Replying to myself, it wasn't stupid, the menuconfig is confusing and over-cautious. When you turn on secure boot the menu turns on "Permanently disable ROM Download Mode". You have to turn on "Allow potentially insecure options" then go into "Potentially insecure options --->" and turn on "Don’t au...

Is it possible to re-flash the user program in a device secured with SB V2 or is it permanently burned?

If it can be re-flashed, then what's the procedure? I've read the docs many times, and it's obviously possible with V1, but I can't see how it's done in V2.

Try reflashing with

idf.py encrypted-app-flash

add port if needed and "monitor" if you want, ie idf.py encrypted-app-flash monitor

You're welcome, and we've *all* done it and I still do it after 40 years of coding. That's just C. It's powerful, it's down on the metal, and it doesn't protect you from yourself. It's a nicer way to write assembler than writing assembler, and assembler won't protect you either. However, the ESP-32 ...

Per my first post, I've tried turning encryption back on and re-flashing, without any change. I went back through the history of changes, and I think what might have happened is that I set the NVS partition to "encrypted" in the partition table along with the code partition (it made sense to encrypt...

Fuses: EFUSE_NAME Description = [Meaningful Value] [Readable/Writeable] (Hex Value) ---------------------------------------------------------------------------------------- Identity fuses: MAC Factory MAC Address = 24:0a:c4:e8:2b:18 (CRC 0xbf OK) R/W CHIP_VER_REV1 Silicon Revision 1 = 1 R/W (0x1) CH...

You declare ..
.. then set two elements of a 1 element array ..
Standard C bug - array overflow.

Genuine ESP32 Devkit-C (D0WD V3 chip), ESP IDF V4.1, no 3rd party tools, under Windows 10. I tried turning on the flash encryption (developer mode) in the menu. Build was OK, flash was OK, all ran fine. After turning encryption off, rebuilding and flashing again, the device now just repeats the foll...