aboutsummaryrefslogtreecommitdiffstats
Commit message (Expand)AuthorAge
...
* fw: sweep missing-liveness lookups across all 12 TAs -- only GCP FE0F; MERIT ...user2026-09-29
* NEW finding: GCP FE0F returns handles for crypto slots that are not live [ST+HW]user2026-09-29
* RETRACT the GCP FE09 lead: the host-controlled value is a MAC input length, n...user2026-09-29
* LEAD: GCP FE09 passes a host-controlled length into a crypto unwrap over a 56...user2026-09-29
* fw: sweep the reject-then-mutate pattern across all 12 TAs -- GCP FE0D is the...user2026-09-29
* NEW finding: GCP FE0D decrements the session refcount on a rejected handle [S...user2026-09-29
* fw: propagate shared-runtime names by content hash; coverage 38% -> 61%user2026-09-29
* ASD 0x301 is correctly bounded: OPM lead deflates to reachability-without-impactuser2026-09-29
* fw: measure annotation coverage (238/622 fns) and document the stale-.i64 wor...user2026-09-29
* OPM 0x301: correct the route and show the argument points into the HOST pageuser2026-09-29
* fw: trace host data into OPM's ASD-0x301 chain; control of the write still un...user2026-09-29
* fw: fix the opcode rule (req[0] = store at [SP]); AUC/FP/XGMI reach was misre...user2026-09-29
* fw: OPM cmd05 reaches ASD 0x301, the second dismissed-for-lack-of-emitter defectuser2026-09-29
* [HW] priming a DRM session does not satisfy ASD's gate; 0x202 still refusesuser2026-09-29
* [HW] host drives GCP into calling ASD 0x202; ASD refuses, so no leak yetuser2026-09-29
* GCP cmd4 passes the HOST params buffer to ASD 0x202: the disclosure is host-v...user2026-09-29
* fw: verify annotation state in all twelve IDBs; record the TMZ reopen hanguser2026-09-29
* fw: corrected IDA-derived SVC tables for all twelve TAs; retract the shifted ...user2026-09-29
* fw: IDA-authoritative RPC thunk naming; GCP 0x202 -> ASD verified three waysuser2026-09-29
* fw: SVC surface of the new TAs -- GCP forwards ASD 0x202, overturning a stand...user2026-09-29
* fw: reverse-engineer and annotate all twelve newly-hittable TAs in IDAuser2026-09-29
* INVOKE probe [HW]: all twelve newly-discovered TAs are host-invokableuser2026-09-29
* fw: triage the twelve unaudited TA types this card accepts; TMZ is a stub, RA...user2026-09-29
* HDCP: confirm the stack canary is present and covering the overflow in all 17...user2026-09-29
* HDCP: map the oldest TA build (23.0.4.49) and sweep the overflow shape across...user2026-09-29
* LOAD_TA full sweep [HW]: 88/117 accepted, 16 TA components authenticate on Na...user2026-09-29
* fw: harvest all 53 Windows driver versions -- 110 new firmware images, 17 TA ...user2026-09-29
* LOAD_TA sweep [HW]: this Navi 31 accepts 13 Windows TAs, 9 of types never aud...user2026-09-29
* fw: carve PSP firmware from AMD Windows drivers; 10 TA types the Linux corpus...user2026-09-29
* ASD 0x202: two new negative axes, and name the question that actually decides ituser2026-09-29
* Disclosure summary: correct 0x3103 reasoning, bound the VCN half, surface GPU...user2026-09-29
* VCN DPG round 2: LMA writes latch nothing reachable; false positive caught by...user2026-09-29
* VCN DPG round: un-gate VCN registers, explain the old constant-window, sound ...user2026-09-29
* VCN type-49 closure: target space identified as the DPG shadow register fileuser2026-09-29
* VCN type-49: validated read channel, first sound write-observation, two new p...user2026-09-29
* SYS_DRV 0x3103: close reachability -- the stored length is pinned at zerouser2026-09-29
* TSU round 7: live mailbox survey -- no command populates the gating tableuser2026-09-28
* TSU round 6: void the mailbox survey -- it failed its own liveness controluser2026-09-28
* TSU round 5: answer the open question; the gating table is never populateduser2026-09-28
* TSU round 4: no writer found for the bound word; correct round 3's over-readuser2026-09-28
* TSU: the verify abort is an empty registry, not a security checkuser2026-09-28
* TSU disclosure: investigate the verify gate, and propagate the caveatuser2026-09-28
* MEC/PM4 round 10: no firmware privilege check on MAP_QUEUES; thread closeduser2026-09-28
* MEC/PM4 round 9: stop the KIQ port on cost/benefit, name the cheaper routeuser2026-09-28
* Record the stuck-HQD hazard from the KIQ port, and the ATX recoveryuser2026-09-28
* MEC/PM4 round 8: port amdgpu's KIQ slot selection; queue activates, still stallsuser2026-09-28
* Consolidate the GPU-engine campaign into the authoritative validity audituser2026-09-28
* MEC/PM4 round 7: HIQ plumbing blocked, blocker characterised preciselyuser2026-09-28
* MEC/PM4 round 6: MAP_QUEUES chain is untested, not closeduser2026-09-28
* MEC/PM4 round 5 [HW]: the user->kernel register boundary holdsuser2026-09-28
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-09 01:39:36 +0000 — sl0p fork