Hardware:
- Laptop: ASUS Zenbook 14 OLED UX3405CA
- CPU: Intel Core Ultra 9 285H (Arrow Lake-H)
- Audio controller: Intel SST / SOF (sof-audio-pci-intel-mtl 0000:00:1f.3)
- BIOS: UX3405CA.307 (updated; issue persists)

Software:
- Fedora: 43
- Kernel: 6.19.6-200.fc43.x86_64
- alsa-sof-firmware-2025.12.2-1.fc43.noarch
- Secure Boot: disabled

Problem:
Internal audio does not work at all. GNOME Settings shows only "Dummy Output".
ALSA reports no soundcards:

  $ cat /proc/asound/cards
  --- no soundcards ---

The SOF driver finds the firmware/topology files but the DSP fails during
ROM public key validation (VALIDATE_PUB_KEY, error 0x97).

Relevant dmesg excerpt:

  sof-audio-pci-intel-mtl 0000:00:1f.3: Firmware file:     intel/sof-ipc4/arl/sof-arl.ri
  sof-audio-pci-intel-mtl 0000:00:1f.3: Firmware lib path: intel/sof-ipc4-lib/arl
  sof-audio-pci-intel-mtl 0000:00:1f.3: Topology file:     intel/sof-ipc4-tplg/sof-hda-generic-2ch.tplg
  sof-audio-pci-intel-mtl 0000:00:1f.3: Loaded firmware library: ADSPFW, version: 2.11.1.1
  sof-audio-pci-intel-mtl 0000:00:1f.3: hda_cl_copy_fw: timeout with rom_status_reg (0x163200) read
  sof-audio-pci-intel-mtl 0000:00:1f.3: Firmware download failed
  sof-audio-pci-intel-mtl 0000:00:1f.3: fw_state: SOF_FW_BOOT_IN_PROGRESS (3)
  sof-audio-pci-intel-mtl 0000:00:1f.3: 0xd000000c: module: ROM_EXT, state: VALIDATE_PUB_KEY, not running
  sof-audio-pci-intel-mtl 0000:00:1f.3: error code: 0x97 (unknown)
  sof-audio-pci-intel-mtl 0000:00:1f.3: error: failed to boot DSP firmware -110
  sof-audio-pci-intel-mtl 0000:00:1f.3: error: sof_probe_work failed err: -110

Steps to reproduce:
1. Boot Fedora 43 on ASUS Zenbook 14 OLED UX3405CA (Core Ultra 9 285H).
2. Check audio: cat /proc/asound/cards

Expected result:
DSP boots successfully, ALSA soundcard appears, internal audio works.

Actual result:
No soundcards. DSP fails at VALIDATE_PUB_KEY with error 0x97.

Troubleshooting already done:
- Secure Boot disabled in BIOS
- BIOS/firmware updated (UX3405CA.307)
- alsa-sof-firmware 2025.12.2 installed and up to date
- Firmware files are found by kernel but DSP rejects them (signature mismatch suspected)

Question:
Is this a firmware signing / key mismatch for Arrow Lake-H on this ASUS model?
Is updated signed firmware expected via alsa-sof-firmware or kernel?

Reproducible: Always