From bcfb7dc680daaa226fd7bda33adea59cce96ce6f Mon Sep 17 00:00:00 2001
From: Alex Zenla <alex@edera.dev>
Date: Sat, 26 Sep 2026 18:13:06 -0700
Subject: [PATCH] fix(shim): take security arch2 boot_policy as a UEFI Boolean

The firmware passes BootPolicy as a UEFI BOOLEAN (a u8). Declaring it
as a Rust bool in the extern signature is undefined behavior for any
value other than 0 or 1. Use uefi_raw::Boolean instead.
---
 crates/eficore/src/shim/hook.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/crates/eficore/src/shim/hook.rs b/crates/eficore/src/shim/hook.rs
index 2aac139..72d99d1 100644
--- a/crates/eficore/src/shim/hook.rs
+++ b/crates/eficore/src/shim/hook.rs
@@ -6,7 +6,7 @@ use spin::{LazyLock, Mutex};
 use uefi::proto::device_path::FfiDevicePath;
 use uefi::proto::unsafe_protocol;
 use uefi::{Guid, guid};
-use uefi_raw::Status;
+use uefi_raw::{Boolean, Status};
 
 /// GUID for the EFI_SECURITY_ARCH protocol.
 const SECURITY_ARCH_GUID: Guid = guid!("a46423e3-4617-49f1-b9ff-d1bfa9115839");
@@ -33,7 +33,7 @@ pub struct SecurityArch2Protocol {
         path: *const FfiDevicePath,
         file_buffer: *const u8,
         file_size: usize,
-        boot_policy: bool,
+        boot_policy: Boolean,
     ) -> Status,
 }
 
@@ -137,7 +137,7 @@ impl SecurityHook {
         path: *const FfiDevicePath,
         file_buffer: *const u8,
         file_size: usize,
-        boot_policy: bool,
+        boot_policy: Boolean,
     ) -> Status {
         // Verify the path and file buffer are not null.
         if path.is_null() || file_buffer.is_null() {
@@ -145,7 +145,7 @@ impl SecurityHook {
         }
 
         // If the boot policy is true, we can't continue as we don't support that.
-        if boot_policy {
+        if bool::from(boot_policy) {
             return Status::INVALID_PARAMETER;
         }