Hacker News Reader

I would assume bootloader unlocked, I believe that causes SafetyNet to fail and can't imagine why a carrier unlocked phone would.

Yeah, an unlocked bootloader passes androidboot.verifiedbootstate=ORANGE to the kernel cmdline.

That said, the kernel could just lie about what was passed to it sooooo...