Fixed the secure boot enrollment script

docs/secure-boot-keys.md

@@ -130,6 +130,35 @@ on a trusted/isolated network (see TODO #10).
 Only the **public** certs/`.esl`/`.auth` reach the workstation — never copy
 `PK.key`/`KEK.key`/`db.key` onto a host.
 
+### Troubleshooting `fleet-sb-enroll` (bench, 2026-06-20)
+
+**`dd: ... Invalid argument` (EINVAL) on the `db` write** = the firmware's
+`SetVariable` rejected the payload (EFI_INVALID_PARAMETER), *not* an auth/Setup
+Mode failure (that surfaces as EACCES / "Permission denied"). Diagnose top-down:
+
+- **Is the `.auth` actually a signed authenticated variable?** First 16 bytes are
+  an `EFI_TIME`: `sudo od -An -tx1 -N16 db.auth` → a valid one starts with the
+  year little-endian (2026 = `ea 07`). If it starts with `a1 59 c0 a5 …` it's a
+  bare **ESL** (the `sign-efi-sig-list` step was skipped); `30 82 …` is a raw DER
+  cert. Re-create the `.auth` (step 2) and re-bake.
+- **The 4-byte attribute prefix must contain its NUL bytes.** A bash *variable*
+  **cannot** hold NULs — `ATTR=$'\x27\x00\x00\x00'` silently truncates to the
+  single byte `0x27`, so efivarfs reads a corrupt attribute u32 and the kernel
+  returns EINVAL **before the firmware is even called**. This was a real bug in an
+  early `fleet-sb-enroll`; the fix emits the prefix with `printf '\x27\x00\x00\x00'`
+  at write time (never via a variable). If you hand-roll an enrolment, do the same.
+- **Proxmox / OVMF red herring:** VM EFI disks default to `pre-enrolled-keys=1`,
+  so `mokutil --db` shows the **Microsoft** cert (`Windows Production PCA 2011`,
+  owner `77fa9abd-…`) *even in Setup Mode*. This looks like a "db not empty →
+  rejected" problem but isn't — the write fails identically on a clean
+  `pre-enrolled-keys=0` disk if the NUL bug is present. For a clean OVMF test bed:
+  `qm set <vmid> --efidisk0 <storage>:1,efitype=4m,pre-enrolled-keys=0`.
+
+**Verified:** with the fix, a Proxmox VM enrols db→KEK→PK from the baked `.auth`
+files and boots the CI-signed UKI under **enforcing Secure Boot** over the HTTP
+boot path (`mokutil --sb-state` = enabled). The PXE/iPXE front-end additionally
+needs `snponly.efi` signed with `db` — see the iPXE section below.
+
 ## 4. Wire `db` into the build
 
 ```bash