| Commit message (Expand) | Author | Age |
|---|
| * | LSB-zero ARM-mode re-entry: r8 is the one unswept gadget base, route 1 closed... | user | 2026-10-07 |
| * | index this session's findings, which existed but were unindexed | user | 2026-09-30 |
| * | write up the rollback finding for disclosure | user | 2026-09-30 |
| * | close the last ring-frame field and publish the complete field map | user | 2026-09-30 |
| * | hundredth pass: consolidate the denial-of-service family into a disclosure-re... | user | 2026-09-30 |
| * | seventieth pass: consolidate into a disclosure-ready report and index it | user | 2026-09-30 |
| * | TSU round 7: live mailbox survey -- no command populates the gating table | user | 2026-09-28 |
| * | TSU disclosure: investigate the verify gate, and propagate the caveat | user | 2026-09-28 |
| * | MEC/PM4 round 10: no firmware privilege check on MAP_QUEUES; thread closed | user | 2026-09-28 |
| * | MEC/PM4 round 9: stop the KIQ port on cost/benefit, name the cheaper route | user | 2026-09-28 |
| * | MEC/PM4 round 8: port amdgpu's KIQ slot selection; queue activates, still stalls | user | 2026-09-28 |
| * | Consolidate the GPU-engine campaign into the authoritative validity audit | user | 2026-09-28 |
| * | MEC/PM4 round 7: HIQ plumbing blocked, blocker characterised precisely | user | 2026-09-28 |
| * | MEC/PM4 round 6: MAP_QUEUES chain is untested, not closed | user | 2026-09-28 |
| * | MEC/PM4 round 5 [HW]: the user->kernel register boundary holds | user | 2026-09-28 |
| * | MEC/PM4 round 4: correct the dispatch table, refute the length-bound guess | user | 2026-09-28 |
| * | Synthesise the corpus: test the strongest compound, and reorder the targets | user | 2026-09-28 |
| * | Scope the DMCUB findings by reachability, and test the user-influenced path | user | 2026-09-28 |
| * | Inventory every loadable firmware component, and record the sweep hazard | user | 2026-09-28 |
| * | Census external input channels and test register modelling for SYS_DRV | user | 2026-09-26 |
| * | END TO END: modelled display data steers real PSP firmware in the emulator | user | 2026-09-25 |
| * | full_system's TA invoke was never broken: it was my cmd_buf_len | user | 2026-09-25 |
| * | Inventory the display/DDC input surface; it is 10 RPC channels, not one field | user | 2026-09-25 |
| * | Real-SYS_DRV test for gate B blocked on full_system's TA invoke; index it | user | 2026-09-25 |
| * | Record architectural insights from the AMD SP source | user | 2026-09-24 |
| * | Retract the "flat ring oracle": the readback address was wrong, not the path | user | 2026-09-24 |
| * | P4 resolved: Route C's window is unguarded PSP-internal physical space | user | 2026-09-24 |
| * | Record the actual TSU bug: unverified tsu_write_block is a PSP disclosure pri... | user | 2026-09-24 |
| * | Add the TSU flash/update mailbox to the register and index -- it was missing | user | 2026-09-24 |
| * | Localise the RAS invoke gap: LOAD_TA registers no session; invoke path is fai... | user | 2026-09-24 |
| * | RAS invoke: the status oracle in full_system's ring path is invalid | user | 2026-09-23 |
| * | Fix RAS-in-full_system plumbing; catch a three-address-space aliasing trap | user | 2026-09-23 |
| * | Drive RAS over the ring inside full_system: state confirmed good, plumbing left | user | 2026-09-23 |
| * | P3 resolved: 0x000d's capacity IS populated -- the bridge was the problem | user | 2026-09-23 |
| * | P3: identify the writer of SYS_DRV 0xE575B8 | user | 2026-09-23 |
| * | Restructure the findings corpus: add INDEX.md, resolve duplicates, re-prioritise | user | 2026-09-23 |
