From this post I tried sudo ./flash.sh --read-info ${BOARD} nvme0n1p1 and confirmed that no fuses have been burned yet:
==== Fuse Info (/home/subnero/tinker/gen5-bsp/orin/flashing/Linux_for_Tegra/bootloader/fuse_t234.bin) ====
PublicKeyHash: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
PkcPubkeyHash1: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
PkcPubkeyHash2: 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
BootSecurityInfo: 00000200
ArmJtagDisable: 00000000
SecurityMode: 00000000
SwReserved: 00000000
DebugAuthentication: 00000000
OdmInfo: 00000000
OdmId: 0000000000000000
OdmLock: 00000000
ReservedOdm0: 00000000
ReservedOdm1: 00000000
ReservedOdm2: 00000000
ReservedOdm3: 00000000
ReservedOdm4: 00000000
ReservedOdm5: 00000000
ReservedOdm6: 00000000
ReservedOdm7: 00000000
Sku: 000000d6
Uid: c080fd1700000050d9f25d7004000000
OptEmcDisable: 0000000c
My fuse.xml looks like:
<genericfuse MagicId="0x45535546" version="1.0.0">
<fuse name="OemK1" size="32" value="0x${FUSE_KEY}"/>
<fuse name="OemK2" size="32" value="0x${FUSE_KEY}"/>
<fuse name="BootSecurityInfo" size="4" value="0x200"/>
</genericfuse>
I see that the BootSecurityInfo fuse has been burned, but not the other two. This makes it more puzzling that it cannot boot.