[138a:0090] VFS7500 W25Q80B: 5 partitions + FF cert, 0404 on partition/write, 04af on erase — no recovery path - Thinkpad T460p

[soulsplit]

I'm on a Thinkpad T460p and I cannot get the fingerprint reader to work.
Here's what I was able to extract with the help of AI:

Device: Validity VFS7500 138a:0090, flash W25Q80B 1MB, host 20FWCTO1WW (ThinkPad)
OS: Linux Mint 22.3 (noble), Python 3.12, libusb-1.0 1.0.27, pyusb 1.2.1
Packages: open-fprintd 0.7ppa2, python3-validity 0.15ppa2 (uunicorn PPA)

State: 5 correct 0090 partitions, cert area FF/ffff (also seen as 11 entries with garbage tail + 04af on cert read — see dump).

• stock initializer (3v1n0 proto9x, no signature): partition_flash -> 0404
• signed re-partition (0090 layout + partition_signature_0090): -> 0404
• plain write_flash(1,0) (partition lvl 7, FF, no erase): -> 0404
• service init_flash: formats from 0 OK, TLS cert + ECDH OK, erase_flash(1) -> 04af (init_flash.py:172)
• factory_reset OK but table persists over warm reboot; get_flash_info flaky (0401/timeout) until send_init

Expected: recovery path for partitions>0 + empty cert on 0090 (init_flash returns early when partitions exist, then read_tls_flash fails).

Related: #272 (009a busy/empty-flash; retry + short-reply tolerance applied locally — early flakes gone, write lock remains).

Evidence: https://gist.github.com/soulsplit/f767843c0ad5f010054b2ac2912f1379