AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/dmcub/dmcub_isa.py?h=main 2026-09-28T13:47:09Z 2026-09-28T13:47:09Z user user@clank 2026-09-28T13:47:09Z urn:sha1:de7dc6e0e485b6d5c363316634de87eba0f7a451 DMCUB had been skipped for months. Identify it as Tensilica Xtensa (windowed ABI, with in-tree positive/negative controls), correct the load base to VA = 0x60000000 + file - 0x200 after finding the nested $PS1 header, and build the tooling to read it: parser, CFG, disassembler with capstone-6 gaps patched, register map, jump-table and copy-length auditors. All 24 implemented DMUB_CMD__* types get a verdict, plus the GPINT doorbell (114-entry table, 12 implemented, all bounded -- a clean negative). Hardware, via PSP load on the 7900 XTX: FINDING-1 [HW] ABM_INIT_CONFIG's unchecked u16 writes ~32 KB past a 712-byte slot FINDING-2 [HW] type 8 returns memory at an unbounded 16-bit panel_inst FINDING-5 [HW] CW0/CW1/SEC_CNTL are not host-writable; PSP signature enforced FINDING-6 [HW] one command wedges the inbox loop (display DoS) FINDING-7 [HW] no arbitrary write: writes follow the host-owned CW6 window FINDING-8 [HW] auth is neither version- nor ASIC-bound; rollback works FINDING-9 [ST] DCN4 LSDMA: host-programmed DMA with only a count != 0 check FINDING-10 [HW] REG_REG_WAIT is an arbitrary-address read oracle whose timing leaks PSP-protected memory; a full CW0 sweep shows the TMR image is byte-identical to public firmware, which bounds it FINDING-3 and -4 are downgraded to latent with the evidence that did not support them. Liveness must be measured by ring consumption, not SCRATCH0 -- that mistake silently voided ~120 negative measurements and is recorded in place.