As far as I can tell, this is exposing a pre-existing race condition in EndOfDxe. It just so HAPPENS that the old "Disable RequestToLock" callback executed after this TcgMor callback, whereas the new VariablePolicy callback executes first.

I'm going to poke around for a solution, but this seems like an architectural problem with EndOfDxe.

On Wed, Sep 23, 2020 at 6:02 AM Laszlo Ersek <lersek@redhat.com> wrote:
Hi Bret,

On 09/23/20 08:12, Bret Barkelew via groups.io wrote:
> To whom it may concern,
> This is as done as it’s going to get.
>
> Thank you all for your help!

I tried to merge this via <https://github.com/tianocore/edk2/pull/954>,
but it failed. Please review the build report, and submit v9 if necessary.

Thanks!
Laszlo