# TA version diffs

Generated by `fw/ta_diff_all.py`. Only **same-branch consecutive builds**: the
third version field is a branch, not a sequence, so cross-branch comparison is
meaningless (ASD's `asd_dispatch` merely oscillates 842/1306/1352 bytes between
branches). Noise normalised per `fw/ta_diff.py`.

See **[SECURITY-REVIEW.md](SECURITY-REVIEW.md)** for the memory-safety and object-lifetime
screening of all 55 diffs: one confirmed fix (HDCP timing side-channel), one unresolved fleet-wide
change (SYS_DRV service 0x208), one defect never fixed in any build (unbounded HDCP2 SRM length),
and a table of eleven apparent fixes refuted at byte level.

## Findings worth starting from

**HDCP 23.0.0.52 -> 23.0.0.57 is a timing side-channel fix.** `hdcp2_rx_LC_Send_L_prime`, the
HDCP 2.x locality check, stopped verifying L' with `memcmp_be` (early exit on the first differing
word) and switched to `ct_memcmp`, which ORs all 16 bytes with no early exit. That comparison is
exactly where an early return leaks a byte-at-a-time oracle. `receiver_id_lookup` still uses
`memcmp_be`, which is fine -- receiver IDs are not secret.

**GCP extends an ASIC allowlist at nearly every release.**
`gcp_cmdFE08_KeyExchangeAuthenticatedSession__h4` grows +10 bytes almost every version. It calls
`gcp_sysdrv_rpc_200()` and switches on the returned word, yielding 0 to proceed or 611 to reject:
14 allowed IDs at 22.0.0.53, then 16, 19, 20, 22, 24, 26, 28 by 22.0.0.77. `0xe` arrives late, at
.68, out of order. `0xd` is still absent.

**GCP 22.0.0.60 -> 22.0.0.62 adds teardown to the session lifecycle.** +1598 bytes concentrated in
`gcp_cmd01` AllocateDRMSession (+90), `gcp_cmd05` CloseDRMSession (+96) and `gcp_cmdFE0D`
DestroyCryptoSession (+68), each gaining the same new call sequence on its error and exit paths.
The callee is still unnamed, so what it releases is not established.

**Do not read ASD's dispatch case lists as change.** `asd_dispatch` appears to lose 48 `case`
labels at 163 -> 173 and regain them at 195 -> 239. That is Hex-Rays alternating between an
explicit `switch` and the range check `if (req->rpc_id - 384 <= 0x40)` -- 384 is 0x180 and
0x180+0x40 is 0x1C0, exactly the range that seems to vanish. The function does genuinely grow
778 -> 1352 bytes inside the 33.0.0 branch, but the case delta is not evidence of new RPCs.

`resized` is the trustworthy column -- same function, different byte size, taken
from the index sidecar rather than the decompiler. `new`/`gone` can also reflect a
function being named in one build and not another, so read them as leads.

| module | branch | from | to | resized | new | gone | bodies | bytes | file |
|---|---|---|---|--:|--:|--:|--:|--:|---|
| asd | 33.0.0 | 33.0.0.163 | 33.0.0.173 | 16 | 166 | 6 | 88 | +1080 | [asd/33.0.0.163__to__33.0.0.173.diff](asd/33.0.0.163__to__33.0.0.173.diff) |
| asd | 33.0.0 | 33.0.0.173 | 33.0.0.181 | 3 | 3 | 2 | 66 | -36 | [asd/33.0.0.173__to__33.0.0.181.diff](asd/33.0.0.173__to__33.0.0.181.diff) |
| asd | 33.0.0 | 33.0.0.181 | 33.0.0.195 | 16 | 100 | 2 | 46 | +8382 | [asd/33.0.0.181__to__33.0.0.195.diff](asd/33.0.0.181__to__33.0.0.195.diff) |
| asd | 33.0.0 | 33.0.0.195 | 33.0.0.239 | 32 | 254 | 6 | 158 | +18638 | [asd/33.0.0.195__to__33.0.0.239.diff](asd/33.0.0.195__to__33.0.0.239.diff) |
| asd | 33.0.4 | 33.0.4.153 | 33.0.4.222 | 20 | 483 | 3 | 87 | +20190 | [asd/33.0.4.153__to__33.0.4.222.diff](asd/33.0.4.153__to__33.0.4.222.diff) |
| asd | 33.0.8 | 33.0.8.195 | 33.0.8.222 | 30 | 163 | 4 | 141 | +7974 | [asd/33.0.8.195__to__33.0.8.222.diff](asd/33.0.8.195__to__33.0.8.222.diff) |
| asd | 33.0.8 | 33.0.8.222 | 33.0.8.235 | 10 | 82 | 2 | 150 | +10458 | [asd/33.0.8.222__to__33.0.8.235.diff](asd/33.0.8.222__to__33.0.8.235.diff) |
| asd | 33.0.8 | 33.0.8.235 | 33.0.8.239 | 4 | 2 | 0 | 19 | +182 | [asd/33.0.8.235__to__33.0.8.239.diff](asd/33.0.8.235__to__33.0.8.239.diff) |
| asd | 33.0.16 | 33.0.16.144 | 33.0.16.209 | 19 | 464 | 2 | 76 | +18758 | [asd/33.0.16.144__to__33.0.16.209.diff](asd/33.0.16.144__to__33.0.16.209.diff) |
| csu | 42.0.0 | 42.0.0.2 | 42.0.0.6 | 1 | 2 | 1 | 3 | +22 | [csu/42.0.0.2__to__42.0.0.6.diff](csu/42.0.0.2__to__42.0.0.6.diff) |
| gcp | 22.0.0 | 22.0.0.53 | 22.0.0.57 | 3 | 8 | 8 | 17 | +32 | [gcp/22.0.0.53__to__22.0.0.57.diff](gcp/22.0.0.53__to__22.0.0.57.diff) |
| gcp | 22.0.0 | 22.0.0.57 | 22.0.0.60 | 1 | 0 | 0 | 5 | +16 | [gcp/22.0.0.57__to__22.0.0.60.diff](gcp/22.0.0.57__to__22.0.0.60.diff) |
| gcp | 22.0.0 | 22.0.0.60 | 22.0.0.62 | 11 | 19 | 18 | 18 | +1598 | [gcp/22.0.0.60__to__22.0.0.62.diff](gcp/22.0.0.60__to__22.0.0.62.diff) |
| gcp | 22.0.0 | 22.0.0.62 | 22.0.0.64 | 0 | 0 | 0 | 6 | +0 | [gcp/22.0.0.62__to__22.0.0.64.diff](gcp/22.0.0.62__to__22.0.0.64.diff) |
| gcp | 22.0.0 | 22.0.0.64 | 22.0.0.68 | 1 | 0 | 1 | 14 | -62 | [gcp/22.0.0.64__to__22.0.0.68.diff](gcp/22.0.0.64__to__22.0.0.68.diff) |
| gcp | 22.0.0 | 22.0.0.68 | 22.0.0.71 | 1 | 0 | 0 | 2 | +10 | [gcp/22.0.0.68__to__22.0.0.71.diff](gcp/22.0.0.68__to__22.0.0.71.diff) |
| gcp | 22.0.0 | 22.0.0.71 | 22.0.0.73 | 1 | 0 | 0 | 5 | +10 | [gcp/22.0.0.71__to__22.0.0.73.diff](gcp/22.0.0.71__to__22.0.0.73.diff) |
| gcp | 22.0.0 | 22.0.0.73 | 22.0.0.77 | 1 | 0 | 0 | 3 | +10 | [gcp/22.0.0.73__to__22.0.0.77.diff](gcp/22.0.0.73__to__22.0.0.77.diff) |
| gcp | 22.0.4 | 22.0.4.49 | 22.0.4.50 | 1 | 4 | 4 | 13 | +6 | [gcp/22.0.4.49__to__22.0.4.50.diff](gcp/22.0.4.49__to__22.0.4.50.diff) |
| hdcp | 23.0.0 | 23.0.0.52 | 23.0.0.57 | 27 | 8 | 7 | 34 | +150 | [hdcp/23.0.0.52__to__23.0.0.57.diff](hdcp/23.0.0.52__to__23.0.0.57.diff) |
| hdcp | 23.0.0 | 23.0.0.57 | 23.0.0.59 | 0 | 2 | 1 | 1 | +178 | [hdcp/23.0.0.57__to__23.0.0.59.diff](hdcp/23.0.0.57__to__23.0.0.59.diff) |
| merit | 24.0.0 | 24.0.0.46 | 24.0.0.50 | 1 | 2 | 3 | 7 | -142 | [merit/24.0.0.46__to__24.0.0.50.diff](merit/24.0.0.46__to__24.0.0.50.diff) |
| merit | 24.0.0 | 24.0.0.50 | 24.0.0.53 | 0 | 0 | 0 | 1 | +0 | [merit/24.0.0.50__to__24.0.0.53.diff](merit/24.0.0.50__to__24.0.0.53.diff) |
| merit | 24.0.0 | 24.0.0.53 | 24.0.0.56 | 1 | 1 | 0 | 2 | +158 | [merit/24.0.0.53__to__24.0.0.56.diff](merit/24.0.0.53__to__24.0.0.56.diff) |
| merit | 24.0.0 | 24.0.0.56 | 24.0.0.57 | 0 | 0 | 0 | 1 | +0 | [merit/24.0.0.56__to__24.0.0.57.diff](merit/24.0.0.56__to__24.0.0.57.diff) |
| merit | 24.0.0 | 24.0.0.57 | 24.0.0.61 | 0 | 1 | 1 | 4 | +56 | [merit/24.0.0.57__to__24.0.0.61.diff](merit/24.0.0.57__to__24.0.0.61.diff) |
| merit | 24.0.0 | 24.0.0.61 | 24.0.0.64 | 0 | 2 | 1 | 4 | +92 | [merit/24.0.0.61__to__24.0.0.64.diff](merit/24.0.0.61__to__24.0.0.64.diff) |
| merit | 24.0.0 | 24.0.0.64 | 24.0.0.66 | 0 | 0 | 1 | 4 | -148 | [merit/24.0.0.64__to__24.0.0.66.diff](merit/24.0.0.64__to__24.0.0.66.diff) |
| merit | 24.0.0 | 24.0.0.66 | 24.0.0.70 | 0 | 0 | 0 | 1 | +0 | [merit/24.0.0.66__to__24.0.0.70.diff](merit/24.0.0.66__to__24.0.0.70.diff) |
| opm | 25.0.0 | 25.0.0.51 | 25.0.0.57 | 3 | 8 | 13 | 8 | -2534 | [opm/25.0.0.51__to__25.0.0.57.diff](opm/25.0.0.51__to__25.0.0.57.diff) |
| opm | 25.0.0 | 25.0.0.57 | 25.0.0.60 | 1 | 0 | 1 | 4 | -1822 | [opm/25.0.0.57__to__25.0.0.60.diff](opm/25.0.0.57__to__25.0.0.60.diff) |
| opm | 25.0.0 | 25.0.0.60 | 25.0.0.62 | 3 | 7 | 5 | 4 | +1726 | [opm/25.0.0.60__to__25.0.0.62.diff](opm/25.0.0.60__to__25.0.0.62.diff) |
| opm | 25.0.0 | 25.0.0.62 | 25.0.0.63 | 0 | 0 | 0 | 9 | +0 | [opm/25.0.0.62__to__25.0.0.63.diff](opm/25.0.0.62__to__25.0.0.63.diff) |
| opm | 25.0.0 | 25.0.0.63 | 25.0.0.66 | 1 | 1 | 1 | 5 | +682 | [opm/25.0.0.63__to__25.0.0.66.diff](opm/25.0.0.63__to__25.0.0.66.diff) |
| opm | 25.0.0 | 25.0.0.66 | 25.0.0.69 | 0 | 0 | 0 | 1 | +0 | [opm/25.0.0.66__to__25.0.0.69.diff](opm/25.0.0.66__to__25.0.0.69.diff) |
| opm | 25.0.0 | 25.0.0.69 | 25.0.0.71 | 0 | 0 | 0 | 1 | +0 | [opm/25.0.0.69__to__25.0.0.71.diff](opm/25.0.0.69__to__25.0.0.71.diff) |
| opm | 25.0.0 | 25.0.0.71 | 25.0.0.81 | 0 | 0 | 0 | 1 | +0 | [opm/25.0.0.71__to__25.0.0.81.diff](opm/25.0.0.71__to__25.0.0.81.diff) |
| opm | 25.0.4 | 25.0.4.47 | 25.0.4.48 | 0 | 0 | 0 | 5 | +0 | [opm/25.0.4.47__to__25.0.4.48.diff](opm/25.0.4.47__to__25.0.4.48.diff) |
| powerplay | 34.0.0 | 34.0.0.9 | 34.0.0.12 | 2 | 14 | 0 | 9 | +5032 | [powerplay/34.0.0.9__to__34.0.0.12.diff](powerplay/34.0.0.9__to__34.0.0.12.diff) |
| powerplay | 34.0.0 | 34.0.0.12 | 34.0.0.13 | 0 | 5 | 3 | 11 | +1200 | [powerplay/34.0.0.12__to__34.0.0.13.diff](powerplay/34.0.0.12__to__34.0.0.13.diff) |
| powerplay | 34.0.0 | 34.0.0.13 | 34.0.0.15 | 0 | 5 | 0 | 12 | +1572 | [powerplay/34.0.0.13__to__34.0.0.15.diff](powerplay/34.0.0.13__to__34.0.0.15.diff) |
| powerplay | 34.0.0 | 34.0.0.15 | 34.0.0.17 | 0 | 2 | 0 | 5 | +1288 | [powerplay/34.0.0.15__to__34.0.0.17.diff](powerplay/34.0.0.15__to__34.0.0.17.diff) |
| rap | 7.0.0 | 7.0.0.19 | 7.0.0.22 | 1 | 0 | 12 | 1 | +266 | [rap/7.0.0.19__to__7.0.0.22.diff](rap/7.0.0.19__to__7.0.0.22.diff) |
| ras | 27.0.0 | 27.0.0.21 | 27.0.0.22 | 1 | 0 | 0 | 1 | +16 | [ras/27.0.0.21__to__27.0.0.22.diff](ras/27.0.0.21__to__27.0.0.22.diff) |
| ras | 27.0.0 | 27.0.0.22 | 27.0.0.23 | 1 | 7 | 19 | 1 | -1622 | [ras/27.0.0.22__to__27.0.0.23.diff](ras/27.0.0.22__to__27.0.0.23.diff) |
| ras | 27.0.0 | 27.0.0.23 | 27.0.0.24 | 0 | 1 | 0 | 0 | +756 | [ras/27.0.0.23__to__27.0.0.24.diff](ras/27.0.0.23__to__27.0.0.24.diff) |
| ras | 27.0.0 | 27.0.0.25 | 27.0.0.26 | 1 | 0 | 0 | 1 | +16 | [ras/27.0.0.25__to__27.0.0.26.diff](ras/27.0.0.25__to__27.0.0.26.diff) |
| wspe | 30.0.0 | 30.0.0.28 | 30.0.0.30 | 1 | 0 | 0 | 4 | -2 | [wspe/30.0.0.28__to__30.0.0.30.diff](wspe/30.0.0.28__to__30.0.0.30.diff) |
| wspe | 30.0.0 | 30.0.0.30 | 30.0.0.34 | 1 | 4 | 2 | 2 | +104 | [wspe/30.0.0.30__to__30.0.0.34.diff](wspe/30.0.0.30__to__30.0.0.34.diff) |
| wspe | 30.0.0 | 30.0.0.34 | 30.0.0.35 | 0 | 0 | 0 | 3 | +0 | [wspe/30.0.0.34__to__30.0.0.35.diff](wspe/30.0.0.34__to__30.0.0.35.diff) |
| wspe | 30.0.0 | 30.0.0.35 | 30.0.0.36 | 0 | 0 | 0 | 2 | +0 | [wspe/30.0.0.35__to__30.0.0.36.diff](wspe/30.0.0.35__to__30.0.0.36.diff) |
| wspe | 30.0.0 | 30.0.0.36 | 30.0.0.38 | 0 | 0 | 0 | 2 | +0 | [wspe/30.0.0.36__to__30.0.0.38.diff](wspe/30.0.0.36__to__30.0.0.38.diff) |
| xgmi | 32.0.0 | 32.0.0.2 | 32.0.0.13 | 8 | 33 | 0 | 9 | +2722 | [xgmi/32.0.0.2__to__32.0.0.13.diff](xgmi/32.0.0.2__to__32.0.0.13.diff) |
| xgmi | 32.0.0 | 32.0.0.13 | 32.0.0.15 | 23 | 15 | 4 | 34 | +2616 | [xgmi/32.0.0.13__to__32.0.0.15.diff](xgmi/32.0.0.13__to__32.0.0.15.diff) |
| xgmi | 32.0.0 | 32.0.0.15 | 32.0.0.20 | 4 | 2 | 0 | 15 | +738 | [xgmi/32.0.0.15__to__32.0.0.20.diff](xgmi/32.0.0.15__to__32.0.0.20.diff) |