How to unlock bootloader when I have EDL on XT1925-12

[Anonymous941]

I have a Verizon-locked bootloader on my XT1925-12. I managed to find test points to enter EDL mode, and connected to it successfully with https://github.com/bkerler/edl, but I can't get it to do anything useful because the loader has restrictions.

$ edl r sp sp.bin
Qualcomm Sahara / Firehose Client V3.62 (c) B.Kerler 2018-2025.
main - Trying with no loader given ...
main - Waiting for the device
......
main - Hint:   Press and hold vol up+dwn, connect usb. For some, only use vol up.
main - Xiaomi: Press and hold vol dwn + pwr, in fastboot mode connect usb.
        Run "./fastpwn oem edl".
main - Other:  Run "adb reboot edl".

...............
..............
............main - Device detected :)
sahara - Protocol version: 2, Version supported: 1
main - Mode detected: sahara
sahara - 
Version 0x2
------------------------
HWID:              0x0009a0e103680000 (MSM_ID:0x0009a0e1,OEM_ID:0x0368,MODEL_ID:0x0000)
CPU detected:      "SDM450"
PK_HASH:           0x1133d8b74398644e5870da2de179fc39e97f8be1d2fc1a6e6964cb4b4a3e1d28
Serial:            <redacted>

sahara - Detected loader: /home/user/Documents/Programming/Kindle recovery/edl/edlclient/../Loaders/lenovo_motorola/0009a0e103680000_1133d8b74398644e_fhprg_peek.bin
sahara - Protocol version: 2, Version supported: 1
sahara - Uploading loader /home/user/Documents/Programming/Kindle recovery/edl/edlclient/../Loaders/lenovo_motorola/0009a0e103680000_1133d8b74398644e_fhprg_peek.bin ...
sahara - 32-Bit mode detected.
sahara - Firehose mode detected, uploading...
sahara - Loader successfully uploaded.
main - Trying to connect to firehose loader ...
firehose_client
firehose_client - [LIB]: No --memory option set, we assume "eMMC" as default ..., if it fails, try using "--memory" with "UFS","NAND" or "spinor" instead !
firehose - TargetName=MSM8953
firehose - MemoryName=eMMC
firehose - Version=1
firehose - Trying to read first storage sector...
firehose - Running configure...
firehose - Storage report:
firehose - total_blocks:61071360
firehose - block_size:512
firehose - page_size:512
firehose - num_physical:3
firehose - mfr_id:21
firehose - serial_num:931385028
firehose - fw_version:1
firehose - mem_type:eMMC
firehose - prod_name:GD6BMB
firehose_client - Supported functions:
-----------------
firehose - 
Reading from physical partition 0, sector 573440, sectors 16384
firehose
firehose - [LIB]: range restricted: physical_partition_number=0, start_sector=573440, num_sectors=16384
firehose
firehose - [LIB]: ['range restricted: physical_partition_number=0, start_sector=573440, num_sectors=16384']

peek and poke are restricted too. When I decompile the loader in Ghidra I find this function:

undefined4
FUN_08038184(uint param_1,undefined4 param_2,uint param_3,uint param_4,uint param_5,int param_6)

{
  uint uVar1;
  uint extraout_r1;
  uint uVar2;
  undefined4 uVar3;
  uint uVar4;
  uint uVar5;
  undefined8 uVar6;
  uint local_70 [19];
  
  uVar3 = 0x48;
  uVar1 = param_4;
  uVar6 = FUN_08006c84(local_70,&DAT_08044958,0x48,param_4);
  uVar1 = FUN_0803f9b8(0x807a320,(int)((ulonglong)uVar6 >> 0x20),uVar3,uVar1);
  uVar4 = param_4 + param_6 + (uint)CARRY4(param_3,param_5);
  if (((param_1 == 0) &&
      (uVar5 = (extraout_r1 - 1) + (uint)(0x20 < uVar1),
      uVar5 < param_4 || param_4 - uVar5 < (uint)(uVar1 - 0x21 <= param_3))) &&
     (uVar4 < extraout_r1 || extraout_r1 - uVar4 < (uint)(param_3 + param_5 <= uVar1))) {
    return 1;
  }
  uVar1 = 0;
  do {
    if (param_1 == local_70[uVar1 * 6] && local_70[uVar1 * 6 + 1] == (int)param_1 >> 0x1f) {
      uVar5 = local_70[uVar1 * 6 + 2];
      uVar2 = local_70[uVar1 * 6 + 3];
      if ((uVar2 < param_4 || param_4 - uVar2 < (uint)(uVar5 <= param_3)) &&
         (uVar2 = uVar2 + local_70[uVar1 * 6 + 5] + (uint)CARRY4(uVar5,local_70[uVar1 * 6 + 4]),
         uVar4 < uVar2 ||
         uVar2 - uVar4 < (uint)(param_3 + param_5 <= uVar5 + local_70[uVar1 * 6 + 4]))) {
        return 1;
      }
    }
    uVar1 = uVar1 + 1;
    if (2 < uVar1) {
      FUN_0802b91c("range restricted: physical_partition_number=%d, start_sector=%lld, num_sectors=% lld"
                   ,param_1,param_3,param_4);
      return 0;
    }
  } while( true );
}

It's very frustrating, usually if you can manage to get the phone into EDL you can unlock the bootloader. But I'm not able to despite this running a very old version of Android (Android 9).