I implemented the same two commands independently and ended up at the same place, so I have read this one closely and tested it against a macOS 26 (Tahoe) guest: with it applied the guest issues cmd 0x11/0x13 during boot and both are accepted (no more kSMCBadCommand), the boot-time key writes (NTOK, MSDW, QENA, HE0N) succeed, and get-key-type is answered for the keys it probes.
Reviewed-by: Daniel Golle <[email protected]> Tested-by: Daniel Golle <[email protected]> One minor observation on get-key-type: Inferring the type from the value length reports REV as "ch8*" (six bytes) rather than its documented "{rev" fourcc. The guest I traced accepts it and boots either way, so this is cosmetic -- just noting it in case you want to give the handful of typed keys (REV, the "flag"/"{fds" style keys) an explicit type later.
