Yup, you did most of the correct things.
Your device is UFS (as confirmed by the chip number) and an SDM636.
The Poke3 loader (which I've used a zillion times on the Poke3/eMMC) seems to misbehave on UFS.
It could be that the OEM tried to patch something in and broke things.
Normally the Firehose protocol allows something to blather as much as it likes but it must end with an ACK or a NAK and then shut up after that. The fact that the edl /z shows queued up messages shows that it broke that contract.
Ok, you'll have to do some 'spearminting.
Code:
edl /lnote3.bin
edl /u /i /v
edl /x /v "<getstorageinfo slot='0' physical_partition_number='0'/>"
I'm not sure that "slot" is interpreted.
I'm not sure if you have a non-standard slot.
Play with slot, small numbers and partition 0-6.
Note anything different.
Be aware that messages can queue up to the next command.