Thanks for the super quick response and the fix, Gary. I had noticed that the variable delete request from the shim had different attributes and size=0, and thought that this was risky behavior. Interesting to see that this "gray area" in the EFI spec is implicated in _part_ of the problem.