Pixel 7 Android 17 CP31.260608.007: v30.7 patched init_boot returns to fastboot

[NightGlowww]

Device: Google Pixel 7 (panther)
Android version: 17 beta / CinnamonBun, build CP31.260608.007, SDK 37, security patch 2026-06-05
Magisk version name: 30.7 (tested both Magisk-v30.7.apk and app-debug.apk from the v30.7 release)
Magisk version code: 30700

Summary

On a Pixel 7 (panther) running Android 17 beta build CP31.260608.007, flashing a Magisk v30.7 patched init_boot.img causes an early boot failure and the device returns to bootloader/fastboot. Flashing the stock init_boot_b back immediately restores a normal boot.

This was reproduced with:

• Magisk-v30.7.apk from the v30.7 release, default patch flags (KEEPVERITY=false, KEEPFORCEENCRYPT=false)
• app-debug.apk from the v30.7 release, default patch flags (KEEPVERITY=false, KEEPFORCEENCRYPT=false)
• I also tried one manual stable-build patch with KEEPVERITY=true, KEEPFORCEENCRYPT=true; it failed the same way.

No Magisk modules were installed. The device had been freshly wiped by bootloader unlocking before the Magisk tests.

Reproduction steps

1. Download the official Google factory image:
   https://dl.google.com/developers/android/cinnamonbun/images/factory/panther_beta-cp31.260608.007-factory-083674f1.zip
2. Extract init_boot.img from image-panther_beta-cp31.260608.007.zip.
3. Patch init_boot.img with Magisk v30.7.
4. Reboot to bootloader.
5. Flash the patched image to the current slot:
   fastboot flash init_boot_b <patched-init_boot.img>
6. Reboot.

Expected behavior

The device should boot Android and Magisk should be installed.

Actual behavior

The device does not reach Android. After roughly 90 seconds, it returns to bootloader/fastboot.

After the failed boot, fastboot showed this relevant state:

current-slot: b
unlocked: yes
enter-reason: BL1 requested
slot-successful:b: no
slot-unbootable:b: no
slot-retry-count:b: 1

Restoring the original stock image always recovers the device:

fastboot flash init_boot_b stock_init_boot.img
fastboot reboot

The device then boots normally.

Image / environment details

Stock init_boot.img:

SHA256: da8c670f9dabee944ef05d78a51d71ab825530a6873e97255b55d4c828ff7230
Boot image header: 4
OS_VERSION: 17.0.0
OS_PATCH_LEVEL: 2026-06
RAMDISK_FMT: lz4_legacy
VBMETA: present

Patched image SHA256 values:

Magisk-v30.7.apk default patch: a3605fd51c0f8477aaeb1d7ce793ddd77af22d5433e647fe2937f256e825ef97
app-debug.apk v30.7 default patch: 0829b513282d926e0ecc85d1f23949262843fed116e307e7346f13dbac53e823
Magisk-v30.7.apk manual KEEPVERITY/KEEPFORCEENCRYPT true patch: 0df45157168201d0bd6c1dab889c59bc0f568b684194d170370e5998049c4f23

Patch log excerpt from the debug build:

- Unpacking boot image
HEADER_VER      [4]
OS_VERSION      [17.0.0]
OS_PATCH_LEVEL  [2026-06]
RAMDISK_FMT     [lz4_legacy]
VBMETA
- Checking ramdisk status
- Stock boot image detected
- Patching ramdisk
- Pre-init storage partition: sda8
Patch with flag KEEPVERITY=[false] KEEPFORCEENCRYPT=[false]
- Repacking boot image
Repack to boot image: [new-boot.img]

Working stock boot environment:

ro.product.model: Pixel 7
ro.product.device: panther
ro.build.fingerprint: google/panther_beta/panther:CinnamonBun/CP31.260608.007/15653239:user/release-keys
ro.build.version.release: 17
ro.build.version.sdk: 37
ro.build.version.security_patch: 2026-06-05
kernel: 6.1.162-android14-11-g5e8b0cffebd1-ab15202165
bootloader: cloudripper-17.0-15435019

Logs

I could not retrieve a kernel crash log for the failed boot. The device returns to bootloader before Android userspace is available, and after recovering with stock init_boot, /sys/fs/pstore is empty:

/sys/fs/pstore: total 0

Additional note

As a control, the same device can boot normally with stock init_boot.img. A KernelSU Next GKI2/LKM patch for android14-6.1 also boots on this build and provides root, so the stock factory image and bootloader state appear otherwise recoverable. This report is specifically about Magisk v30.7 patched init_boot.img returning the device to bootloader on Android 17 beta build CP31.260608.007.

As of 2026-06-29, the official canary.json and debug.json in topjohnwu/magisk-files point to Magisk 30.6, so I did not find a newer official canary/debug build to test beyond v30.7.

[RitaMoreno21]

/sys/fs/pstore: total 0

[RitaMoreno21]

/

[srt54558]

same issue it seems. bootloop on pixel 8 pro

[srt54558]

nevermind, magisk 30700 works perfectly fine on android 17, its a magisk module. @RitaMoreno21 ensure no pre-existing root modules block it, check adb logs when booting with a debug build

[canyie]

Magisk works perfectly on my Pixel 6a with cp31.260608.007. I think it is more likely caused by some modules 🤔

[rarenathan]

I'm having the same issue on my Pixel 9 on cp2a.260705.006

Works fine on Pixel 7 on its ver of cp2a.260705.006. Very weird.

[trumanhung]

Additional stock Android 17 data point: Magisk v30.7 successfully rooted a Pixel 11 Pro XL (kodiak) without the fastboot fallback reported here.

• Fingerprint: google/kodiak/kodiak:17/CD1A.260714.001.A9/15938155:user/release-keys
• Security patch: 2026-08-05
• Active slot: a
• Stock init_boot.img: 8,388,608 bytes; SHA-256 b0f444b06ca749a51452a1efb84b78d99d5a72e8026f8f6b151ed7d0a8f458d5
• Official Magisk v30.7 APK: SHA-256 e0d32d2123532860f97123d927b1bb86c4e08e6fd8a48bfc6b5bee0afae9ebd5
• Patch configuration: KEEPVERITY=true, KEEPFORCEENCRYPT=true, RECOVERYMODE=false, VENDORBOOT=false, PREINITDEVICE=sda12
• Patched image: 8,388,608 bytes; SHA-256 b366835684093ed876a63666d82bee5c3a64099c6bd6b212858f13e832b1d5a3
• Flashed only init_boot_a; vbmeta was untouched

The device completed boot normally without returning to fastboot. su -c id returned uid=0(root) with context u:r:magisk:s0; SELinux remained Enforcing.

No Magisk modules were installed. Zygisk was not enabled or tested. This only establishes success for the exact device/build and configuration above; it does not reproduce or invalidate the Pixel 7 failure.