Ran sdm-cryptconfig from a running freshly booted RPi 500+, received all the expected output and rebooted.

Made it to part in the process marked by the red line in this picture stolen from the examples:

After entering the passphrase, I get the below x2, and then a new passphrase prompt:

Cannot initialize device-mapper. Is dm_mod kernel module loaded?`
Cannot use device cryptroot, name is invalid or still in use.

The first line I recall the material pre-reboot said was ok, the second line is interesting. I have let it hang out for a while to try to evaluate whether it's still encrypting (it's a 256GB NVMe drive). Been probably about 45 min at the time of writing this.

I still suspect that it's encrypting (due to personal experience plus the warning line that encryption can take a while), but posting this just on the off chance that there's anything to do other than give it time (or if there's a suspicion that something else could have gone awry). Wondering if there's a way to present any kind of progress indicator (my guess is no during this level of boot) or maybe the script can query whether the device is ready prior to requesting the passphrase (unless the way to do that is to try to unlock it haha).