ASD audit pass 2: 0x800/forwarded group + tail workers uniformly validated -- negative

Read the forwarded workers 0xd0d134/26c/28c/114 and tail targets 0xd11238/112e4/11348/111c8 plus
0xd0d0bc/170. Uniform: zero-init a validated 4-byte user output ptr, validate arg2 as a 4-byte
pointer via 0xd12e90, gate 0xd116ac, bound the channel selector <=0x3f (table+sel*0x60, state
check), then write a single dword to the user ptr or dispatch through an ASD-internal fn-ptr. Get/
set-one-dword-on-a-bounded-channel ops: no message-controlled length, no copy into ASD, no
attacker-controlled index. Negative.

Pass 1+2 conclusion: across ~15 service-2 handlers in the 0x180 and 0x800/forwarded groups plus
their channel workers, ASD's TA-reachable surface is uniformly validated, matching the documented
result that its 37 host-reachable opcodes are all bounded. No memory-safety defect found. Flagged
honestly that this is a manual pass, not an exhaustive validated-oracle sweep, so it does not CLOSE
the surface; the 0x200/0x300 groups, the exact 0xd12e90 region semantics, and the per-channel fn-ptr
handlers remain unaudited.

Net: the escalation route is structurally open and proven up to the ASD message boundary, but ASD is
well defended -- capability demonstrated to the ASD door, no hole found in the door yet.

1 files changed, 45 insertions, 0 deletions

diff --git a/fw/LEAD-ASD-SERVICE2-ATTACK-SURFACE.md b/fw/LEAD-ASD-SERVICE2-ATTACK-SURFACE.md
index a01ba41..ed6f0da 100644
--- a/fw/LEAD-ASD-SERVICE2-ATTACK-SURFACE.md
+++ b/fw/LEAD-ASD-SERVICE2-ATTACK-SURFACE.md
@@ -113,3 +113,48 @@ down. Pass 2 targets:
 Net: the escalation route (GCP ROP -> ASD service 2 -> type-2 code exec -> fuses/MMIO) is
 structurally open and the transport+gate are favourable; audit pass 1 cleared the first dispatch
 level; the bug, if present, is in the per-channel handlers or the unaudited groups.
+
+## Audit pass 2: the 0x800/forwarded group and tail workers are uniformly validated -- negative
+
+Read the forwarded workers `0xd0d134/0xd0d26c/0xd0d28c/0xd0d114` and their tail targets
+`0xd11238/0xd112e4/0xd11348/0xd111c8`, plus `0xd0d0bc/0xd0d170`. Uniform shape, all bounded:
+
+* `str #0,[arg2]` zero-inits the caller's 4-byte output pointer;
+* arg2 validated as a **4-byte** pointer via `0xd12e90` (len fixed at 4, so no overflow of the
+  caller buffer, and nothing copied *into* ASD);
+* capability gate `0xd116ac`;
+* channel selector arg1 bounded `<= 0x3f`, index `table + sel*0x60`, state check `[entry+4]==1`;
+* result is a **single dword written to the validated 4-byte user pointer**, or dispatch through an
+  ASD-internal function pointer `[asd_table + 0x1888/...]`.
+
+These are get/set-one-dword-on-a-bounded-channel operations. No message-controlled length, no copy
+into an ASD buffer, no attacker-controlled index. Negative.
+
+## Pass 1+2 conclusion: ASD's service-2 surface is uniformly validated across what was audited
+
+~15 handlers across the `0x180` and `0x800`/forwarded groups, plus their tail/channel workers, all
+share the same discipline: capability gate, bounded channel index (`<= 0x3e/0x3f`, stride `0x60`),
+`0xd12e90` pointer validation, and either fixed-length copies or dispatch through ASD-internal
+function-pointer tables. This matches the project's documented result that ASD's 37 **host**-reachable
+opcodes are all bounded (`ASD-REACHABLE-AUDIT.md`); the **service-2 (TA-reachable)** handlers audited
+here are the same style and equally defended. No memory-safety defect was found.
+
+**This is a manual pass, not an exhaustive validated-oracle sweep**, so it does not *close* the
+surface to the project's standard. What remains genuinely unaudited:
+
+* the `0x200`/`0x300` groups (GCP uses `0x201/0x204/0x305`; likely same discipline but unread here);
+* the exact region semantics of `0xd12e90` at `0xd12ea4+` -- whether a TA-window pointer
+  (`0x400000-0x800000`) with a large `len` passes, which is the only way the "copy len into a fixed
+  ASD buffer" class stays alive, and no audited handler actually performs such a copy;
+* the per-channel function-pointer handlers (`[asd_table + 0x1828/183c/1888/1c84]`) in full -- they
+  are ASD-internal and not attacker-controlled without a prior write, but a bug inside one reached
+  with a validated pointer could still exist.
+
+## Net for the escalation
+
+The route GCP-ROP -> ASD service 2 -> type-2 code exec -> fuses is **structurally open and proven up
+to the ASD message boundary** (transport works, gate is favourable). But ASD itself is well
+defended: two audit passes over the most promising groups found uniform validation and no bug. An
+escalation through ASD would need either an exhaustive validated sweep of all groups + channel
+handlers, or a different ASD defect class (e.g. a logic/state bug rather than memory safety). The
+honest status is: capability demonstrated to the ASD door; no hole found in the door yet.