| Commit message (Expand) | Author | Age |
|---|
| ... | |
| * | Identify the display-surface gate: sOS service table, dest 2 never registered | user | 2026-09-25 |
| * | Locate where the display chain stops: RPC 0x1a0, refused by sOS before any se... | user | 2026-09-25 |
| * | full_system's TA invoke was never broken: it was my cmd_buf_len | user | 2026-09-25 |
| * | Inventory the display/DDC input surface; it is 10 RPC channels, not one field | user | 2026-09-25 |
| * | Real-SYS_DRV test for gate B blocked on full_system's TA invoke; index it | user | 2026-09-25 |
| * | Retract "crafted DDC data reached the bug": the passthrough test was circular | user | 2026-09-25 |
| * | End-to-end: a sink-reported byte alone decides whether the HDCP overflow runs | user | 2026-09-25 |
| * | Model a malicious display sink: gate B's value passes through verbatim | user | 2026-09-25 |
| * | Re-rate HDCP session-state bypass: gate B is sink-supplied input, not a secret | user | 2026-09-25 |
| * | Close ASD 0x308: the write branch is structurally unreachable, not undemonstr... | user | 2026-09-24 |
| * | Retract the "wall at PA 0x3ef00000": it was ring exhaustion, not an address l... | user | 2026-09-24 |
| * | Sweep VRAM with the classification oracle: only the TMR is protected below 1 GB | user | 2026-09-24 |
| * | A working address-classification oracle on silicon, validated against ground ... | user | 2026-09-24 |
| * | Record the LOAD_TA-outside-VRAM hazard in psp_out/CONSTRAINTS.md | user | 2026-09-24 |
| * | Step 2 on silicon: absent-address probing wedges the card; record the hazard | user | 2026-09-24 |
| * | Execute strategy step 1: CCP fault statuses were unmodelled; fix by modelling | user | 2026-09-24 |
| * | Strategy shift: structural controls (pspemu/oracle.py), then CCP as an oracle | user | 2026-09-24 |
| * | Reachability for the TA SVC lead: identity confirmed, the call is not | user | 2026-09-24 |
| * | Lead 3: the SVC gate and the pointer validator disagree about the caller | user | 2026-09-24 |
| * | New angle: enumerate the kernel surface a compromised TA can reach | user | 2026-09-24 |
| * | Fix two broken controls; the Route C window really is untouched on exercised ... | user | 2026-09-24 |
| * | Add routec_window_watch harness; its own control voids its first result | user | 2026-09-24 |
| * | Downgrade Route C impact to provisional: the consumer scan has a blind spot | user | 2026-09-24 |
| * | Record architectural insights from the AMD SP source | user | 2026-09-24 |
| * | Adopt verified CCP semantics from the leaked AMD SP tree | user | 2026-09-24 |
| * | Record the inconclusive attempt to find RAS's init parameter source | user | 2026-09-24 |
| * | RAS authors 0xffff000b itself; locate the single fix-point, do not patch it | user | 2026-09-24 |
| * | Trace RAS's 0xffff000b to the TA init handshake, not the loader | user | 2026-09-24 |
| * | Narrow RAS's 0xffff000b: not the image loader, and two hypotheses refuted | user | 2026-09-24 |
| * | Ring LOAD_TA works; the failure is RAS-specific, not a harness defect | user | 2026-09-24 |
| * | Retract the "flat ring oracle": the readback address was wrong, not the path | user | 2026-09-24 |
| * | Mark ifwi_parse_model as diverging from firmware; revert an attempted fix | user | 2026-09-24 |
| * | Bound Route C's impact: firmware references 3 of the window's 415 dwords | user | 2026-09-24 |
| * | P4 resolved: Route C's window is unguarded PSP-internal physical space | user | 2026-09-24 |
| * | Fuzz the pre-auth IFWI parser: two OOB sites, both bounded to 16 bytes | user | 2026-09-24 |
| * | RESOLVED: the TSU 4.1c disclosure is signature-gated -- downgrade the finding | user | 2026-09-24 |
| * | Correct the TSU e2e caveat: the earlier verify failure is not a signature rej... | user | 2026-09-24 |
| * | Demonstrate the TSU 4.1c chain end to end in the emulator, and find a gating ... | user | 2026-09-24 |
| * | Confirm the 4.1c disclosure mechanism in our build, at corrected addresses | user | 2026-09-24 |
| * | Demonstrate the pre-auth IFWI wrapping bug executing in the emulator | user | 2026-09-24 |
| * | Record that the TSU disclosure path is runtime-reachable, not boot-time | user | 2026-09-24 |
| * | Record the actual TSU bug: unverified tsu_write_block is a PSP disclosure pri... | user | 2026-09-24 |
| * | Add the TSU flash/update mailbox to the register and index -- it was missing | user | 2026-09-24 |
| * | Localise the RAS invoke gap: LOAD_TA registers no session; invoke path is fai... | user | 2026-09-24 |
| * | RAS invoke: the status oracle in full_system's ring path is invalid | user | 2026-09-23 |
| * | Fix RAS-in-full_system plumbing; catch a three-address-space aliasing trap | user | 2026-09-23 |
| * | Drive RAS over the ring inside full_system: state confirmed good, plumbing left | user | 2026-09-23 |
| * | P3 resolved: 0x000d's capacity IS populated -- the bridge was the problem | user | 2026-09-23 |
| * | P3: identify the writer of SYS_DRV 0xE575B8 | user | 2026-09-23 |
| * | P1: find a decoding VCN window, pin the acceptance precondition, writes still... | user | 2026-09-23 |
