh[1555]: Bus n/a: changing state RUNNING → CLOSED
[  109.001044] TEST-70-TPM2.sh[472]: + echo 'Subtest /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.pcrlock.sh failed'
[  109.001220] TEST-70-TPM2.sh[472]: Subtest /usr/lib/systemd/tests/testdata/units/TEST-70-TPM2.pcrlock.sh failed
[  109.001350] TEST-70-TPM2.sh[472]: + return 1

For rawhide:

qemu-system-x86_64: terminating on signal 15 from pid 81928 (/usr/bin/python3)
Finishing after writing 0 entries
qemu-system-x86_64: tpm-emulator: Could not cleanly shutdown the TPM
‣ Interrupted
No coredumps found.

I vaguely recall I had seen these before and it was because I had forgot to make some change somewhere. Can someone help here?

Claude review of PR #42570 (cbf8033)

Must fix

• Sections no longer located when no CHID matches — src/boot/pe.c:406-435 — when .hwids is present but neither chid_match succeeds, pe_locate_sections_internal() over the real section list is never called, so .linux/.initrd/.cmdline/etc. are never found and the UKI fails to boot (matches the TEST-70-TPM2 failures reported on the PR). Restore the unconditional final call.
• OOB read in .hwids NUL-termination check — src/boot/chid.c:146 — (size_t*) hwid_buffer + off advances the pointer by off * sizeof(size_t) bytes, not off bytes, so the memchr scans the wrong region (string termination is never actually bounded) and reads out of bounds for any non-zero offset. Use (const uint8_t *) hwid_buffer + off.

Suggestions

• .efifw matching coupled to .dtbauto presence — src/boot/pe.c:422 — UEFI-FW matching is only reachable because the whole block is gated by looking_for_dtbauto(); a caller requesting .efifw without .dtbauto would silently never match.
• Unbounded attacker-controlled offset on UEFI-FW path — src/boot/pe.c:422 — device_get_fwid() dereferences an unvalidated uint32_t offset from the untrusted .hwids section; this pre-existing pattern is newly exercised by the UEFI_FW match. Consider bounds-checking offsets against hwid_length.
• Offset validation doesn't bound string length — src/boot/chid.c:131-145 — the new >= hwid_length checks bound only where each string starts, not its NUL-termination, so streq8() on fwid/name/compatible can still read past the section end.
• Redundant/inconsistent section-location passes — src/boot/pe.c:413-429 — the final pass duplicates the inner success passes, and on DT-match + FW-no-match it runs with hwids==NULL but a stale non-NULL device; reset device with hwids and locate sections once. (device is now reset together with hwids; author considers the remaining restructuring resolved.)
• Make CHID device-type dispatch exhaustive — src/boot/chid.c:121 — declare the loop locals at narrowest scope and give the if/else if over device_type a terminal else assert_not_reached() so off/name_off definite-assignment doesn't rely implicitly on the IN_SET guard.
• Validate untrusted descriptor size field (dismissed) — src/boot/chid.c:125 — the descriptor's size bits are read from the untrusted table but never checked against sizeof(Device); the loop hardcodes the stride.
• Skip NUL-termination check for absent (offset 0) strings — src/boot/chid.c:147 — offset 0 means "not present", but the unconditional memchr validates an unrelated region for absent fields, inconsistent with device_get_*().

Nits

• Duplicate offset-validation blocks — src/boot/chid.c:131-145 — the DEVICETREE and UEFI_FW validation blocks are identical; compute the device type once and share the bounds check.
• Stray indentation — src/boot/pe.c:354 — return false; has a 9-column indent; fix to 8 while renaming the function.
• Inconsistent argument indentation — src/boot/pe.c:385 — the pe_locate_sections_internal() call indents its arguments to column 19, vs column 24 for the identical final call at line 430.
• Stray double semicolon — src/boot/chid.c:124 — &devices[n_devices];; has a trailing empty statement.
• Over-long line in section-name predicate — src/boot/pe.c:352 — the two pe_section_name_equal() checks exceed the ~109-column guideline.
• Missing space in pointer cast — src/boot/chid.c:147 — (const uint8_t*) should be (const uint8_t *) per the project's pointer-spacing convention; applies to lines 147 and 149.
• Collapse IN_SET onto one line — src/boot/chid.c:130 — with device_type extracted into a local, the condition now fits on a single line.
• Misleading "no UEFI FW" log for DT-only images — src/boot/pe.c:426 — fires on every boot of a devicetree-only image whose .hwids has no firmware entry, where no firmware was ever expected.

Workflow run

lgtm, but please swap those two checks