r/androidroot • u/rafnafgaming • 14h ago
Support Xiaomi 17 Pro Max (popsicle) + PixelOS Android 17 — All Play Integrity verdicts failing. Need help diagnosing the cause.
Hey everyone,
I'm running a modified PixelOS Android 17 build on my Xiaomi 17 Pro Max (popsicle), and I'm having trouble with Play Integrity. I'm currently failing Basic, Device, and Strong Integrity. I'm looking for help identifying the underlying cause instead of blindly stacking modules or changing random settings.
Device and software
- Device: Xiaomi 17 Pro Max (2509FPN0BC)
- Codename:
popsicle - ROM:
PixelOS-popsicle-20261007-four-fixes_by_Kanoe - Android: 17 / API 37
- Firmware: HyperOS 3.0.319
- Security patch shown in Specter: 2026-10-01
- Root setup: KernelSU-based, with Zygisk-related components
- Bootloader: Modified-device setup; I want to verify the actual boot and attestation state rather than trust one tool's report.
Current Play Integrity results
- ❌
MEETS_BASIC_INTEGRITY - ❌
MEETS_DEVICE_INTEGRITY - ❌
MEETS_STRONG_INTEGRITY
None of the three verdicts are currently passing.
Current setup
The tools and modules involved include:
- Specter
- Play Integrity Fork v18
- HMA-OSS Zygisk
- Zygisk-related components
.BRENE - SuSFS- ZN - Audit Patch
- NoMount
- bindhosts
- Iconify
Specter currently displays:
- TEE backend:
TEESimulator - Keybox: TAKR 10 active
- Selected device profile: Pixel 6a
- Security patch: 2026-10-01
Some module names appeared repeatedly in my scrolling screenshots, but I haven't verified whether those are actual duplicate installations.
Duck Detector findings
My earlier Duck Detector report showed a few things that might be relevant:
- Fingerprint/build-tag mismatch Fingerprint:
Xiaomi/custom_popsicle/popsicle:17/CP2A.260605.016/eng.root:user/test-keysMeanwhile,Build.TAGSandro.build.tagsreportedly showrelease-keys. - SELinux policy finding SELinux is enforcing, but the report flagged an allowed
adbd -> adbroot:binderinteraction. I don't know whether this is expected for this ROM. - Attestation inconsistency Duck Detector reported a Google-rooted certificate chain and locked/verified boot state, while Specter explicitly shows
TEESimulator. I need to establish whether the reported attestation is genuinely hardware-backed. - Custom ROM environment The ROM contains LineageOS-derived components. Widevine reports L1, but the session is
NOT_PROVISIONED.
These are observations, not confirmed causes of the current failure.
What I need help with
- What could cause Basic Integrity itself to fail on this setup?
- How can I distinguish a Google Play services/checker issue from a ROM, root, or attestation issue?
- Could the fingerprint/build configuration or simulated TEE be contributing to the failure?
- How can I identify conflicting modules without randomly changing the entire setup?
- Is there a known issue with this PixelOS build or Android 17 on
popsicle? - What are my realistic options if I want genuine Play Integrity, especially Strong Integrity?
I'm looking for a proper diagnosis and reproducible troubleshooting steps. I don't want to risk bricking the device by flashing incompatible firmware or relocking the bootloader while a modified ROM is installed.
I can share the checker screenshot, Duck Detector report, module list, and relevant logs.






