1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
# ASD `.163` `0x100`: type-1 callback error leaves active type-6 record
**Signed-code partial-state defect, reproduced in isolated signed
dispatch with synthetic descriptor and installed ASIC-20/25 callback.
No card session, accepted hardware link, or cross-client effect.**
`0x100 → sub_D0B66C` bounds the channel to 0–31 and validates
its 64-byte descriptor. It writes `record[+4]=1`, copies descriptor
word 0 into `record[+8]` and copies other fields **before** invoking
callback slot 769 if descriptor word 0 is 1. ASIC-20/25 startup
`sub_D08DAC` installs slot 769 thunk `0xD10441 →
asd_state_not_1_cfg0` (`0xD10FD4`). That signed callback writes
record `+76=5`, `+64=6` and `+68=4` on a non-1 private startup
predicate `*(u32 *)0xD29108`, then **returns 1**. If predicate is 1,
it writes `+68=2` and returns 0. `sub_D0B66C` returns the callback
result without clearing the active/type fields on error. This is a
persistent *record state in the isolated model*, not a demonstrated
live protected session.
`python3 psp_emu/harness/probe_asd163_100_type1_error_record.py`
passed through signed `0x100` dispatch. With a planted type-1
descriptor and a synthetic installed signed slot-769 thunk,
predicate 0 returned **1** but left
`(+4,+8,+64,+68,+76)=(1,1,6,4,5)`; predicate 1 returned **0**
and left `(1,1,6,2,5)`. There were no emulated faults. The test
starts without a full ASIC boot or valid channel/fabric descriptor.
A prior fresh-boot **card read** found the predicate
`0xD29108==1` at that point, so predicate-0 is **not** the measured
fresh-boot state; later transitions and other callback failures
remain unverified. Signed DTM `.19` host commands 2/4 are an
independent producer of ASD `0x100` with descriptor word 0 from
the host request (`fw/AUDIT-DTM19-ASD100-TYPE1-PRODUCER.md`);
this does **not** demonstrate that a live host supplies type 1
when the failure predicate holds. No hardware command was issued for this test.
Subsequent first-level `0x1A1` checks an active record and record
`+8==1` before the ASIC status/callback gates. This does **not**
show that an error-left-behind record passes slot 770, becomes a
valid HDCP victim, reaches entropy generation, or harms a second
client. Other `0x100` callback variants and record reuse are not
closed. Do not create/fail live links merely for a status code.
|
