CM5 Signed-boot network boot over TFTP aborts unconditionally ("Read boot.img failed", Error 12)

Start by reproducing on a CM5 with SIGNED_BOOT=1 and inspect uart.log alongside log.pcapng.txt. Compare the RRQ response and immediate ERROR 0 behavior across OACK and plain DATA responses. Done means the signed TFTP path downloads boot.img, requests boot.sig, and boots instead of aborting.

Describe the bug

With SIGNED_BOOT=1, TFTP network boot on BCM2712 never downloads boot.img.
The bootloader completes DHCP, ARPs the TFTP server, sends the RRQ (<serial>/boot.img, options tsize 0, blksize 1468), receives the server's first response packet (OACK or plain DATA — see below), then immediately sends TFTP ERROR 0 "Early terminate" and exits the boot mode:

 15.48 TFTP_GET: c8:4b:d6:77:bb:ad 192.168.0.102 d905d499/boot.img
 15.55 RX: 10 ... UDP RECV: 7          <- exactly one packet received after RRQ
 15.58 Boot mode: RESTART (0f) order 0
 15.56 Restart 0 max -1

and on some attempts, more verbosely:

 66.37 Read boot.img failed
 66.80 Error 12 loading boot.img
 66.83 Boot mode: NETWORK (02) order f

boot.sig is never requested. The device loops DHCP → RRQ → abort forever.

Without SIGNED_BOOT the same CM5 network boots fine — including with boot_ramdisk=1: an unsigned EEPROM with a loose config.txt containing just boot_ramdisk=1 downloads the identical 43 MB boot.img over TFTP from the same server in ~13 s and boots it.
So the ramdisk loader and the TFTP transport both work; only the signed path aborts, and it aborts before any data block is transferred, regardless of file size (8 MB fails identically) or server behaviour (OACK with either option order, tsize-only, blksize-only, and plain option free DATA all get the same instant abort). A CM4 (BCM2711) with the equivalent SIGNED_BOOT configuration, same key, same server
and same boot.img/boot.sig downloads and boots over TFTP without issues.

Steps to reproduce the behaviour

1. CM5 (tested: 2 GB, rev b04180), EEPROM with SIGNED_BOOT=1, customer pubkey, BOOT_ORDER=0xf2, OTP not fused (also reproduces before/after the 2026-02-23 partition-walk fix).
2. Any TFTP server serving a signed boot.img + boot.sig (any size).
3. DHCP with option 66 / siaddr pointing at the server.
4. Boot. Wireshark shows RRQ + server response + client ERROR "Early terminate";
   BOOT_UART shows the log above.

Device (s)

Raspberry Pi CM5

Bootloader configuration.

[all]
SIGNED_BOOT=1
BOOT_UART=1
BOOT_ORDER=0xf2

System

Bootloader versions:

Release	Version	Result
2025-12-08	2226a853	RRQ → abort
2026-02-06	8124798b	RRQ → abort (immediately exits boot mode — pre partition-walk fix)
2026-05-26 (default)	086b83e3	RRQ → abort, retries per 2026-02-23 fix
2026-06-29 (latest)	f68405bc	RRQ → abort

Bootloader logs

uart.log

USB boot

This issue is specific to TFTP.

NVMe boot

This issue is specific to TFTP.

Network (TFTP boot)

Form doesn't allow me to upload wireshark .pcapng files, so I've appended .txt to the file name.
log.pcapng.txt