Hello,

1. The PCH/SoC fuses (FPF) are initially not set/unprovisioned. The OEM sets the values at the Engine firmware (TXE FW) and at first end of manufacturing boot (fpt -closemnf) these will permanently commit to the hardware (FPF). The Engine firmware is used for the initial FPF provisioning. The settings it holds afterwards are useless. Only what's actually commited to the HW/FPF matters.

2. At the Engine FW, zeros means that it's not set. It doesn't mean that the actual HW/FPF is the same though, as explained at the 1st answer. At the HW/FPF, "not set" means that it is still in unprovisioned mode so the end of manufacturing never happened.

3. If the HW/FPF is set to zeroes then it usually means that the feature in question is Disabled permanently. So it is "set" to something, provisioned to "Disabled" state. Check the FPF status at the bottom for more info on what's "not set", "Enabled", "Disabled" etc.

4. If you see HW/FPF "not set" then it's definitely in manufacturing mode (I call this mode "OEM"). If they are set, manufacturing mode is basically equivalent to whether you have read/write access to the SPI/BIOS chip for servicing or similar (I call this mode "OEM/User"). MEInfo/TXEInfo tool should tell you whether Manufacturing Mode (doesn't specify which) is enabled and whether you have read/write access to the Engine firmware.

5. Answered above.

6. The FPF are within the PCH/SoC. The Engine co-processor is also within the PCH/Soc but they are not the same. They work together. The only reliable way to detect the FPF state of a given system is to query it while it's working via MEInfo/TXEInfo, as explained above. Looking at the BG Hash via Flash Image Tool or the BG state within BIOS via UEFITool (__FIT__, ACM etc) is not reliable because an OEM may have configured/set everything properly but not actually commited these changes to the HW/FPF by closing the manufacturing mode at least once (fpt -closemnf).

7. You can find some great research/results from people such as Alex Matrosov at his Betraying the BIOS: Where the Guardians of the BIOS are Failing talk, among others. From my personal experience, the best when it comes to security is Lenovo and HP followed closely by Dell. Apple is also very good (nowadays) but uses their own measures on top (T2 chip, way less features enabled).