wall-2 session-84: the a86038 want-scan mapped - all four entries PASS with the driven window value (wants {0,0,0,6} vs actuals {0,0,0,0xffffffff00000100}, no pending); a full-window write (0x0..0x1ff0) does not clear the wait; the residual gate is the A8 loop's internal callback/retry machinery (the a85f30 exit path decrements *(rbp) while firing the global callbacks 0x206f790/0x206f7a0 with args from rbp+0x30/0x38/0x40) and the slow yield-spin cadence (b284b0(...,0xb))

1 files changed, 26 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index daa0463..f59ad03 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -236,3 +236,29 @@
   a82f30 in the sampled window); the nvidia0-side window (obj+0x1478)
   is NOT present in the pagemap (VM_IO; host cannot write it via the
   RAM file).
+
+## ADDENDUM (r687, session 84) — the a86038 want-scan mapped: ALL WANTS PASS with the driven window value; the residual gate is the A8 loop's internal callback/retry machinery
+
+* Live dump of the a86038 scan (BP at 0xa8608e, per-index):
+    i=0 want=0x0 actual=0x0 pend=no
+    i=1 want=0x0 actual=0x0 pend=no
+    i=2 want=0x0 actual=0x0 pend=no
+    i=3 want=0x6 actual=0xffffffff00000100 pend=no
+  (want from a82fd0(job_obj, i) = the job object's +0x98 array maxed
+  against global+0x600; actual from r14+0x5e8 = our driven counter).
+  NO pending entries -> the scan completes.
+* Writing 0x100 to the ENTIRE readback window (offsets 0x0..0x1ff0 of VA
+  0x7827e6c12000) did not clear the wait either.
+* The loop still cycles: the bt stays at the a85f08-a85f1a yield call
+  (b284b0(*(rsp+0x10), 0xb) - a bounded pause/yield spin of ~0x14
+  units, hence the slow cadence), and the exit-attempt path a85f30
+  decrements *(rbp) (w0=1) while firing the global callbacks
+  (0x206f790/0x206f7a0 vtables: *(%rax), *0x10, *0x18) with args from
+  rbp+0x30/0x38/0x40. The remaining gate is this callback/retry
+  machinery (or another wait object), not the readback values.
+* NEXT: resolve the global callback targets (0x206f790/0x206f7a0
+  vtables at runtime) and trace the a85f30 exit path (what the
+  callbacks do and what makes *(rbp) reach 0); or find how the real GPU
+  writes the readback window (the op-4 methods 0x800000bb/0xbc the
+  service skips) and emulate that write so the client's own machinery
+  completes.