# Signed OPM `.51` cmd 8 → ASD `0x301`: prefix check versus SRM payload

**Scope:** static signed OPM `.51` and ASD `.163`; no emulator authentication
claim, card request, valid SRM, or active-build proof. This refines the older
`fw/AUDIT-NEW-TAS-RE.md` host-data-route observation: reaching the emitter
is **conditional on an OPM integrity/crypto comparison**. It does not follow
that an arbitrary host can author the prefix that selects that path.

## OPM byte ranges (raw Thumb at `0x401320..0x401544`)

**New entry-span check:** Signed `opm_TA_InvokeCommandEntryPoint`
(`0x402AE4`) first requires a nonnull param0 memref with low param-type
nibble `7` and `*(u32 *)(param0+4) >= 0x3D54`, before dispatching
host command 8 to `0x401320`. That declared minimum is larger than the
cmd-8 prefix and payload-pointer fields through host `+0x101F`.
Thus the fixed 0x1000-byte prefix copy is **not** an uncovered
length check in OPM's signed entry. This does not prove that sOS maps
or validates the whole declared memref: the host-to-sOS mapping boundary
was not independently measured here.

For cmd 8, `R7` is the host params pointer. OPM checks slot index
`*(u32 *)(R7+0x10) <= 0x3f`, requires a slot state 3, then:

- `0x401360..0x40136E`: set `R8=SP+0x10`, copy exactly `0x1000` bytes
  from `R7+0x18` into that stack buffer. The copied host range is
  **`[+0x18,+0x1018)`**.
- `0x401380..0x401390`: call `sub_402300(index, R8+0x10, 0xff0, R8)`;
  reject when it returns zero. Inside `sub_402300` the signed code obtains
  a SYS_DRV crypto object, calls service-1 `0x10` on the `0xff0`-byte
  `R8+0x10` portion, and compares the computed first 16 bytes with `R8`
  via `sub_402EB8` (bytewise XOR/OR). It releases objects on examined
  paths. The modeled availability of keys/CCP and any ability to produce
  such an authenticated prefix are **not established**.
- `0x40152C..0x401544`: require `*(u32 *)(SP+0x34)==4`. This corresponds
  to copied host **`+0x3c`**. `R0=*(u32 *)(SP+0x38)` corresponds to copied
  host **`+0x40`**. Both are within the compared prefix; describing them
  as independently attacker-settable would overlook the earlier gate.
  The `0x301` request length is read from host **`+0x1018`** and its input
  pointer is host **`+0x101c`**. These two fields are *outside* the
  `0x1000`-byte compared prefix. OPM only checks nonzero length here, but
  ASD `.163` then bounds length to `[0x30,0x1400]` and validates the
  caller mapping.

ASD `.163` `asd_srm_op_301` (`0xD0CED0`) further checks a stored SRM
version bound, and `asd_srm_header_check` (`0xD0D0D4`) requires the input
SRM's big-endian header bytes `input[2..3]` to equal OPM's `R0` from the
compared prefix. It then performs format and cryptographic checks before
storing the SRM and entering `asd_srm_sub_12EC4`'s multi-revocation loop.
Thus the uncovered OPM payload range is **not** a signature bypass.

## Conclusion / boundary

A verified prefix (if legitimately available) can select a host-supplied
length and SRM payload after its own check, but the prefix controls the
expected SRM header value and ASD checks the signed content independently.
No accepted multi-match SRM, OPM `.51` card build, naturally satisfied
prefix, or live downstream effect is demonstrated. This static OPM path
improves provenance for the separate conditional bug in
`fw/CANDIDATE-ASD-163-SRM-MULTI-REVOCATION-BITMAP.md`; it does not
justify invoking `0x301` on the card.