AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/hw/image_parser_fuzz.py?h=main 2026-09-30T00:44:46Z 2026-09-30T00:44:46Z user user@clank 2026-09-30T00:44:46Z urn:sha1:487df1049aa0f758f634df74b5f2b8a5169e16f2 One surface really was untried, since every load in this audit used a well-formed signed image while the header parse runs before authentication completes and is therefore reachable by any host without a valid signature. Fuzzing truncations, header dwords set to zero and to extreme values, and length mismatches, with the unmodified image as control, every malformed case returns a clean error status with no stall and no crash. One result looked like a signature-coverage gap: four header dwords zeroed still loaded successfully. Two were already zero so those are no-ops, but two hold real address-shaped values and zeroing them still authenticated, which would matter if those fields steer anything. A follow-up settles it: only zero is accepted, and any other substitution fails authentication, so the signature does cover these fields and zero is special-cased as field-unused. An attacker can switch an optional pointer off rather than redirect it, which is not a primitive. The objective is not met.