Why does my M1 Macbook Pro have an i386 efi partion on /Preboot?
I got a 2021 M1 Macbook Pro. It was sent to Apple Repair some months back, and was gone for an inordinate amount of time (over 1 month). It’s been acting a little weird for a while and a few days ago, I poked around it. It appears to have either an EFI partition on it (an i386 EFI partition), in /Volume/Preboot, there is a directory (it’s name is a GUID or UUID of some type), and in it there is an EFI directory and inside that an i386 directory, which contains a few folders and some .efires files. It also seems to be reinstalling the Preboot partition at every boot or shutdown, and it also seems to install Rosetta (2?) somehow.
I’m unable to get rid of Rosetta, it’s either reinstalling it or recreating the folder structure and files or perhaps it is on a sealed volume or snapshot. Doing a full DFU restore does nothing, as well, it seems to download all of this from Apple Servers (gdmf, in particular).
This makes me a bit uncomfortable, as I know that Rosetta can be used to bypass macOS security features somehow, and the fact that a restore (not revive) DFU doesn’t get rid of the efi files or Rosetta (oahd) is puzzling. What’s odder is that Rosetta interferes with upgrades, I think, my Install logs keep mentioning that Rosetta is installed with a “FATAL” message next to it. In addition, the console logs are full of RSA security verification errors from (I think) trustd. It also has some Apple Experiments on it, which may be left over from the repair process, according to the internet search, or at least the framework to use them.
It’s a fresh Sequoia 15.1 install, and I’m also unable to access some parts of the system, even with “csrutil disable”, permissive secuirty and DevToolsSecurity enabled (or disabled, for that matter), as certain directories appear empty using my account or root, but using the “cat” command and autocompletion reveals that there are files in those directories, and it will list a few entries and then give an error message about being unable to access the item). As I said, DFU restores and revives do not change anything. Also, the Macintosh HD is a sealed snapshot, so a lot of the changes never stick after the DFU restore. I also can’t run diagnostics unless I got to Apple’s self repair site and set up a session (it will only do the offline diagnostics, and returns “no session found” if I try to run diagnostics online as a regular user (me) is supposed to do it. I’m assuming that it has something to do with the repair process and pretty much ignored it until the logs started talking about remote sessions and connections, even if most of them report failure (I’m not sure if the sessions are from persons or processes). As I’ve said, I’ve done DFU restores many times with no difference and, of course, I’ve changed my passwords several times.
How do I get rid of these, and how do I stop the RSA verification errors (no certificate found, I believe) and not have Rosetta just installing like that?
MacBook Pro (2021)