zoneadm attach -U

s10u9 introduce zoneadm attach -U option in addition to the  -u option
s10u8  with patch 142910-17/142909-17 ( the update 9 Kernel patch, SPARC/x86 ), once that is installed -U is available, install latest rev of 119254/11955 first, if patching though, it's the patchutils patch
man page

attach [-u | -U] [-b patchid]... [-F] [-n path] [brand-specific options]

The attach subcommand takes a zone that has been detached from one system and attaches the zone onto a new system. Therefore, it is advised (though not required) that the detach subcommand should be run before the “attach” takes place. Once you have the new zone in the configured state, use the attach subcommand to set up the zone root instead of installing the zone as a new zone.

For native zones, zoneadm checks package and patch levels on the machine to which the zone is to be attached. If the packages/patches that the zone depends on from the global zone are different (have different revision numbers) from the dependent packages/patches on the source machine, zoneadm reports these conflicts and does not perform the attach. If the destination system has only newer dependent packages/patches (higher revision numbers) than those on the source system, you can use the -u or -U options. The -u option updates the minimum number of packages within the attached zone to match the higher-revision packages and patches that exist on the new system. The -U option updates all packages in the attached zone that are also installed in the global zone. With -u or -U, as in the default behavior, zoneadm does not perform an attach if outdated packages/patches are found on the target system.

For native zones, one or more -b options can be used to specify a patch ID for a patch installed in the zone. These patches will be backed out before the zone is attached or, if -u was also specified, updated.

The -F option can be used to force the zone into the “installed” state with no validation. This option should be used with care since it can leave the zone in an unsupportable state if it was moved from a source system to a target system that is unable to properly host the zone. The -n option can be used to perform a “dry run” of the attach subcommand. It uses the output of the “detach -n” subcommand as input and is useful to identify any conflicting issues, such as the network device being incompatible, and can also determine whether the host is capable of supporting the zone. The path can be “-”, to read the input from standard input.


It seems that to get to u9 from u8  with all the patches and update one should use -U option
one should not use -F at all
In any case always have a backup copy of the zone so one can always restore the zone to its original state