OVMF could hang fetching the SEV-ES encryption mask

196e496a4ec1 (John Berg and Ivan Orlov, 2026-08-05). OvmfPkg BaseMemEncryptSevLib. Fetch Sev data from the work area. The first DXE call used to read a dynamic PCD for the page-table encryption mask and cache it. That get can turn interrupts back on in the MmioExit #VC path. The public commit says a hypervisor can then inject while the guest expects interrupts off, which nests another #VC and hangs. The mask is now read from the SEC work area in DXE instead.

2c0d84e8a376 (Berg, 2026-08-11). Reserve the AP jump buffer in SEV_ES_WORK_AREA (OvmfPkg/Include/WorkArea.h, OvmfPkg/ResetVector/ResetVector.nasmb). DXE SEV_ES_AP_JMP_FAR had been scribbling the Sec/Pei work area that holds SevStatus and the encryption mask. The mask now lives in a reserved work-area slot that the jump table no longer shares.

6a99d10480ba is the series prerequisite: GetSevEsWorkArea() shared between PEI and DXE.

Three commits landed together on master at 2026-08-27 06:37 UTC, after edk2-stable202608. Tip is 196e496a4ec1. No public GHSA. No public CVE id. Public text is a hang and work-area integrity fix, not a disclosed guest-to-host escape. This is not the August 2026 stable tag, not the TCG log card, not the PPI prompt, and not the MMIO window reserve.