aboutsummaryrefslogtreecommitdiffstats
path: root/hw (follow)
Commit message (Expand)AuthorAge
...
* hundred-and-seventh pass: close the invoke-structure gap properlyuser2026-09-30
* hundred-and-sixth pass: fuzz the unused bytes of the invoke ring structureuser2026-09-30
* hundred-and-fifth pass: no aperture validation on the command buffer, a fifth...user2026-09-30
* hundred-and-fourth pass: descriptor address alignment is enforceduser2026-09-30
* hundred-and-third pass: the pre-authentication image parser is cleanuser2026-09-30
* hundred-and-second pass: complete the corpus sweep across the full command rangeuser2026-09-30
* ninety-ninth pass: complete the full corpus sweep across 78 buildsuser2026-09-30
* ninety-eighth pass: over-declaring the command window causes no out-of-bounds...user2026-09-30
* ninety-seventh pass: corpus builds on hardware give a parameter-driven hang a...user2026-09-30
* ninety-fourth pass: handle and state-machine fuzz, negative but weakuser2026-09-30
* ninety-third pass: complete the deep randomized fuzz across the application setuser2026-09-30
* ninety-second pass: session slot churn at scale is cleanuser2026-09-30
* ninety-first pass: concurrent sessions show no cross-session state leakageuser2026-09-30
* ninetieth pass: session lifecycle and use-after-free probes, negativeuser2026-09-30
* eighty-ninth pass: characterise the last two unread GFX commands and TMR relo...user2026-09-30
* eighty-eighth pass: the image source is range-checked, sharpening the earlier...user2026-09-30
* eighty-seventh pass: the trusted-region range check is correct, no off-by-oneuser2026-09-30
* eighty-sixth pass: fuzz the load descriptor, find a third wedge and confirm a...user2026-09-30
* eighty-fifth pass: remove the harness invoke ceiling and fuzz far deeperuser2026-09-30
* eighty-fourth pass: the 1008-invoke wedge is our own ring bug, retracteduser2026-09-30
* eighty-third pass: per-field mutation fuzz, its one hit did not reproduceuser2026-09-30
* eighty-second pass: show the last untested application is inert, closing the gapuser2026-09-30
* eighty-first pass: close the void gap in the out-of-bounds testuser2026-09-30
* eightieth pass: hardware test for out-of-bounds writes into host memory, nega...user2026-09-30
* seventy-ninth pass: hardware disclosure search across ten applications, negativeuser2026-09-30
* seventy-eighth pass: classify the wedge on hardware, it is a hang not a faultuser2026-09-30
* seventy-seventh pass: rule out session-index dependence for the wedgeuser2026-09-30
* seventy-sixth pass: extended command surface clean, root cause still openuser2026-09-30
* seventy-fourth pass: test the proposed root cause on hardware and falsify ituser2026-09-30
* seventy-second pass: hardware fuzz finds a host INVOKE that wedges the PSPuser2026-09-30
* seventy-first pass: hardware test of the reachability negativeuser2026-09-30
* [HW] new finding: GCP crypto-session acquire gate bypassed by retryinguser2026-09-29
* ASD 0x202 path executes after the ASD-load fix, but the bytes are not a discl...user2026-09-29
* NEW finding: GCP FE0F returns handles for crypto slots that are not live [ST+HW]user2026-09-29
* NEW finding: GCP FE0D decrements the session refcount on a rejected handle [S...user2026-09-29
* [HW] priming a DRM session does not satisfy ASD's gate; 0x202 still refusesuser2026-09-29
* [HW] host drives GCP into calling ASD 0x202; ASD refuses, so no leak yetuser2026-09-29
* INVOKE probe [HW]: all twelve newly-discovered TAs are host-invokableuser2026-09-29
* LOAD_TA full sweep [HW]: 88/117 accepted, 16 TA components authenticate on Na...user2026-09-29
* LOAD_TA sweep [HW]: this Navi 31 accepts 13 Windows TAs, 9 of types never aud...user2026-09-29
* Retract the "wall at PA 0x3ef00000": it was ring exhaustion, not an address l...user2026-09-24
* Sweep VRAM with the classification oracle: only the TMR is protected below 1 GBuser2026-09-24
* A working address-classification oracle on silicon, validated against ground ...user2026-09-24
generated by cgit v1.3.1-sl0p (git 2.54.0) at 2026-11-11 19:50:57 +0000 — sl0p fork