vgsp: content-gated FB-shadow push rescue for recycled client pushes (eng20, end-to-end validation pending)

The direct-GL client's one-shot 59,556 B setup push (VA 0x4001004) reads
zero at decode time: the live page is recycled before our decode runs, so
no C597 bind attaches for h=0xbeef0100. The rescue recovers the push body
from the FB shadow with strict content gates: reject fill windows (require
>=2 multi-word INC runs + >=8 distinct headers), scan at the push VA's
in-page offset (0x4041004 starts 4 B into a page), and log the channel
handle. eng20 refuted the unregistered-VAS hypothesis: the payload pages
DO walk via VAS 0xbeef0300 (0x4000000->pa=0x342ead000,
0x4001000->pa=0x342eae000, consistent delta). Also found: sema_gl_xlate
(absent from params-r1780; default 0) gates every C597 section-recognition
site - with it on, the lane produced its first C597 captures
(127x c305, 20x c307). Validation cyclic c308 (guest init panic) / c309
(QGA wedge) blocked; no observation yet. Unvalidated end to end.

0 files changed, 0 insertions, 0 deletions