OVMF refuses Secure Boot on QEMU pflash without SMM
Brief
Misconfigured Secure Boot VMs halt at firmware init instead of running with an unprotected variable store.
Notes
61733cb16c5d (Gerd Hoffmann, authored 2026-08-14, on master 2026-08-27). OvmfPkg QemuFlashFvbServicesRuntimeDxe. If the variable store is QEMU pflash, the driver now loads only when SMM protects pflash storage, or when Secure Boot support is built off. Otherwise it logs that the VM setup is not secure and CpuDeadLoop()s.
Public text is a config reject, not a named CVE or GHSA. It hardens Secure Boot variable integrity on QEMU/OVMF; it does not claim a guest-to-host escape. Watched path OvmfPkg. Not a recast of 580ad030 (SEV-ES), 188867ec (stable202608), 7e7c6106, 9ed006d6, or 91e71818. Parent tip was 125e8f86 (AcpiEinjLib, not filed).
Commit 61733cb16c5d6c1b50fbff291b87fedb0fe74755