r496j VAS candidates are registered only after a content-verified ring walk (+3 fixes)

The r496g blast registration of every COPY_SERVER_PDES directory let a
stale kernel directory answer another client's VA in the walker's
first-success order (the r459 stale-directory class) - measured as a CUDA
client hanging after DEVICE. Candidates are now parked and registered only
when a walk of the client's own content-validated ring VA through them
reproduces that ring's PA; the r496f vidmem sweep remains as a fallback.

Also in this batch:
- svc_chan_userd's VRAM shape scan now prefers a block with work PENDING
  (get < put) and then the one nearest the registered memdesc offset: on a
  channel re-registration the stale previous USERD still validates (it
  holds the same put/entry values) and the old first-match adoption made
  the pump write GP_GET into the dead block (r504 second DMA init).
- The USERD/FB scan and the CE caps byte-1 BL bits (r496i) are unchanged;
  TU104_CE_CAPS1 = 0x03 needs the CUDA battery re-verification.

1 files changed, 8 insertions, 0 deletions

diff --git a/kernel/gsp_sema_service.h b/kernel/gsp_sema_service.h
index 305a027..ee5c48a 100644
--- a/kernel/gsp_sema_service.h
+++ b/kernel/gsp_sema_service.h
@@ -81,6 +81,14 @@ struct sema_vaspace_desc {
 
 void gsp_sema_service_vaspace_add(const struct sema_vaspace_desc *desc);
 void gsp_sema_service_vaspace_del(u32 h_vaspace);
+/*
+ * r496j: park a page-directory candidate (from COPY_SERVER_PDES) until a
+ * content-validated walk proves it belongs to a live client; only then is
+ * it registered (a blind registration let stale kernel directories answer
+ * other clients' VAs in the walker's first-success order).
+ */
+void gsp_sema_service_vaspace_candidate_add(u32 h_vaspace, u64 pdb,
+					    u32 entries, bool vidmem);
 /* m177: guest RM reload = new guest boot; wipe boot-scoped discovery state
  * (direct-map base, content-scanned tables) on the svc thread. Client
  * session flushes keep that state - see svc_session_flush. */