Device: Samsung Galaxy Tab A 8.0 2019 (SM-T290) GTOWIFI
Android version: 15
LineageOS 22.2
Build: lineage-22.2-20260701-nightly-gtowifi
Magisk version name: 30.7
Magisk version code: 30700
Bootloader:
Unlocked
Download Mode reports:
OEM LOCK: OFF (U)
KG STATUS: Checking
AP SWREV: K5 S5
Problem
After patching the stock LineageOS boot.img with Magisk and flashing it, the device immediately fails before Android starts.
The bootloader shows:
Secure Check Fail: boot.img
The original unmodified LineageOS boot.img boots normally.
The patched image was created directly from the original boot.img using Magisk ("Select and Patch a File") without any manual modifications.
The device never reaches Android after flashing the patched image, therefore no magisk.log can be generated.
No Magisk modules are installed.
Investigation
I compared the original boot image with the Magisk patched image.
The original image contains both Samsung metadata strings:
SEANDROIDENFORCE
SignerVer02
The patched image still contains:
However, the Samsung-specific SignerVer02 metadata is completely missing.
Verified offsets:
Original boot.img
SEANDROIDENFORCE @ 15054848
SignerVer02 @ 15054864
AVB0 @ 15056896
AVBf @ 67108800
Magisk patched image
SEANDROIDENFORCE @ 14968832
SignerVer02 NOT FOUND
AVB0 @ 14970880
AVBf @ 67108800
Relevant information
The LineageOS maintainer recently added Samsung-specific metadata generation for this exact device:
LineageOS/android_device_samsung_gtowifi@2bb8adf
Commit title:
gtowifi: add support for all bootloaders by adding Samsung metadata
The commit message explains that newer Samsung Wingtech bootloaders require the SignerVer02 metadata even when the bootloader is unlocked.
Question
Could MagiskBoot preserve or recreate this Samsung metadata when rebuilding boot.img?
Based on my investigation, the original boot image contains the Samsung SignerVer02 metadata while the Magisk patched image does not.
Could the removal (or failure to preserve) this metadata explain why the bootloader rejects the patched image with:
Secure Check Fail: boot.img
Files
Original boot image:
boot.zip
Magisk patched boot image:
magisk_patched-30700_RayaJ.zip
Screenshot of the bootloader error:
Device: Samsung Galaxy Tab A 8.0 2019 (SM-T290) GTOWIFI
Android version: 15
LineageOS 22.2
Build: lineage-22.2-20260701-nightly-gtowifi
Magisk version name: 30.7
Magisk version code: 30700
Bootloader:
Unlocked
Download Mode reports:
OEM LOCK: OFF (U)
KG STATUS: Checking
AP SWREV: K5 S5
Problem
After patching the stock LineageOS
boot.imgwith Magisk and flashing it, the device immediately fails before Android starts.The bootloader shows:
The original unmodified LineageOS
boot.imgboots normally.The patched image was created directly from the original
boot.imgusing Magisk ("Select and Patch a File") without any manual modifications.The device never reaches Android after flashing the patched image, therefore no
magisk.logcan be generated.No Magisk modules are installed.
Investigation
I compared the original boot image with the Magisk patched image.
The original image contains both Samsung metadata strings:
The patched image still contains:
However, the Samsung-specific
SignerVer02metadata is completely missing.Verified offsets:
Original boot.img
Magisk patched image
Relevant information
The LineageOS maintainer recently added Samsung-specific metadata generation for this exact device:
LineageOS/android_device_samsung_gtowifi@2bb8adf
Commit title:
The commit message explains that newer Samsung Wingtech bootloaders require the
SignerVer02metadata even when the bootloader is unlocked.Question
Could MagiskBoot preserve or recreate this Samsung metadata when rebuilding
boot.img?Based on my investigation, the original boot image contains the Samsung
SignerVer02metadata while the Magisk patched image does not.Could the removal (or failure to preserve) this metadata explain why the bootloader rejects the patched image with:
Files
Original boot image:
boot.zip
Magisk patched boot image:
magisk_patched-30700_RayaJ.zip
Screenshot of the bootloader error: