HGST/WD “CCB” drives stuck DEGRADED (0xF75D media self-test): 1-byte FCOD ROM fix + tool

TL;DR

Drives in the HGST/WD “CCB” enterprise helium family (Leo-B-HE14, etc.) that boot in DEGRADED mode with Degraded Reason = 0xF75D (UEC_MEDIA_SELFTEST_FAILED) often show the same pattern: SA reads fine, the entire user area returns UNC, translator recalculation aborts, and any RAM or SA write simply retriggers the self-test.

These drives can be brought up READY with the user area accessible by setting bit 0 of byte 0x34 in the FCOD module and fixing that module's checksum. FCOD is stored uncompressed in ROM, so this is a straightforward ROM edit that can be flashed externally with a programmer. No SA write is required, and there is no need to unpack or repack compressed code (CODF).

A tool is attached that applies the patch to any CCB ROM.

Symptoms

• Slow ready-up, SA accessible, entire user area returns UNC
• Translator recalculation aborts
• Log-module writes denied (0xF827 ACCESS_DENIED)
• Degraded Reason = 0xF75D, Broken Reason = 0x00 (not flagged physical)
• The verdict is recomputed on every boot. It exists only in the event logs (LGEV, LGAT, etc.) as history and is not stored in the self-test state modules (SLFV, GDST, SMSP, SMSE, etc.), so there is no flag that can be cleared through the usual methods.

Why the usual approaches fail

• This is a firmware lockout rather than corruption. VSTT and the defect lists (MDEF, GLST, PTBL) remain intact, so the translator recalc failure is caused by degraded-mode restrictions.
• There is a write → self-test deadlock. Any RAM or SA write forces the firmware to re-ready, which reruns the failing self-test and puts the drive back into degraded mode before the write can take effect. That means you cannot patch degraded_reason in RAM or rewrite a module to fix it.
• The only deadlock-free surface is the ROM, which can be flashed externally. FCOD is stored there uncompressed, making the workaround practical.

What the firmware is actually doing

Disassembling the decompressed main image (CODF section 3) shows that the boot/ready state machine reads FCOD[0x34] and branches based on three independent bits:



The important detail is that bit0 branches to the same target used by the firmware's "self-test already passed" flag. In other words, bit0 effectively tells the firmware to behave as if the test has already succeeded.

A note for anyone who tried the obvious approach first: setting bit7 (the bit that looks like a self-test disable flag) does prevent the 0xF75D degradation, but it leaves the drive stuck at OM_SPINNING with the reserved area never loaded. The bit7 path eventually requires bit7 to be clear before bring-up can continue, so it goes nowhere. bit0 is the one that works.

The fix

• Set FCOD byte 0x34 |= 0x01 (enable bit0)
• Repair the checksum. CCB modules use a 32-bit little-endian word sum of 0xAA55AA55, enforced by the checksum word at module offset +0x0C. Since setting bit0 adds 1 to the data, the checksum word must be decreased by 1.
• Reference drive:
  FCOD @ ROM 0x13B00
  Flag @ 0x13B34: 0x10 → 0x11
  Checksum @ 0x13B0C: 0x2F86CAF0 → 0x2F86CAEF

Flash the modified ROM and power the drive up. The SA loads normally, op_state becomes READY, Degraded Reason reports 0x0000, and the user area becomes accessible.

Confirmed on a WDC WD140EDGZ-11B1PA0 (Leo-B-HE14, LEE4K, FW 85.00A85, 16 heads).

This has only been tested on a single drive so far. Posting the method so others can verify it across the rest of the family.

The tool

ccb_selftest_skip.py (Python 3, no dependencies).

It:

• Scans a ROM dump (or extracted FCOD module) for all FCOD copies
• Validates each candidate by recomputing the checksum (must equal 0xAA55AA55), which filters out accidental "FCOD" string matches
• Sets bit0 of FCOD[0x34] and updates the checksum word
• Writes a new output file instead of modifying the input
• Is idempotent and reversible

For other CCB variants there are --flag-offset and --flag-bit overrides. The checksum logic is universal, but the flag location may vary by model.

Caveats

• This removes the firmware self-test lockout. It does not repair failing heads. If a head is genuinely weak, its sectors will still return UNC. The difference is that with the lockout removed, the translator functions normally and the drive can be imaged with retries. On my test unit, the head error log (LGHW) showed errors spread fairly evenly across all 16 heads, which looks more like a marginal self-test failure than a dead head.
• bit0 at offset 0x34 has been confirmed on the Leo-B-HE14 / LEE4K lineage. The checksum mechanism appears universal across CCB modules, but on significantly different CCB models I would recommend confirming the FCOD[0x34] dispatch in a disassembler first. The --check option lets you inspect the current state without modifying anything.
• Back up the original ROM before flashing.

Attached: ccb_selftest_skip.py (zipped).

Results from other models, confirmations, and corrections are welcome.

In these examples bit #7 is already set (and bit #0 is reset):

https://www.hddoracle.com/viewtopic.php?p=23994#p23994

_________________
A backup a day keeps DR away.