Host-reachable PSP command handlers — annotated decompilation

Every file is <header block> + <Hex-Rays output>. The header states exactly how the host reaches that handler and which bytes of the shared buffer it controls.

READ THIS FIRST — decompiler caveats

These are Hex-Rays dumps and Hex-Rays has misled this project four times. Anything load-bearing must be checked against disassembly:

1. ta_memcpy/asd_memcpy are thunks. WITHOUT the prototypes applied (see ../annotate_hdcp.py) Hex-Rays prints sub_401058(); with ALL ARGUMENTS DROPPED. That is what hid the HDCP stack overflow. The files here were generated WITH prototypes applied.
2. Buffer sizes in the local declarations can be wrong. _DWORD v54[58] (232 B) in sub_402A88 is actually 268 B -- ta_memclr(v54, 0x10C) is authoritative.
3. Stack-protector epilogues can render as while ( *v4 != v56 ) loops that fold unrelated code into the "body". Naming __stack_chk_guard/__stack_chk_fail makes Hex-Rays hide them properly.
4. A single LDR whose value is used twice prints as two dereferences and looks like a TOCTOU double-fetch. Three such "findings" in the HDCP handlers were single loads.

Layout

hdcp/   16 top-level commands + 8 sub-commands + entry/dispatch
dtm/    3 commands + entry
ras/    5 commands + dispatcher/validator/open-session
asd/    14 reachable commands + dispatcher/init/vtable installer

The short version of reachability

HOST --INVOKE_CMD--> TA (HDCP / DTM / RAS)            shared buf = HOST VRAM
                      |
                      +--SVC 0xF2 service 2--> ASD    command id HARDCODED
                                                      by the TA wrapper
                      +--SVC 0xF2 service 1--> crypto task in sOS

The host can pick the TA command freely, but NOT the ASD command. Of ~60 TA->ASD call sites exactly one (HDCP cmd 0x12 -> ASD 0x308) forwards a raw host-VRAM pointer; everything else passes TA stack/session memory.

Files that matter most

hdcp/cmd_0e_hdcp2.c          missing rollback -> session-state bypass (WORKS)
hdcp/subcmd_12_*.c           the stack OOB (reachable, blocked by MAC length)
hdcp/cmd_12_bridge.c         the only host->ASD pointer bridge
asd/cmd_0308_*.c             validate-then-recompute (reachable, crypto gated)
dtm/cmd_02_topology_update_v2.c   is_miracast=1 = the display-core bring-up