Windows 11 25H2: Hypervisor remains active despite hypervisorlaunchtype=Off and VBS disabled — recurring HYPERVISOR_ERROR 0x20001 on cold boot

I am troubleshooting recurring BSODs on an HP ProBook 465 G11 with an AMD Ryzen 7 7735U, 64 GB RAM, Windows 11 Pro 25H2.

The problem occurs primarily during a cold boot after a full shutdown. The BSOD happens within the first few seconds of startup. An automatic restart normally boots successfully, and the computer is then stable even under heavy workloads.

Most of the BSODs I see on screen are:

HYPERVISOR_ERROR (0x20001)

Some early crashes do not create a minidump. Other captured startup crashes have produced 0x154, 0x139, 0x7E and 0xE1 bugchecks, so I am not assuming that Hyper-V itself is necessarily the root cause.

I am trying to perform a controlled diagnostic boot without the Windows hypervisor, but I cannot actually get the hypervisor to stop running.

Current configuration:

bcdedit /enum "{current}" → hypervisorlaunchtype Off

Windows Optional Features:

VirtualMachinePlatform → Disabled HypervisorPlatform → Disabled Microsoft-Hyper-V-All → Disabled Microsoft-Hyper-V-Hypervisor → Disabled

Device Guard registry:

HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard EnableVirtualizationBasedSecurity = 0

Group Policy:

Computer Configuration → Administrative Templates → System → Device Guard → Turn On Virtualization Based Security = Disabled

Credential Guard:

LsaCfgFlags = 0

HVCI:

HypervisorEnforcedCodeIntegrity\Enabled = 0 Locked = 0

Kernel Shadow Stacks:

Enabled = 0

Nevertheless:

systeminfo reports:

“A hypervisor has been detected. Features required for Hyper-V will not be displayed.”

And Win32_DeviceGuard reports:

VirtualizationBasedSecurityStatus = 2

while:

SecurityServicesConfigured = {0} SecurityServicesRunning = {0}

I then ran:

CiTool --list-policies

Most optional/lockdown policies are not enforced, but this policy is:

Friendly Name: Microsoft Windows Virtualization Based Security Policy Platform Policy: true Policy is Signed: true Has File on Disk: true Is Currently Enforced: true Is Authorized: true

My questions are:

1. Is this Microsoft-signed Virtualization Based Security Policy responsible for the hypervisor remaining active despite hypervisorlaunchtype Off and the VBS/Hyper-V settings above?
2. On current Windows 11 Pro 25H2, is there a Microsoft-supported method to perform a temporary diagnostic boot with the hypervisor genuinely not running?
3. Is this VBS platform policy expected behavior in 25H2, and is it intentionally non-disableable through the traditional Hyper-V/VBS controls?
4. Are there known issues involving this configuration and very-early-boot HYPERVISOR_ERROR (0x20001) crashes on AMD systems?

I am not looking for instructions to delete signed CI policies, modify EFI files, disable Secure Boot, or make unsupported registry changes. This is a production workstation, and I would specifically like to know the Microsoft-supported diagnostic procedure.

Thank you.