[HW] svc 0xf2 issued from GCP ROP via stack migration; ASD survive-check passes

Ran the operator's stack-migration chain on silicon as the service-2 (ASD) survive-check. Result:
FE0A status 0x240 (planted), no fault; graceful-chain marker 0x5a at +0x3100 (migration+graceful ran);
exfil'd svc status 0x4 at +0x3000 (ASD returned 0x4); follow-up FE07 ta=0 (ring survived, no ATX).

So from a GCP ROP chain on hardware: pivot into the command buffer, memcpy the svc sub-chain to the
in-window GCP stack (0x410000), mov sp to it (SP now in-window), pop r0=2/r1=msg (msg in-window),
svc 0xf2 -> ASD returns 0x4, str r0,[host_buf] exfil, graceful return. The svc went through the REAL
sos_proc_switch gate (SP and msg both in the type-5 window) -- the link the emulator never exercised
-- and the ring survived.

Complete svc-issuing + exfil + graceful-return machinery validated on silicon. Next: r0=1 (service 1
= SYS_DRV) + 0x3103 message, svc gadget entered at bare svc 0x4061ca to keep r0=1 -- the
confused-deputy confirmation. Harness hw/gcp_rop_svc.py.

1 files changed, 21 insertions, 0 deletions

diff --git a/fw/FINDING-GCP-ROP-TO-SYSDRV-VIA-SERVICE1.md b/fw/FINDING-GCP-ROP-TO-SYSDRV-VIA-SERVICE1.md
index cbb8f29..e65f75e 100644
--- a/fw/FINDING-GCP-ROP-TO-SYSDRV-VIA-SERVICE1.md
+++ b/fw/FINDING-GCP-ROP-TO-SYSDRV-VIA-SERVICE1.md
@@ -394,3 +394,24 @@ This is the chain to build and fire. First silicon attempt stays the service-2 (
 (set r0=2, msg a zeroed in-window buffer) to validate migration + svc + graceful return, then switch
 to service 1 / opcode 0x3103 with the status exfil for the confused-deputy confirmation. Gadgets all
 verified present in GCP .77; memcpy semantics confirmed.
+
+## Step 6 (HARDWARE): svc 0xf2 issued from GCP ROP via stack migration -- machinery proven
+
+`hw/gcp_rop_svc.py`. The stack-migration chain (Step 5b) fired on silicon as the service-2 (ASD)
+survive-check:
+
+    SVC-MIGRATE FE0A status=0x240  FSR=0  faultaddr=0          (no fault)
+    graceful-chain marker @+0x3100 = 0x5a                       (migration + graceful chain ran)
+    exfil'd svc status    @+0x3000 = 0x4                        (ASD returned status 0x4)
+    follow-up FE07: ta=0, handle=0x1000002                      (ring SURVIVED, no ATX)
+
+So on hardware, from a GCP ROP chain: pivot into the command buffer -> `memcpy` the svc sub-chain to
+the in-window GCP stack (`0x410000`) -> `mov sp,0x410000` (SP now in-window) -> `pop r0=2,r1=msg`
+(msg in-window) -> `svc 0xf2` -> ASD processed it and returned `0x4` -> `str r0,[host_buf]` exfil ->
+graceful return. The svc went through the **real `sos_proc_switch` gate** (SP and msg both satisfy
+the type-5 window), which the emulator never exercised. The ring survived and a follow-up FE07
+succeeded with no power cycle.
+
+This validates the complete svc-issuing + exfil + graceful-return machinery on silicon. The only
+change for the confused-deputy test is `r0=1` (service 1 = SYS_DRV) + a `0x3103` message, with the
+svc gadget entered at the bare `svc` (`0x4061ca`) so `r0` stays 1.