AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/hw/cmdbuf_tmr.py?h=main 2026-09-30T00:05:34Z 2026-09-30T00:05:34Z user user@clank 2026-09-30T00:05:34Z urn:sha1:75d83dcdf24fe8d6ddd7158060f258d281cc3f89 All prior fuzzing mutated shared-buffer content, while the load descriptor is a separate host-controlled input that had never been touched. A third wedge trigger: the load command accepts a zero-length command buffer and allocates a session, and the first invoke on that session then hangs the processor for ten seconds and kills the ring, whereas the identical sequence with a normal length returns immediately having written its output. The load-time validation is missing and the failure surfaces as a hang rather than an error, making this simpler than the previously found triggers since it needs two ordinary commands and no crafted payload. A boundary check that holds: pointing the command buffer inside the processor's own trusted memory region is rejected, so host-supplied buffers are validated against that region and the most obvious confused-deputy write route is closed. A length far beyond the allocation is accepted but harmless. The objective is not met, since the zero-length case writes nothing before hanging and is therefore the same class as the others, a hang rather than memory corruption.