vgsp-gr: hold calls on a stream-damaged push so a dropped chunk cannot run LOAD_CONSTANT_BUFFER without its selector state

A chunked GL draw whose earlier chunk was dropped (prelude LOAD-ONLY or the
r1447 arming window hold) replayed the remaining chunks' calls alone; the
constant-buffer selector (0x2380) lived in the dropped chunk, so the bug2548370
macro's LOAD_CONSTANT_BUFFER(0x2390) class-errored (ErrorCode 3) and the
engine poisoned (badf1201 sentinel: pc=513/mac=0xf1 are its artifact, not a
macro). Propagate the stream-relative chunk offset through the candidate and
submit path, keep a per-push STREAM-DAMAGE record of the lowest dropped chunk,
emit later chunks calls-held (the proven-safe shape), never arm the arming
window-hold on a damaged stream, and start a fresh section at stream_rel==0.
r1487: the exact r1485 damaging shape now retires clean (events=5, no poison)
and the next chunk is captured; r1486 (holds off) still poisons because the
first launch runs against a partially packed prelude, confirming the dropped
chunk is the cause, not the hold release.

1 files changed, 9 insertions, 0 deletions

diff --git a/kernel/gsp_phys_booter.h b/kernel/gsp_phys_booter.h
index 6689771..f821a85 100644
--- a/kernel/gsp_phys_booter.h
+++ b/kernel/gsp_phys_booter.h
@@ -495,6 +495,15 @@ struct gsp_phys_gr_submit {
 	 */
 	const u32 *stream;
 	u32 stream_n;		/* dwords */
+	/* Stream-relative dword offset of this window inside the client's
+	 * 3D section (0 = the section's first chunk). Used to detect that an
+	 * earlier chunk of the same push was dropped by a LOAD-ONLY carrier
+	 * or the r1447 window hold: the remaining chunks must then elide
+	 * their CALL runs (the lost chunk's state - e.g. the constant-buffer
+	 * selector - is no longer on the channel, so a macro that emits
+	 * LOAD_CONSTANT_BUFFER would class-error -> FECS priv-error poison).
+	 */
+	u32 stream_rel;
 	/*
 	 * SESSION 153-CONTINUED-87: the first program VA the captured
 	 * window binds (SET_PIPELINE_PROGRAM_ADDRESS pair; 0 when none).