Record PSP security investigation artifacts and probesHEADmain

1 files changed, 32 insertions, 0 deletions

diff --git a/fw/AUDIT-ASD-163-200-20B-NESTED-POINTERS.md b/fw/AUDIT-ASD-163-200-20B-NESTED-POINTERS.md
new file mode 100644
index 0000000..fc1a72c
--- /dev/null
+++ b/fw/AUDIT-ASD-163-200-20B-NESTED-POINTERS.md
@@ -0,0 +1,32 @@
+# Signed ASD `.163` service-2 `0x200..0x20B` immediate-handler audit
+
+**Scoped static pass on signed `asd_33.0.0.163_18debcc4.elf`, not an
+exhaustive callback, crypto, state-machine or hardware-permission audit.**
+GCP ROP can supply service-2 messages with arbitrary opcodes; the normal
+GCP/host command set is not a coverage boundary. This pass checked the
+`0xD013B8` dispatcher-to-leaf argument flow and the first pointer/copy
+checks, using raw Thumb instructions where decompilation failed. It
+found the independently tested `0x20B` missing nested-pointer check,
+not a general assurance that other opcodes are safe.
+
+| Opcode | Immediate signed path | Pointer/size observations and limit |
+|---|---|---|
+| `0x200` | `sub_D0DFC4` → `sub_D0DFE0` | Validates `msg[1]` for `0x28` bytes before output and callback dispatch. Callback semantics not closed. |
+| `0x201` | `sub_D0EF60` | Validates `msg[1]` for 32 bytes and for `*(u32 *)msg[1]`; checked crypto length `*a1-32 <= 0x920`. This references private `0xD397B0` as a 16-byte secret attribute. Downstream crypto and TOCTOU are outside this pass. |
+| `0x202` | `asd_svc_op_202` | Validates input `(ptr,len)`, output-size word `(a4,4)`, and output `(ptr,*a4)` before SYS_DRV operations. **Do not mistake validation for confidentiality:** a prior separate canary-leak finding applies. |
+| `0x203` | `sub_D0E8F8` | Selector `<=3`, pointer/length16 validated. **Deeper signed raw/test:** two or more state bits select a checksum-gated 16-byte global-record **read into caller**; exactly one bit selects a caller→global copy followed by untested stateful callbacks. Free `0x205` can set two bits without owner binding (`fw/CANDIDATE-GCP-ASD-203-DIO-UNBOUND-RECORD-ACCESS.md`). No live cross-client content. |
+| `0x204` | `sub_D0E068` → `sub_D0E084` | Validates `msg[1]` for `0x20` bytes. Signed ASIC-20 `+56` callback writes only four dwords within that window after fixed `SVC 0x7B` reads; no nested pointer in that descendant (`fw/AUDIT-ASD-163-204-ASIC20-CALLBACK-OUTPUT.md`). Other ASICs/runtime fabric content open. |
+| `0x205`, `0x206` | `sub_D0DC34`, `sub_D0DC8C` | Helpers require `msg[1] <= 3` and one-bit `msg[2]` for a bounded state-word mutation. **Dispatcher still performs conditional session/deadline side effects on invalid bitmask/status 2** in signed synthetic controls (`fw/CANDIDATE-GCP-ASD-205-206-INVALID-MASK-SESSION-SIDE-EFFECT.md`). No nested caller pointer. |
+| `0x207` | `asd_svc_op_207` | Explicit `asd_validate_ptr(msg[1],4)` before a nullable callback. Signed ASIC-20 `+0x3C` descendant reads one dword through a separate ASD-private pointer and stores exactly four output bytes; synthetic control rejected ASD-private output and preserved the adjacent sentinel. Natural source-pointer provenance remains open (`fw/AUDIT-ASD-163-207-ASIC20-CALLBACK-OUTPUT.md`). |
+| `0x208` | `asd_log_event` → `asd_bzero_core_cfg2` | Packed scalar fields from `msg[1]`, not a caller pointer. **Deeper signed raw/connected model:** sends fixed service-1 opcode `0x1079` via `SVC 0xF2`, which conditionally requests a fixed-address fabric write of the packed word; no actual fabric effect (`fw/AUDIT-ASD-163-208-SYSDRV-1079-FORWARD.md`). |
+| `0x209` | `sub_D0EB3C` | No nested pointer; reads a state-indexed return table after unsigned `(state-20) <= 7` check. |
+| `0x20A` | `sub_D0E980` | Raw `0xD0E982..0xD0E996` requires pointer nonzero, length `0x10`, and `asd_validate_ptr(ptr,0x10)` before source-byte loads; later branch may copy 16 bytes to internal state. |
+| **`0x20B`** | `0xD0178A` → `asd_svc_op_20B` at `0xD0DC14` | **No nested pointer check:** stores Boolean directly to `*(u32 *)msg[1]`. Signed-dispatch emulator changes synthetic ASD-private RAM, while two fresh card runs with swapped GCP-owned targets prove the selected output store but **not** a live ASD-private write. See `fw/CANDIDATE-GCP-ASD-20B-UNCHECKED-OUTPUT-STORE.md`. |
+
+The transport's message-pointer validation cannot substitute for each
+handler's nested pointer/range check. Some decompiler renderings of the
+`0x201` and `0x202` cleanup flow are misleading; this pass did **not**
+revalidate their successful crypto or object lifetime. It does not cover
+`0x180..0x1C0`, `0x300`, `0x402..0x405`, signed startup, or indirect
+per-channel callbacks. The older statement that ASD's service-2 surface
+is "uniformly validated" is false in this signed build.