Widevine device provisioning returns HTTP 401 and 400 on Android devices

We are seeing a spike in Widevine device certificate provisioning failures on a subset of Android devices.

The provisioning request to: certificateprovisioning/v1/devicecertificates/create returns HTTP 400 before any license request is made.

Response:

androidx.media3.exoplayer.drm.MediaDrmCallbackException:
  Got provisioning response: code=400 systemId=35703 uniqueDeviceId=<redacted>
Caused by: androidx.media3.datasource.HttpDataSource$InvalidResponseCodeException: Response code: 400

{
  "error": {
    "code": 400,
    "message": "Invalid Value",
    "errors": [
      {
        "message": "Invalid Value",
        "domain": "global",
        "reason": "invalid"
      }
    ]
  }
}

The provisioning request is generated by the Widevine CDM and forwarded by Media3 via HttpMediaDrmCallback.executeProvisionRequest()
using the request's data and defaultUrl unchanged.
The resulting error is:

androidx.media3.exoplayer.drm.MediaDrmCallbackException:
  Got provisioning response: code=400

Top affected devices:

• MT9633 | MediaTek TV | Spike starting Aug 26, 2026
• SM-S948B | SM8850 | Concentration of errors on Aug 26, 2026
• RMX5056 | MT6878 | Errors appearing Aug 27, 2026
• CPH2747 | SM8850 | Persistent for >1 month

Questions:

• Is there a known provisioning-service change/incident affecting these devices around Aug 24–27, 2026?
• Are any of these systemIds/devices revoked (expected permanent failure)?
• Did Play services v26.33 change the updatable Widevine CDM in a way that affects provisioning request formatting?