The Amazing Spider-Man 2 (UHD, MKB v76): Disc ID is in public keydb, keydb.cfg is read, but reports 3303 (ISO source)

[chochb]

Summary
The Disc ID of my disc is already listed in the current public keydb (complete entry with D, M, I, V and U fields, MKBv76). keydb.cfg is placed in the MakeMKV data directory and MakeMKV demonstrably reads it, but decryption still fails with 3303. This is not a request to add the disc to the keydb. I am asking why the existing entry is not applied.

Disc type: UHD
Title: The Amazing Spider-Man 2 (4K Ultra HD)
Disc ID: 0x5043E2020724860DEF2E79FC813CB360D99D6359 (SHA-1 of AACS/Unit_Key_RO.inf)
MKB version: v76
Disc dump filename: MKB20_v76_The_Amazing_Spider-Man_2_61DB.tgz
Drive: HL-DT-ST BD-RE WH16NS60
Drive firmware: 1.02 (Patched, microcode access re-enabled)
LibreDrive status: Enabled (platform MT1959)
Drive info: Highest AACS version 82, bus encryption flags 17, BD raw data read: Yes, BD raw metadata read: Yes, unrestricted read speed: Yes
Did you sync the public keydb within the last 15 minutes? Yes, downloaded 2026-10-23 (file header: created 23-Oct-26 09:24:19 UTC)
Have you verified that all submission links are accessible in incognito/private browsing? Yes
Is your MKB_RO.inf file size at least 2MB? Yes, 5242880 bytes (copied from the AACS folder of a 1:1 ISO of the disc, not extracted from the dump)
MKB_RO.inf link: https://files.catbox.moe/xb3bkw.inf
Disc dump link: https://files.catbox.moe/tzp6no.tgz

keydb entry
The entry for the Disc ID above is present: title "The Amazing Spider-Man 2 (The Amazing Spider-Man 2 - 4K Ultra HD)", date 2022-01-26, fields D, M, I, V, U, comment "MKBv76 ... VolumeSize: 64131170304 (UHD)". The UDF volume size of my ISO is exactly 64131170304 bytes (the ISO file is 64132349952 bytes, 1179648 bytes of trailing padding), so it is the same pressing.

Setup
- Source: 1:1 ISO made with ddrescue from the disc (LG WH16NS60, LibreDrive). Opened as iso: and as a file: source (ISO + discatt.dat overlay). No disc in a drive during the failing runs.
- Linux: MakeMKV v2.0.0 linux(x64-release) in Docker (jlesage/makemkv), app_DataDir = /config/data, the same folder where the dump is written. Both keydb.cfg and KEYDB.cfg exist there.
- macOS: MakeMKV v1.18.4 darwin(arm64-release), keydb.cfg in ~/Library/MakeMKV, source ISO / folder. Same result.
- The dump was also emailed to svq@makemkv.com on 2026-10-01, and MakeMKV reports it as sent for analysis on every run.

Evidence that keydb.cfg is read
I monitored the data directory with inotifywait while running MakeMKV. In each run keydb.cfg is opened and read (about 5 seconds per read, twice per run), then the dump file is opened. The result is still:
"The AACS dump file ... was successfully sent for analysis"
"The volume key is unknown for this disc - video can't be decrypted"
"Failed to open disc"
(MSG 3348, 3303, 5010)

Questions
1. Does MakeMKV apply VUKs from keydb.cfg for ISO/folder sources, or only when the disc is in a LibreDrive drive?
2. Is there a way to see in the log whether a keydb entry was matched? The debug log only shows the content hash table.
3. Is anything else required for the entry to match (e.g. MKB version, bus encryption state)?

Thanks!

[keydb_helper]

- Source: 1:1 ISO made with ddrescue from the disc (LG WH16NS60, LibreDrive). Opened as iso: and as a file: source (ISO + discatt.dat overlay). No disc in a drive during the failing runs.

Did you disable bus encryption before creating the ISO with ddrescue? If not, that would explain why the kv.dat file in your disc dump file seems to be bus encrypted.

Questions
1. Does MakeMKV apply VUKs from keydb.cfg for ISO/folder sources, or only when the disc is in a LibreDrive drive?

When a title is not natively supported MakeMKV will utilise the local keydb.cfg file for all classes of Blu-ray input (physical disc, virtual disc, folder, and ISO file).

2. Is there a way to see in the log whether a keydb entry was matched? The debug log only shows the content hash table.

No, I don't believe MakeMKV indicates accessing or utilising the keydb in its logging.

3. Is anything else required for the entry to match (e.g. MKB version, bus encryption state)?

I believe the libaacs disc ID is the sole factor used when looking up VUKs in the keydb. MakeMKV should be capable of disabling bus encryption on any LibreDrive capable drive. If reading from an ISO file or folder structure, MakeMKV requires bus encryption to have been disabled before creating the backup.