Deploying the same attestation service across a fleet. A subset of hosts (same SGX-enabled CPU model, same BIOS) consistently fails with an `invalid cpu svn` error during quote verification. The service passes on others.

Using the DCAP library (v1.16). The failure occurs in `sgx_qv_verify_quote`.

* Identical OS, driver, and PCCS configuration.
* All machines show `SGX HW` and `SGX LC` enabled.
* Retrieved PCK certs appear valid from the cache.

Suspect a platform manifest issue or a hidden BIOS setting, but vendor insists configs are identical. Need to isolate the variable.

What specifically in the TCB status triggers `invalid cpu svn`? Is this a known mismatch between the CPUSVN in the quote and the one derived from the PCK? Log snippet below.

```json
{
"verification_result": "SGX_QL_QV_RESULT_INVALID_CPU_SVN",
"tcb_info": {
"tcb_levels": [...],
"pce_svn": 13
}
}
```

Debug steps taken so far:
* Confirmed PCCS returns valid TCB info for all affected CPUs.
* Re-fetched PCK certs, no change.
* Compared `sgx_report` body (excluding MACs) from working and failing hosts—identical CPUSVN values in the report.

Where is the mismatch?