Pluton TPM: EkCertIsAvailable false in MeasuredBoot despite valid EK certificate present (ASUS G614FR)

My device fails TPM attestation. Windows logs TPM-WMI Event ID 1040 (Error): "Pre-attestation integrity checks confirm a critical component failed and the device should not pass attestation."

The referenced MeasuredBoot JSON shows:

HealthStatus: "Cannot be attested"

Required fields:

• TpmPresent: true (desired: true) — PASS
• TpmMeetsMinimumVersion: true (desired: true) — PASS
• TpmIsResponsive: true (desired: true) — PASS
• TcgLogFound: true (desired: true) — PASS
• EkCertIsAvailable: FALSE (desired: true) — FAIL

Also reported false:

EkCertRsa2048IsAvailable, EkCertEccP256IsAvailable, EkCertEccP384IsAvailable, WindowsAikCertRsa2048IsAvailable, WindowsAikCertEccP256IsAvailable, WindowsAikCertEccP384IsAvailable

EkCertIsAvailable is the only failing required field.

THE PARADOX: Get-TpmEndorsementKeyInfo DOES return a valid manufacturer certificate:

Subject: CN=PlutonId [redacted], OU=6.4.1.400, O=Microsoft Corporation

Issuer: CN=[redacted], OU=DEVICE EKICA DFID00A60F11, O=Microsoft Corporation

Valid: 14/09/2021 to 15/12/2039

AdditionalCertificates: empty

So the EK certificate exists on the chip, but the Windows attestation subsystem reports it as unavailable.

tpmtool getdeviceinformation also contradicts the MeasuredBoot result:

• Ready For Attestation: True
• Is Capable For Attestation: True
• TPM Has Vulnerable Firmware: False
• PCR7 Binding State: Bound
• Maintenance Task Complete: True

SYSTEM:

• ASUS ROG Strix G16 G614FR
• AMD Ryzen 9 9955HX3D
• Microsoft Pluton (VendorId: Pluton.TPM.A), manufacturer MSFT, version 6.4.1.400
• TPM 2.0, spec 1.38
• BIOS G614FR.317 (latest available), EC G614FREC.308
• Windows 11, fully updated
• Secure Boot: Active, Platform Mode Deployed, all keys Factory
• Memory Integrity (HVCI): enabled
• Boot mode: UEFI/GPT

ALREADY TRIED (no change):

• BIOS updated from 316 to 317
• TPM cleared via Windows Security and via registry
• Secure Boot keys verified as factory defaults
• Windows fully updated
• Third-party network service (ExitLag) removed to rule out interference
• Minimal peripherals

This blocks Call of Duty RICOCHET remote attestation, which reports "BIOS Firmware: Update Required" even though the BIOS is already the latest version released by the OEM.

QUESTIONS:

1. Is this a known Pluton EK provisioning defect?
2. Why would Get-TpmEndorsementKeyInfo return a valid certificate while MeasuredBoot reports EkCertIsAvailable as false?
3. Is there a supported way to re-provision the EK certificate, or does this require an OEM firmware update?