The USB Port Was the Problem

This took way longer than it should have. I'm writing it down in case someone else ends up staring at a wall of SQUASHFS errors and blaming everything except the port.

tl;drIf a Fedora-based live USB keeps giving you SQUASHFS read errors, GPT header warnings, MokManager errors, or just freezes on the splash screen, and it happens with more than one stick, plug it into a different port before you replace anything. On my board the ports that go through an onboard hub were the problem. A port wired straight to the chipset booted the same stick on the first try.

I was trying to boot Bazzite off a USB stick. Should have taken five minutes. Instead the problem kept looking like something else. First it looked like Secure Boot, then the GPU, then RAM, then a fake flash drive.

It wasn't any of those. My board is an MSI PRO Z890-A WiFi, and some of its rear USB ports go through a Genesys Logic GL3523 hub chip. That's the group I had been plugging into. I moved the exact same stick to a port that goes straight to the chipset and it booted clean.

This is one board, so I'm not saying every GL3523 is bad. But if your boot keeps failing in a different spot every time and the one thing you never change is the port, the port should be on your list.

What it looked like

Every new symptom pointed somewhere different, which is what made this so annoying.

Early boot. With Secure Boot on I got Failed to open \EFI\BOOT\mmx64.efi - Not Found and a MokManager error. Bazzite really does make you enroll a key for Secure Boot, so I figured it was that.³
Splash screen. It either froze on the Plymouth screen or the spinner just went forever. Switching to a TTY gave me a black screen. On hardware this new, a graphics driver problem seemed pretty likely.
Verbose boot. I took out quiet rhgb and added plymouth.enable=0, and there were SQUASHFS read errors everywhere. Random bad blocks like that usually mean the flash is dying.
Partition scan. dmesg complained about a GPT alternate header mismatch on the USB. That's the classic fake capacity stick error.
The end. Eventually systemd couldn't load targets because of an Input/output error and everything just stopped.

At one point I got all the way to a bazzite login: prompt by booting with nomodeset systemd.unit=multi-user.target plymouth.enable=0. Looking back, that was a big clue. The kernel was fine and most of the system loaded. Only certain blocks on the stick were failing to read.

SQUASHFS error: Failed to read block 0x9a384f27: -5
SQUASHFS error: Unable to read fragment cache entry [...]
SQUASHFS error: Unable to read page, block ..., size ...

And the GPT one:

GPT:Primary header thinks Alt. header is not at the end of the disk.
GPT:13883135 != 121145343
GPT:Alternate GPT header not at the end of the disk.
GPT: Use GNU Parted to correct GPT errors.

The sector number in that error changed depending on which stick I used, even though they were all the same model with the same reported size. That's why I kept blaming the sticks.

Everything I blamed first

All of these were worth checking. None of them were it.

Secure Boot / MOK. Enrolled the key, then turned Secure Boot off completely. Still failed. The MOK error was real, it was just a separate thing.
NVRAM. Did a full CMOS/NVRAM reset. Nothing changed.
The GPU. Tried nomodeset, then pulled the RTX 5080 and ran off integrated graphics. nomodeset changed what showed up on screen but not the errors, and integrated graphics failed the exact same way.
RAM. XMP was already off. Ran a full Memtest86 pass and it came back clean.
BIOS. Already on the latest version.
The sticks. Tried three different ones, one of them still sealed in the package, written with both Fedora Media Writer and Rufus. Checked the SHA256 every time. All three failed the same way, just at different blocks.
The download. Checksum matched the official one.

The one thing I never really changed was the port. Every single attempt went through the same group of rear ports.

What it actually was

Not every rear port on this board is wired the same way. The 10Gbps ports go straight to the chipset. The 5Gbps ones go through an onboard hub, the GL3523, which is a USB 3.2 Gen 1 hub chip that gets used on motherboards.²

In every log where I could see it, the stick was sitting behind that hub:

usb 4-3: New USB device found... Product: USB3.2 Hub, Manufacturer: GenesysLogic
usb 4-3.1: New USB device found... Product: USB DISK 3.0

Once I saw that, everything made sense. The stick was fine. Reads were getting corrupted or dropped somewhere in the hub, so every boot had a new random set of unreadable blocks, every stick looked broken, and the live system fell apart like the flash was dying.

The fix was kind of embarrassing. I plugged the stick into one of the chipset ports (the red 10Gbps ones on this board) and rebooted. Same stick, same ISO. Booted on the first try.

Why it was so hard to figure out

Pretty much every symptom pointed at something else:

The GPT mismatch looks exactly like a fake flash drive.
The bad blocks moved around between boots, which looks like failing NAND.
The splash screen hang, plus nomodeset seeming to help, looked like a GPU driver problem.
The MokManager error was real. Bazzite does need its key enrolled when Secure Boot is on, and their docs walk you through it.³ ⁴
Memtest, BIOS updates, checksums and reseating the GPU are all good things to check. None of them will tell you a USB port is messing up reads.

If this sounds familiar

Before you download the ISO a fourth time or send a flash drive back:

Find the rear USB port map in your board's manual and see if the ports are split into different controller or hub groups.¹
Boot with verbose logging and look at what shows up right before the USB drive does. Being listed under a hub isn't automatically bad, but it's worth knowing.
Move the stick to a port the manual says goes straight to the chipset and try again before you change anything else.
If moving ports changes everything, stop blaming the stick.

My setup

board: MSI PRO Z890-A WiFi (Intel Z890, LGA1851)
cpu: Intel Core Ultra series
gpu: NVIDIA RTX 5080
images: Bazzite and Fedora Workstation live
writers: Fedora Media Writer, Rufus
sticks: 3 different ones

Lesson learned: when a hardware problem seems random, keep track of what you're actually changing. I swapped the sticks, the images, the boot flags, the GPU and the firmware settings, and never the port. The second I did, it was fixed.