The majority of shops that firmware devs come from (and particularly defense) have a policy of only verifying the dates of employment and nothing else.

References would be personal references - someone with a cell number and call the college he attended; they should also verify enrollment and completion. You don't want to be calling the HR department. Also, a secret is if the reference (not HR) only verifies employment, that's a negative review. They are concerned about liability. If it was a good employee, the references have no qualms about saying so; it's the negative aspects that carry legal liability. You need to ask for those, not just prior companies. My resume has a "References available upon request" at the bottom and I'd happily give them. Is that no longer practiced? It used to be a requirement.

It's corporate policy with most of the companies in the field for any of their employees to not confirm more. And it's enforced. It's a defense thing.

College buddies will tell more lies than the candidate will.