aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAge
...
* tenth pass: field-flow v2 on IDA boundaries with verified writers; TAs and AS...user2026-09-29
* RETRACT the ninth pass: its positive control passed on garbage from a linear ...user2026-09-29
* triage ASD's single field-flow site: bounded against the caller's capacityuser2026-09-29
* ninth pass: field-level detector passes both controls; TA negative is now con...user2026-09-29
* eighth pass: build an inter-procedural detector, then decline to trust its ou...user2026-09-29
* close the SYS_DRV underflow lead: the only caller bounds the length to 0x30user2026-09-29
* [ST] seventh pass: scan the code behind the TAs; one unresolved underflow sha...user2026-09-29
* emulator fuzz harness: TAs really do load; first fault refuted on siliconuser2026-09-29
* sixth pass: build emulator fuzz harness for the twelve TAs; result deliberate...user2026-09-29
* fifth pass: scan the whole corpus (~110 bodies) for all three shapes, build-d...user2026-09-29
* fourth pass: scaled-index audit across the twelve TAs -- none host-controlleduser2026-09-29
* third pass: destination-side copy audit across the twelve TAs -- negativeuser2026-09-29
* close every TA copy call site: bounded, except one latent callee-length shapeuser2026-09-29
* [ST] latent XGMI stack overflow: callee-supplied length copied into a 68-byte...user2026-09-29
* hunt a memory-corruption primitive in the twelve TAs: not found, and establis...user2026-09-29
* assess the GCP defects' real capability: DoS alone, but an enabler for a key-...user2026-09-29
* [ST] GCP version sweep: all three defects present in every harvested builduser2026-09-29
* [ST] audit the shared runtime clusters: negative, and the hypothesis is voiduser2026-09-29
* [HW] retract the FE0A reachability claim: both new lookups are auth-gateduser2026-09-29
* [ST] sharpen the FE0F finding: two of the three lookups compare the never-wri...user2026-09-29
* [ST] lifetime sweep across all twelve TAs: concentrated in GCP, and OPM prove...user2026-09-29
* [ST] extend the FE0F finding: three liveness-free lookups in GCP, not oneuser2026-09-29
* [ST] complete the ASD single-TA opcode sweep: uniformly guarded, no host pathuser2026-09-29
* [ST] extend the opcode sweep to ASD: 0x403/0x404 closed, ASD now in the pipelineuser2026-09-29
* [ST] complete the SYS_DRV unique-opcode sweep: oc 0x109b benign, powerplay 0x...user2026-09-29
* [ST] audit RAP's SYS_DRV opcodes; most of the ~23 unique opcodes are deaduser2026-09-29
* [ST] XGMI privileged-reach lead resolved negative: SYS_DRV stubs the whole blockuser2026-09-29
* [ST] lead: XGMI cmd09/cmd0A pass host dwords into SYS_DRV 0x1061/0x1062user2026-09-29
* [ST] resolve the 0x60xx lead: emitter real, attacker-controlled value is notuser2026-09-29
* [ST] overturn the SYS_DRV 0x60xx 'no emitter' negative: POWERPLAY emits ituser2026-09-29
* fw: command-surface dumps for all twelve TAs, with honest handler attributionuser2026-09-29
* fw: regenerate the GCP command-surface dump after the arity passuser2026-09-29
* fw: rebuild powerplay's corrupt database; verify all 632 functions decompileuser2026-09-29
* fw: recover helper arity by dataflow, validated first -- 632/632 functions no...user2026-09-29
* fw: readable GCP command-surface dump + sharpen FE0F's in-database commentuser2026-09-29
* fw: restore AMD's own function names and apply prototypes/types across the TAsuser2026-09-29
* GCP acquire-gate bypass: measure the surface it opens, de-confound, audit ituser2026-09-29
* [HW] new finding: GCP crypto-session acquire gate bypassed by retryinguser2026-09-29
* ASD 0x202 path executes after the ASD-load fix, but the bytes are not a discl...user2026-09-29
* GCP FE0F/FE0D: rule out UAF -- slot reuse rebinds the handleuser2026-09-29
* [HW] GCP FE0F/FE0D chain proven end-to-end: unauthorised lookup, destroy, repeatuser2026-09-29
* fw: document the annotation residue; all 632 functions now named or documenteduser2026-09-29
* fw: verified final annotation coverage by querying every IDB directly (85%)user2026-09-29
* psp_out: fold the twelve-TA round into the authoritative audit and disclosure...user2026-09-29
* RESOLVE the MERIT cmd05 oracle: gated by an ASD-derived value; robustness def...user2026-09-29
* fw: apply missed-function pass to all 5 affected TAs and re-run every detectoruser2026-09-29
* LEAD: MERIT cmd05 compares with an unbounded host length; gated on hardwareuser2026-09-29
* fw: IDA had missed functions -- coverage denominator and every sweep were inc...user2026-09-29
* fw: characterise the unnamed remainder instead of inventing names; GCP to 113...user2026-09-29
* fw: annotation coverage 65% -> 82%; POWERPLAY's fptr table found and nameduser2026-09-29
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-09 01:28:27 +0000 — sl0p fork