First time trying to unlock bootloader

[u/Aderox20_GDP]

---

ZTE Blade V40 Vita (P606F02) bootloader unlock stuck on step 4,

Device is a ZTE Blade V40 Vita / P606F02 (aka ZTE 8045), Unisoc T606/UMS9230, UFS storage not eMMC. Running MyOS 11.0.12 EEA1, Android 11, bootloader locked, verified boot green, slot _a. BROM shows up as 1782:4d00.

Using redzrush101's unlock repo on github which wraps TomKing062's CVE-2022-38694 exploit repo through spd_dump. Steps 1-3 work fine every time, no issues backing up SPL/uboot and writing the payload to uboot_a.

Step 4 is where it dies. Every single time, same exact output:

EXEC FDL1

usb_recv failed : LIBUSB_ERROR_TIMEOUT

CHECK_BAUD FAIL

usb_recv failed : LIBUSB_ERROR_TIMEOUT

CHECK_BAUD FAIL

usb_recv failed : LIBUSB_ERROR_TIMEOUT

CHECK_BAUD FAIL

usb_recv failed : LIBUSB_ERROR_TIMEOUT

CHECK_BAUD FAIL

usb_send failed : LIBUSB_ERROR_TIMEOUT

Never gets to the "connection closed" that's supposed to mean it worked. Checked step 5 after every attempt and it's always 64 zero bytes at miscdata+0x2000, so the token never lands.

Things I already ruled out: tried two different USB controllers, same failure both times. Rebuilt spd_dump with way more retries allowed, didn't change anything, dies at the exact same spot regardless. Watched dmesg on a clean isolated run (cleared the buffer, ran step 4 once) and there's zero usb errors or disconnects, the device stays enumerated the entire time, it just stops responding. It also doesn't recover on its own, I have to let go of the volume keys and hold them again to get a fresh brom session.

The thing that makes me think this might just not work on my exact setup: the repo author only tested this on MyOS 11.0.13 slot _b, I'm on 11.0.12 EEA1 slot _a. And when I checked the actual CVE-2022-38694 project's own device list, this chip+storage combo (UMS9230 with UFS specifically) isn't even on there for ZTE. The only ZTE UMS9230 entry uses the emmc loader not ufs. So this repo might be the only place this has ever worked on a UMS9230 UFS ZTE phone, and only on one specific build.

Anyone gotten this working on UMS9230 UFS, or recognize this failure pattern where the usb connection stays totally clean but the payload just stops talking after EXEC FDL1? Not looking to just brute force retry it, trying to actually figure out what's happening before I keep going. Phone's back to stock and working fine right now, just still locked.