1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
# Free SYS_DRV `.54` `0x1026`: re-enters initialization without its signed startup predicate
**Conditional lifecycle/availability lead, signed-static only. Do not
invoke on the card merely to get a status.** The free high dispatcher
`sub_E105A8` case `0x1026` calls `sub_E025D0` directly. Its nominal
request scalar is unused by this leaf, and no owner/current-phase check
precedes the initial writes.
Signed Thumb `0xE025D0..0xE025E0` first sets the SYS_DRV-private
status word `0xE26154` to **0** and `0xE257BC` to **2**, before
`sub_E0B490` chooses a hardware branch or later initialization calls
can fail. The variant-`0x100` branch sets `0xE26154` to 1 again only
after that selector; other paths call `sub_E16160`, `sub_E0DB94`,
`sub_E167F0`, `sub_E02A38` and related stateful helpers. Two direct
readers of the `0xE26154` status include `sub_E0ABE0` and
`sub_E20108`; `0xE257BC` is also referenced by multiple signed
leaves, including the `0x1076` path. This is not a read-only getter
or a return-code-only operation.
The only other direct signed callsite of `sub_E025D0` found was
`sub_E0C9AC` during SYS_DRV's normal management path. There it is
conditioned on `BYTE1(*((_DWORD *)*off_E0C9E4+693))==1`, under an
sOS mutex, before updating the manager's completion word. Direct free
`0x1026` bypasses **that particular callsite's** pending-request
predicate; it is not established that the predicate is meant as a
security ACL or that every authorized reinitialization must use it.
There may be later hardware-side gates and indirect callsites.
No live pre-call values, concurrent RAP/other-client ownership,
recovery behavior, safe restoration oracle, or hardware reinitialization
effect are established. The initial two stores and control-flow gap
are signed-code observations, **not** proof of a live cross-client reset
or broader privilege escalation. A modeled init with default-success
SVCs would not supply a hardware oracle for these stateful effects.
|
