The harvest branch already enforces non-empty cmdline + presence of root=. The pre-populated branch (added in 0d2688a5) was missing the same validation, so a malformed /etc/default/limine could slip through and the later cryptdevice= check would silently no-op because $CMDLINE was empty.