I thought that the UEFI firmware would set ATA disks to the Security Frozen state just before transitioning to the OS (ExitBootServices).

However, when I checked the ATA Identify data in a UEFI application, the disks were already in the frozen state.

Is there any clear documentation that specifies at what point in UEFI the ATA Security Frozen is set?

Additionally, to perform a Security Erase in UEFI, I need to prevent the disks from being frozen. Is there a way to prevent freezing by loading UEFI Dxe or similar earlier in the process?

To solve this, we need to develop using EDK2. Which API or Protocol should I use?