Pretty sure I went through all the right steps and that I'm rooted. Magisk gave su root access to AFWall. Not sure if the Note2 running Android 9 has A/B and if so, how to check it or change from one to the other.
Do I need to look for partition tables and see which one was set to default?
https://source.android.com/docs/core/ota/ab
+++Note2 Root
enable USB debugging
adb devices
adb reboot bootloader
fastboot flashing unlock
fastboot flash boot your_patched_boot.img
fastboot reboot
+++
FWIW, I found a Linux version of the imgtool I pulled from GitHub and compiled...but it only offers pretty basic info. The only difference I see between each version of the image is the addition of a RAMDISK in the Magisk patched boot.img and a different ID. All the CmdLine options appear the same.