diff --git a/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD b/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD
index bb1fe541c..960ee3ed3 100644
--- a/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD
+++ b/device/testing/linux-postmarketos-qcom-sm8550/APKBUILD
@@ -5,7 +5,7 @@ maintainer="snlavaise <snlavaise@gmail.com>"
 _flavor="postmarketos-qcom-sm8550"
 pkgname=linux-$_flavor
 pkgver=7.2
-pkgrel=11
+pkgrel=12
 pkgdesc="Mainline kernel for Qualcomm SM8550 (Snapdragon 8 Gen 2) + Motorola rtwo"
 arch="aarch64"
 _carch="arm64"
@@ -60,6 +60,12 @@ prepare() {
 		sed -i '/sm8550-mtp\.dtb/a dtb-$(CONFIG_ARCH_QCOM) += sm8550-motorola-rtwo.dtb' \
 			"$_dtsdir/Makefile"
 	fi
+	# Build this DTB with -@ so it gets a /__symbols__ node. The Motorola
+	# SM8550 ABL runs its dtbo-apply path (libufdt) against the base DTB
+	# and drops to the bootloader menu if the symbols are missing.
+	if ! grep -q "DTC_FLAGS_sm8550-motorola-rtwo" "$_dtsdir/Makefile"; then
+		echo 'DTC_FLAGS_sm8550-motorola-rtwo := -@' >> "$_dtsdir/Makefile"
+	fi
 
 	# Base config (from linux-postmarketos-mainline) + rtwo bring-up fragment.
 	cp "$srcdir/config-motorola-rtwo.aarch64" .config
@@ -106,5 +112,5 @@ sha512sums="
 52d5aa7f94f6aa6141debf4ceb4fc7a2e75505a7cd38b8854e501be83c2b57863020f463f2fdb2fc93667e6cfe13274d077e5207a611e4797bd9404ee0e64c58  linux-postmarketos-qcom-sm8550-7.2.tar.gz
 f9ae52489f6b9e6fef64952943cd09732a5bef90a0e8765db03c256483028368687d6d5a1d80dd813a513e7e80d91f8b47f49b91cff67266b76f1d6275a7fea0  config-motorola-rtwo.aarch64
 53441c23146d76bb0eaa358a25f6cce4f21740cfb65b755df52bbb218daf2cda30b3d80fa6ca4e283ea1afe2b0fa708307b678b421898100710b8fb99b08d6c5  rtwo.config
-91f6a22d1c3ae0a2919cdc8d31adb3bb0ef8db0ba9e3b1608eeefc9460ccf19704d54e09338556aa735c3a875a73107785ab33a795d48ad86febc1abd3ad5aba  sm8550-motorola-rtwo.dts
+f05e6c76e546c1287bbfc228e3953c5ef3646a99cf42f21c113debc8846d7442419df685f8f94feb329e60341a0e1bb47f29bdebd49b0f1c0fd097a6a3faa4d5  sm8550-motorola-rtwo.dts
 "
diff --git a/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts b/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts
index cb2afb4d2..3f5d6d314 100644
--- a/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts
+++ b/device/testing/linux-postmarketos-qcom-sm8550/sm8550-motorola-rtwo.dts
@@ -11,10 +11,19 @@
  *   - only the debug UART and USB (high-speed peripheral) are enabled,
  *     enough to reach the initramfs and bring up USB networking
  *
- * Unlike Sony, this DT does carry qcom,msm-id / qcom,board-id (the
- * Motorola ABL selects a DTB from a multi-FDT vendor_boot) and a
- * ramoops reserved-memory region (console survives a failed boot),
- * both taken from the DT the stock firmware runs.
+ * Unlike Sony, this DT carries several things the Motorola SM8550 ABL
+ * and hypervisor need, all taken from the DT the stock firmware runs:
+ *   - qcom,msm-id / qcom,board-id + the qcom,kalama* compatibles, so the
+ *     ABL accepts this blob out of its multi-FDT vendor_boot
+ *   - qcom_tzlog / arch_timer labels + dtc -@ (__symbols__), without
+ *     which the SM8550 ABL bails to the bootloader menu when it tries to
+ *     apply a dtbo (see the LKML "sm8550: Fix DTBO boot failure" thread)
+ *   - the chipinfo and llcc_lpi no-map carveouts, which mainline
+ *     sm8550.dtsi lacks and the ABL does NOT reconstruct - if Linux uses
+ *     that memory the hypervisor faults the access and the SoC resets
+ *     with no console output (the <2s reboot we were chasing; the
+ *     mainline Samsung Galaxy Tab S9 port hit the same "NoC error")
+ *   - a ramoops region so a failed boot's console survives
  */
 
 /dts-v1/;
@@ -31,13 +40,20 @@
 
 / {
 	model = "Motorola Moto Edge 40 Pro";
-	compatible = "motorola,rtwo", "qcom,sm8550";
+	/*
+	 * "qcom,kalama*" (the downstream SoC name) is kept alongside
+	 * "qcom,sm8550": the Motorola ABL matches the board against these
+	 * strings *and* qcom,board-id before it will launch the kernel
+	 * (the mainline Samsung SM8550 port needed the same).
+	 */
+	compatible = "motorola,rtwo", "qcom,kalama-mtp", "qcom,kalama",
+		     "qcom,mtp", "qcom,sm8550";
 	chassis-type = "handset";
 
 	/*
-	 * The Motorola ABL does DTB selection (its stock vendor_boot carries
-	 * several concatenated FDTs). Carry the SoC/board match table from the
-	 * DT the stock firmware runs so the bootloader accepts this blob:
+	 * SoC/board match table, verbatim from the DT the stock firmware
+	 * runs, so the ABL accepts this blob out of its multi-FDT
+	 * vendor_boot:
 	 *   qcom,msm-id  = <0x218 0x20000  0x207 0x20000  0x207 0x10000  0x218 0x10000>
 	 *   qcom,board-id = <0x241 0xb1b0>
 	 */
@@ -49,7 +65,11 @@
 		serial0 = &uart7;
 	};
 
-	chosen {
+	/*
+	 * The 'qcom_tzlog' label must exist (on any node) or the SM8550 ABL
+	 * refuses to apply a dtbo and drops to the bootloader menu.
+	 */
+	qcom_tzlog: chosen {
 		stdout-path = "serial0:115200n8";
 	};
 
@@ -68,6 +88,23 @@
 			console-size = <0x40000>;
 			record-size = <0x20000>;
 		};
+
+		/*
+		 * no-map carveouts that mainline sm8550.dtsi does not have and
+		 * the Motorola ABL does not inject. Both sit inside a HLOS DRAM
+		 * bank, so without them Linux maps and uses memory the SoC has
+		 * handed to firmware/hardware -> external abort -> silent reset.
+		 * Addresses/sizes are verbatim from the stock DT.
+		 */
+		chipinfo@81cf4000 {
+			no-map;
+			reg = <0x0 0x81cf4000 0x0 0x1000>;
+		};
+
+		llcc-lpi@ff800000 {
+			no-map;
+			reg = <0x0 0xff800000 0x0 0x600000>;
+		};
 	};
 
 	vph_pwr: vph-pwr-regulator {
@@ -81,6 +118,16 @@
 	};
 };
 
+/*
+ * The SM8550 ABL also needs an 'arch_timer' label on the timer node
+ * before it will apply a dtbo. Re-opening /timer by name just attaches
+ * the label to the node sm8550.dtsi already defines.
+ */
+/ {
+	arch_timer: timer {
+	};
+};
+
 &apps_rsc {
 	regulators-0 {
 		compatible = "qcom,pm8550-rpmh-regulators";