In the first iteration through the second for loop, MD_NUM_SLOTS(md) appears to have a value of 24 and since target_slot is always 0, it never reaches the 'continue' statement. With current builds, &target appears to have a value of 3faee138. U-Boot appears to send this address to map_to_sysmem() [1] which seems to return 0, which is then what results in the EFI_NOT_FOUND. I went back to try figure out why it is somehow working when I block the 'break' statement with the condition status == EFI_SUCCESS. Doing so causes the loop to start its second iteration when EFI_NOT_FOUND comes back. In the second iteration, MD_NUM_SLOTS(md) is 0 so we reach the 'continue' statement. This happens for the third and fourth iteration too. On the fifth iteration, MD_NUM_SLOTS(md) is 443 so it makes its second call to efi_allocate_pages(). On all iterations, target_slot remains 0. What is confusing is this second call to efi_allocate_pages() seems to have the same value for &target of 3faee138, but this time when U-Boot calls map_to_sysmem() it returns a value of 88080384 instead of 0. As a result, we get EFI_SUCCESS and the kernel boots. U-Boot also reports a new reservation in its lmb map between the first and second calls to efi_allocate_pages(). During first call to efi_allocate_pages(): lmb_dump_all: memory.count = 0x1 memory[0] [0x0-0x3fffffff], 0x40000000 bytes, flags: none reserved.count = 0x5 reserved[0] [0x4000000-0x41fffff], 0x200000 bytes, flags: none reserved[1] [0x4400000-0x53fffff], 0x1000000 bytes, flags: none reserved[2] [0x3dae3000-0x3e2c8fff], 0x7e6000 bytes, flags: no-overwrite, no-map reserved[3] [0x3ea6c000-0x3eaedfff], 0x82000 bytes, flags: no-overwrite, no-map reserved[4] [0x3eaee960-0x3fffffff], 0x15116a0 bytes, flags: no-map During second call to efi_allocate_pages(): lmb_dump_all: memory.count = 0x1 memory[0] [0x0-0x3fffffff], 0x40000000 bytes, flags: none reserved.count = 0x6 reserved[0] [0x0-0x113ffff], 0x1140000 bytes, flags: no-overwrite, no-map reserved[1] [0x4000000-0x41fffff], 0x200000 bytes, flags: none reserved[2] [0x4400000-0x53fffff], 0x1000000 bytes, flags: none reserved[3] [0x3dae3000-0x3e2c8fff], 0x7e6000 bytes, flags: no-overwrite, no-map reserved[4] [0x3ea6c000-0x3eaedfff], 0x82000 bytes, flags: no-overwrite, no-map reserved[5] [0x3eaee960-0x3fffffff], 0x15116a0 bytes, flags: no-map [1] https://github.com/u-boot/u-boot/blob/master/lib/efi_loader/efi_memory.c#L493
