iPad6,11 restore + downgrade from iOS 16pb to 15.6 fails with "Unable to connect to FDR client (-2)"

[m-stefanski]

I have tried both ideviderestore 1.0.0 and macOS 12.5 restore function (this one throws 4013 or 4015).

Log for idevicerestore the farthest it can go:

idevicerestore --erase --latest
Found device in Recovery mode
Identified device as j71sap, iPad6,11
The following firmwares are currently being signed for iPad6,11:
  [1] 15.6 (build 19G71)
  [2] 15.5 (build 19F77)
Select the firmware you want to restore: 1
Selected firmware 15.6 (build 19G71)
Verifying 'iPad_64bit_TouchID_ASTC_15.6_19G71_Restore.ipsw'...
Checksum matches.
Extracting BuildManifest from IPSW
Product Version: 15.6
Product Build: 19G71 Major: 19
INFO: device serial number is F9FT9SY2HLFD
Device supports Image4: true
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
################################ [ WARNING ] #################################
# You are about to perform an *ERASE* restore. ALL DATA on the target device #
# will be IRREVERSIBLY DESTROYED. If you want to update your device without  #
# erasing the user data, hit CTRL+C now and restart without -e or --erase    #
# command line switch.                                                       #
# If you want to continue with the ERASE, please type YES and press ENTER.   #
##############################################################################
> YES
Checking IPSW for required components...
All required components found in IPSW
Using cached filesystem from 'iPad_64bit_TouchID_ASTC_15.6_19G71_Restore/078-33832-077.dmg'
Found ECID 5733958582777
Getting ApNonce in recovery mode... 8f 49 83 bc 06 a8 52 5f 73 89 5e ec d3 75 0e fd a5 91 28 f3 
Trying to fetch new SHSH blob
Getting SepNonce in recovery mode... 60 81 e0 85 86 ae 06 20 bf 9e 27 0d 28 82 32 2d 1e b2 35 7f 
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
Extracting iBEC.ipad6f.RELEASE.im4p...
Personalizing IMG4 component iBEC...
Sending iBEC (457495 bytes)...
Recovery Mode Environment:
iBoot build-version=iBoot-7459.140.15
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2x~ipad.im4p...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (27707 bytes)...
Extracting 078-34285-078.dmg.trustcache...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (11292 bytes)...
ramdisk-size=0x20000000
Extracting 078-34285-078.dmg...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (113857540 bytes)...
Extracting DeviceTree.j71sap.im4p...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (29636 bytes)...
Extracting kernelcache.release.ipad6f...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (21034601 bytes)...
Waiting for device to enter restore mode...
About to restore device... 
Connecting now...
Connected to com.apple.mobile.restored, version 15
Device ffffffffffffffffffffffffffffffff0000015d has successfully entered restore mode
Hardware Information:
BoardID: 16
ChipID: 32768
UniqueChipID: 5733958582777
ProductionMode: true
Starting FDR listener thread
ERROR: Unable to connect to FDR client (-2)
ERROR: Failed to start FDR Ctrl channel
ERROR: Unable to start the restore process
ERROR: Unable to restore device

Sometimes it fails earlier on:

Found device in Recovery mode
Identified device as j71sap, iPad6,11
The following firmwares are currently being signed for iPad6,11:
  [1] 15.6 (build 19G71)
  [2] 15.5 (build 19F77)
Select the firmware you want to restore: 1
Selected firmware 15.6 (build 19G71)
Verifying 'iPad_64bit_TouchID_ASTC_15.6_19G71_Restore.ipsw'...
Checksum matches.
Extracting BuildManifest from IPSW
Product Version: 15.6
Product Build: 19G71 Major: 19
INFO: device serial number is F9FT9SY2HLFD
Device supports Image4: true
Variant: Customer Erase Install (IPSW)
This restore will erase your device data.
################################ [ WARNING ] #################################
# You are about to perform an *ERASE* restore. ALL DATA on the target device #
# will be IRREVERSIBLY DESTROYED. If you want to update your device without  #
# erasing the user data, hit CTRL+C now and restart without -e or --erase    #
# command line switch.                                                       #
# If you want to continue with the ERASE, please type YES and press ENTER.   #
##############################################################################
> YES
Checking IPSW for required components...
All required components found in IPSW
Using cached filesystem from 'iPad_64bit_TouchID_ASTC_15.6_19G71_Restore/078-33832-077.dmg'
Found ECID 5733958582777
Getting ApNonce in recovery mode... 03 4f 7e ca 8d f1 33 6e a4 46 8a f2 84 31 0f d2 4a 6b fa fb 
Trying to fetch new SHSH blob
Getting SepNonce in recovery mode... bb 25 99 d6 53 90 f8 23 22 d6 b6 51 cc bf d9 a1 d6 64 42 4e 
Request URL set to https://gs.apple.com/TSS/controller?action=2
Sending TSS request attempt 1... response successfully received
Received SHSH blobs
Extracting iBEC.ipad6f.RELEASE.im4p...
Personalizing IMG4 component iBEC...
Sending iBEC (457495 bytes)...
Recovery Mode Environment:
iBoot build-version=iBoot-7459.140.15
iBoot build-style=RELEASE
Sending RestoreLogo...
Extracting applelogo@2x~ipad.im4p...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (27707 bytes)...
Extracting 078-34285-078.dmg.trustcache...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (11292 bytes)...
ramdisk-size=0x20000000
Extracting 078-34285-078.dmg...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (113857540 bytes)...
Extracting DeviceTree.j71sap.im4p...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (29636 bytes)...
Extracting kernelcache.release.ipad6f...
Personalizing IMG4 component RestoreKernelCache...
Sending RestoreKernelCache (21034601 bytes)...
Waiting for device to enter restore mode...
About to restore device... 
ERROR: Unable to connect to device in restore mode
ERROR: Unable to open device in restore mode
ERROR: Unable to restore device