ecrypting image file breaks efi/boot of the guest/Ubuntu - ?

[lejeczek <peljasz@xxxxxxxxxxx>]

    Hi guys.
        
        I've have a guest and that guest differs from all other guest
        by:
        
          <os>
            <type arch='x86_64'
        machine='pc-q35-rhel9.0.0'>hvm</type>
            <loader readonly='yes' secure='yes'
type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
           
        <nvram>/var/lib/libvirt/qemu/nvram/ubusrv1_VARS.fd</nvram>
            <boot dev='hd'/>
            <bootmenu enable='yes'/>
          </os>
        
        whereas everything else has:
        
          <os>
            <type arch='x86_64'
        machine='pc-q35-rhel9.0.0'>hvm</type>
            <boot dev='hd'/>
            <boot dev='cdrom'/>
            <bootmenu enable='yes'/>
          </os>
        
        Now, that different guest fails - as the only one - to start, to
        boot after its qcow2 image was luks-encrypted.
        Guest starts but says that:
        
        BdsDxe: failed to load Boot0001 "Uefi Misc Device" from PciRoot
        (0x0)/Pci(0x2,0x3)/Pci(0x0,0x0): Not found
        
        revert back to original, non-encrypted qcow2 image and all works
        a ok.
        
        All and any thoughts shared are much appreciated.
        many thanks, L.