Thanks to work done by crosbreaker, it is now possible to boot almost any UEFI program from a leaked RMA shim (until next reboot), including Windows. This even works while enterprise enrolled. Right now this is mainly a proof of concept, I might start work on a Windows bootloader using this soon.
github.comGitHub - crosbreaker/kexec: vibecoded kernel module to provide /dev/kexec in chromeOS shimsvibecoded kernel module to provide /dev/kexec in chromeOS shims - crosbreaker/kexec