Comment 19 for bug 1867092

So the issue here appears to be that the new shim treats a failure to write MokListRT to nvram as a fatal error, even when not booting in SecureBoot mode, with the consequence that systems with no nvram space available will fail to boot.

This will take time to resolve upstream due to the requirement to go through a signing cycle with Microsoft for any new binaries. However, it sounds like the bug is well-characterized and we should be able to work with upstream for a proper fix.