EEA firmware (THELOOP.EEA26010501U) shipped with locked bootloader — unable to root

[gasperoiclj-boop]

I have a Loop DL purchased in the UK. Unlike the device in robyn.zip's guide, my unit has a locked bootloader.

Device info:

• Brand/Manufacturer: rainx
• Model: theloop
• Board: tb8791p1_64
• SoC: MT6877 (arm64-v8a)
• Android 15, SDK 35, first_api_level 35
• Build: THELOOP.EEA26010501U
• Build date: Mon Jan 5 17:17:54 CST 2026
• Fingerprint: rainx/theloop/theloop:15/AP3A.240905.015.A2/1767159308:user/release-keys
• Locale: en-GB
• Serial: ORFMGBD3PCA000350
• Slot: _a (A/B partitioning)
• Treble: true
• Dynamic partitions: true
• Encrypted: file-based (aes-256-cts)
• Build type: user
• Build tags: release-keys
• ro.debuggable: 0
• AVB version: 1.3 (vbmeta AVB 1.2)
• vbmeta.device_state: locked
• verifiedbootstate: green
• veritymode: enforcing
• secure: yes

Bootloader status:

• unlocked: no (from fastboot getvar)
• sys.oem_unlock_allowed: 0
• No OEM Unlock toggle in Developer Options
• settings put global oem_unlock_allowed 1 accepts but has no effect on sys.oem_unlock_allowed

What I tried:

1. fastboot oem unlock — regular fastboot mode has USB driver issues on Windows (MediaTek), device shows as "theloop" but fastboot commands don't reach it
2. fastbootd works perfectly but returns Unable to open fastboot HAL for oem unlock and Download is not allowed on locked devices for any flash command
3. mtkclient connects to BROM (0E8D:0003) — SBC: False, SLA: False, DAA: False (device is unprotected) but stage 2 upload fails without preloader (no DRAM init)
4. Cannot extract preloader via ADB (no root, permission denied on /dev/block/mmcblk0boot0)
5. DSU Sideloader installs GSI (both vanilla and gapps) successfully, gsi_tool status shows installed, gsi_tool enable succeeds, but device always boots back into stock — AVB blocks GSI boot
6. fastbootd fetch command not supported

BROM info from mtkclient:

• CPU: MT6877/MT6877V/MT8791N(Dimensity 900/1080/7050)
• HW code: 0x959
• SBC enabled: False
• SLA enabled: False
• DAA enabled: False
• Root cert required: False
• ME_ID: E5131140C51322CA96C8499E06B3BD90
• SOC_ID: F933EF779AD472C714BBADE93E77BB425F1D0341F7D557B93E0D6D6DBD8438FB

Partition layout includes: preloader_a (mmcblk0boot0), preloader_b (mmcblk0boot1), seccfg (mmcblk0p17), vbmeta_a (mmcblk0p7), init_boot_a (mmcblk0p33), boot_a (mmcblk0p31)

Questions:

1. Was your device already bootloader-unlocked out of the box? Mine clearly is not.
2. Does anyone have a preloader dump that could be used with mtkclient to bypass stage 2?
3. Has anyone found a way to unlock the bootloader on locked EEA units?
4. Is there a firmware version difference between unlocked and locked devices?

Happy to provide full property dump, partition list, or any other debug info.

Thanks!