|
|
The request entry splits on the opcode, sending values at or above 0x1000 to the 247-case
switch treated throughout this work as the dispatcher and everything below it to a
separate handler family that was never analysed. That family is recovered here and
recorded as a command map.
This invalidates the basis on which the XGMI callee-length finding was filed as latent.
The claim that the platform does not implement opcode 0xd came from checking only the
247-case switch, which serves no opcode below 0x1000. The small-opcode family has a case
for 0xd routing to a substantive handler that validates a length, calls one of the copy
sites already catalogued in this audit, and reports a result back to the caller, so the
precondition the finding was waiting on appears satisfied. The finding is reopened with
three concrete steps listed before it can be called exercisable.
The same family contains the poisoner and consumer of the open stack-overflow lead, at
opcodes 3 and 8/9 respectively.
|
