AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/hw/invoke_struct_fuzz.py?h=main 2026-09-30T00:53:20Z 2026-09-30T00:53:20Z user user@clank 2026-09-30T00:53:20Z urn:sha1:484d3d3dd4de810fa0b06183dd8c68f9c326b648 The previous pass showed a wholesale-filled invoke structure is rejected, meaning something in those bytes is validated, and a validated field is a used field. A full-resolution sweep of all one hundred and ninety-six dwords, at word stride rather than the earlier coarse stride, isolates exactly one field. Characterising its accepted range shows only zero is accepted, small values give one error code and large values another, with no stall and nothing written beyond the declared window at any value, so the field is strictly validated. The invoke ring structure is therefore fully characterised, with almost every dword ignored, the single field that is read range-checked, and no value producing corruption. The objective is not met. 2026-09-30T00:52:00Z user user@clank 2026-09-30T00:52:00Z urn:sha1:138382c22e6fa2291286785efdedb25007586a3a The previous pass left this surface partially covered because the fill test clobbered the session identifier and therefore measured the session check rather than the payload. Fixed by filling the raw bytes first and setting the two real fields through the accessors afterwards so they survive. With that correction, filling the whole remainder returns a clean error with its own status code, distinct from the invalid-session code, so the processor is validating the region rather than the session check firing. Individual dwords across the full range are all ignored with success status. No stalls and no writes outside the declared window in any case. The invoke ring structure is therefore fully covered: stray individual fields are ignored and a wholesale-garbage structure is rejected with its own code, so the previous pass's caveat is resolved rather than left standing. The objective is not met. 2026-09-30T00:51:11Z user user@clank 2026-09-30T00:51:11Z urn:sha1:713c5f370dfe91985b541a62a16f32b04d8872f9 The invoke ring command is several hundred bytes but every invoke in this audit set only two fields and left the rest zero, and that data is parsed directly from the ring, a different input path from the shared buffer, never previously fuzzed. Individual dwords across the first part of the unused space, set to all-ones, are ignored with success status, no stall and no write beyond the declared window. The cases that filled the whole remainder all returned the same error, but those rows prove nothing and are not counted, since filling from that offset overwrites the session identifier itself and the error is exactly the invalid-session code the lifecycle probe produced for stale and forged handles, so it is the session check firing rather than a reaction to the payload. The pass establishes that the first part of the unused ring-command space is ignored safely, while the remainder is only covered by the uninformative fill case, so this surface is partially covered and is stated as such rather than claimed complete.