Manufacturing mode is determined by the FD lock state and the Manufacturing bit being set. You don't have to use -closemnf if you build the SPI image with FD locked and Manufacturing bit set at Flash Image Tool. If you leave the FD unlocked, you can reflash the ME region via software solutions (FPT, flashrom, AFU etc). If you have other methods of bypassing the lock when needed (jumper, BIOS option, programmer etc) the you can leave it locked for better security.

@ Toetje583:

I suppose you used USB Flashback or similar. These update the BIOS region only, not the ME. If you used a programmer with outimage.bin then the version would be 11.6.29 indeed. Use FWUpdate tool to update the ME instead. If you want to clean it you need read/write access to its region which is not possible without a programmer, a motherboard jumper, a bios option which enables ME reflash etc.

@ e1D:

Manufacturing Mode is controlled by the Flash Descriptor Region Access Permissions (all of them must be at the Intel recommended values) and by the setting of the Engine (ME/TXE) Manufacturing Done bit. Thus, there are four possible cases: FD Locked + Done bit Set, FD Locked + Done bit Not Set, FD Unlocked + Done bit Set and FD Unlocked + Done bit Not Set. Manufacturing Mode is Disabled only when the FD is Locked and the Done bit is Set (1st case). The other three lead to Manufacturing Mode being Enabled.

Flash Programming Tool's Close Manufacturing command (-closemnf) automatically Sets the FD locks to Intel recommended values and the Engine Manufacturing Done bit. Usually a Global Reset (-greset) is performed to apply the changes and at the next reboot the system will be out of Manufacturing Mode. There are two exceptions:

1) If the FD is locked and the Engine Done bit is Set, -closemnf does nothing since the system already has Manufacturing Mode Disabled
2) If the FD is locked but the Engine Done bit is Not Set, -closemnf cannot proceed since it cannot change the Engine Done bit at the Engine region while the FD is Locked

In the latter exception, one would need to reprogram the Engine region of the SPI/BIOS chip with the Manufacturing Done bit Set. Generally, Flash Image Tool automatically Sets the Manufacturing Done bit at the Engine Region upon image building, provided that the Flash Descriptor Region Access Permissions are Set to those recommended by Intel. You need to manually change an option at Flash Image Tool to allow leaving the Engine Manufacturing Done bit Not Set even when the FD is Locked.

Section D2 for CSE (CSME 11 & CSTXE 3) got updated today:

At Step 11 I've added proper instructions for what file to replace when working with bare Engine regions only. When not working with SPI images, you need to replace the input Engine region, not the one from "Decomp" folder. That's because FIT looks for the Engine region at the input file in that case, so we need to replace that for the cleaning to be successful.

You must use FIT v11 for CSME 11 firmware, not 10 or anything else. The CSME firmware (its settings specifically) is corrupted so FIT cannot parse it. You'll need to find a SPI dump from someone else with the same system and clean that instead. Then extract its CSME region with UEFITool in order to replace the one from your own dump.

You need an Engine region with that model's settings, we can neither guess them or take them from your corrupted dump. The choices are either the OEM SPI/BIOS (not useful in your case as Dell includes RGN/stock Engine regions for FWUpdate flashing during normal BIOS updating) or someone else's (non-corrupted) dump which can then be cleaned as I said above.

BootGuard should not be an issue when dealing with Engine firmware. Take the old (but healthy) SPI dump and follow the CleanUp Guide using the latest compatible 11.8 RGN for your system (yes you can jump from 11.0 to 11.8 while using the guide). Then extract its cleaned/configured/updated Engine region via UEFITool. Replace the one at your own dump with the guide's output (make sure the region sizes are the same in UEFITool, they should probably be the same in this case). Flash your fixed dump (cleaned/configured/updated CSME firmware) back via flashrom or whatever programmer you used in the first place.

Sections D1 for Pre-CSE (ME 2 - 10 & TXE 1 - 2) > Step 15 and D2 for CSE (CSME 11 & CSTXE 3) > Step 16 got updated today. I've added instructions on how to make sure that the output region has the same size as the dumped one which is relevant when working with bare Engine regions only.