A2992 - liquid damage - PP1V2_S2 2.6ohm short

A2992 - liquid damage - PP1V2_S2 2.6ohm short.
Booting motehrboard has 3-4kOhms resistance on this line

Damaged areas were kb backlight, speaker aplifier chips and vicinity of U8100 PMIC. U8100 was replaced after I discovered it was shorted.

5V 0amp - motherboard out of the assembly
5V 0.4 amp - battery plugged in

Nothing warms up under thermal cam


3V8AON present and stable
PP1V8_S2 also super low - 2-3ohms, 3kOhms on a working board

You can try injecting 2V into 1V8_S2 rail.
Very likely nothing will heat to detect with fingers.
A good infrared camera can show you the culprit.

Yes I have a decent thermal cam. I didnt want to start injecting voltage right away. And I see both PP1V2_S2 and PP1V8_S2 are shorted.
Right now I removed both U8100 and U7700. Shorts remain.

I suppose I should not risk injecting 1V to PP1V2_S2 since it goes directly to the CPU

But I will try injecting voltage to PP1V8_S2

You can inject 1.4V even to 1V2_S2.
If both rails have CPU has common point, guess what...

Following your advice - I injected 1V to PP1V2_S2 and WiFi chip (UL000) heats up. PP1V8_S2 also goes there. It took almost 1.6 amps

So I suppose motherboard is as good as dead, UL000 is married to the CPU, right?

Unless I drill it where the hotspot is and hope for a passive component inside the IC causing the short?

CPU and Wifi chip are married, yes.
Sometime is possible to recover that chip as you've said; nothing to lose trying.