fix(firmware): set vbmeta AVB flags to 0x01 to prevent Android 16 fastboot lock

The vbmeta patch routine previously forced AVB flags to 0x03. On Android 16 base builds (for example Xiaomi 17), this can lead to persistent fastboot boot failure after flashing.

This change updates _patch_vbmeta() to write 0x01 at the AVB flags offset (123) instead of 0x03, preserving the intended AVB relaxation while avoiding the device-specific fastboot lock behavior.

What changed:

- Updated FLAGS_TO_SET from b"\x03" to b"\x01" in FirmwareModifier._patch_vbmeta().

- Added a focused regression test that creates a synthetic vbmeta image with AVB magic and verifies byte offset 123 is patched to 0x01.

Verification:

- .venv/bin/pytest -q tests/core/test_firmware_modifier.py

- .venv/bin/pytest -q tests/test_workflow.py

Co-authored-by: Codex <codex@openai.com>

Author: toraidl

src/core/modifiers/firmware_modifier.py

@@ -95,7 +95,8 @@ def _patch_vbmeta(self):
 
         AVB_MAGIC = b"AVB0"
         FLAGS_OFFSET = 123
-        FLAGS_TO_SET = b"\x03"
+        # Use AVB flag 0x01 to avoid fastboot bootloop issues on Android 16 base builds.
+        FLAGS_TO_SET = b"\x01"
 
         try:
             with open(vbmeta_img, "r+b") as f:

tests/core/test_firmware_modifier.py

@@ -0,0 +1,34 @@
+from pathlib import Path
+from types import SimpleNamespace
+
+from src.core.modifiers.firmware_modifier import FirmwareModifier
+
+
+def _build_context(tmp_path: Path) -> SimpleNamespace:
+    magiskboot = tmp_path / "magiskboot"
+    magiskboot.write_bytes(b"stub")
+
+    repack_images = tmp_path / "target" / "repack_images"
+    repack_images.mkdir(parents=True, exist_ok=True)
+
+    return SimpleNamespace(
+        target_dir=tmp_path / "target",
+        tools=SimpleNamespace(magiskboot=magiskboot),
+        device_config={},
+    )
+
+
+def test_patch_vbmeta_sets_avb_flags_to_one(tmp_path: Path):
+    ctx = _build_context(tmp_path)
+    vbmeta_img = ctx.target_dir / "repack_images" / "vbmeta.img"
+
+    payload = bytearray(256)
+    payload[0:4] = b"AVB0"
+    payload[123] = 0x00
+    vbmeta_img.write_bytes(payload)
+
+    modifier = FirmwareModifier(ctx)
+    modifier._patch_vbmeta()
+
+    patched = vbmeta_img.read_bytes()
+    assert patched[123] == 0x01