Windows 11 Insider Setup fails with 0x800B0109 before UEFI disk layout error

More info on problem:

Windows Update and the official Insider ISO both fail to complete Setup on this device.

Setup terminates before reaching partition selection, with:

"Windows can't be installed because this PC has an unsupported disk layout for UEFI firmware."

However, Panther logs (setupact.log / setuperr.log) show an earlier, more specific failure

during Authenticode signature verification of Facilitator.dll (and Mitigation.dll is

referenced but does not appear to exist as a standalone file in this build's install.wim),

returning error 0x800B0109 (CERT_E_UNTRUSTEDROOT).

I extracted Facilitator.dll directly from install.wim (index 6, Windows 11 Pro) inside the

official ISO (Windows11_InsiderPreview_Client_x64_en-us_29617_1000.iso) and inspected its

certificate chain manually:

Get-AuthenticodeSignature returns Status: UnknownError, with the underlying chain

terminating at:

Subject: CN=Microsoft Development Root Certificate Authority 2014

Issuer: CN=Microsoft Development Root Certificate Authority 2014 (self-signed)

Thumbprint: F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB

Intermediate:

Subject: CN=Microsoft Development PCA 2014

Thumbprint: 5F444A6740B7CA2434C7A5925222C2339EE0F1B7

Leaf:

Subject: CN=Microsoft Windows, O=Microsoft Corporation

Thumbprint: 1B5C9E0CFDFD9CD0744637D8B2D3B62B5081C467

NotBefore: 2025-05-15, NotAfter: 2026-08-11

This is an internal Microsoft development signing root, not part of the public trust chain,

which is why the file fails Authenticode verification on a standard, fully-patched consumer

system (this is expected behavior for a dev-signed file — the concern is that a

publicly-distributed Insider ISO appears to contain a component still signed with an

internal dev certificate rather than the production signing chain).

System context:

- Previous build: 26200.8894, with KB5121767 installed successfully

- UEFI boot, Secure Boot enabled, TPM 2.0 enabled

- SFC /scannow and DISM /RestoreHealth both completed with no integrity issues

- System clock verified correct; root certificate store refreshed via

certutil -generateSSTFromWU (returned "No Updates!", consistent with this root not

being part of the public WU root catalog)

- Confirmed by extracting Facilitator.dll directly from install.wim via DISM mount,

bypassing any local system state entirely — so this is a property of the ISO/build itself,

not a local misconfiguration

Requesting: please confirm whether this is a known signing issue in this specific flight,

and whether a corrected build/servicing update is planned.