wall-2 session-87: window page-list hunt - the 2 GiB cycle's windows are scattered (later offsets at first_PA+off are zeros); the memdesc {size 0x20000, PA=0x107c47000, kptrs} page list is only reachable via the kernel pointers (kcore walk with fresh addresses needed); content search for the init-stream prefix found the window pages (0x103c06000+0x858, 0x11dbfa000+0x858, 0x126d69000+0x59c) but the VA<->page relation is non-linear; the client blocks in os_schedule at the allocation (the unread later pushes suspected)

1 files changed, 28 insertions, 0 deletions

diff --git a/tools/guest-diag/wall2/README-session77.md b/tools/guest-diag/wall2/README-session77.md
index 06dc2f2..6040aff 100644
--- a/tools/guest-diag/wall2/README-session77.md
+++ b/tools/guest-diag/wall2/README-session77.md
@@ -315,3 +315,31 @@
   reproducer - NOTE: it hits vkCreateDevice -4 without the harness
   (word nudge + count clear), so it cannot replace the vk_frame run),
   t91.py (auto-clear + ICD memprops/alloc hooks).
+
+## ADDENDUM (r689, session 87) — the window page-list hunt: the pages are scattered; content matches found but the VA<->page relation is unresolved
+
+* The 2 GiB cycle's window records (recscan89): `0x4480000` descs =
+  {0x107c47000 (live init stream), 0x103c06000, 0x12ecc2000};
+  `0x4ca0000` descs = {0x11dbfa000, 0x12f398000 (live init stream)}.
+  The window's later offsets (va+0x52d4, +0x586c, +0x9000) at
+  first_PA+offset are ALL ZEROS -> the windows are NOT contiguous
+  (scattered pages).
+* The memdesc record (page 0x106128000) is {size=0x20000, flags
+  0x03008000, PA=0x107c47000, kernel pointers 0xffff8d2e5e21ec50 /
+  0x4fe7ec50 / 0x461287e8 ... , "head"/"tail"} — the page list hangs off
+  the kernel pointers. A guest kcore walk of those pointers returned
+  "unreadable" (stale addresses by the time of the walk; the walk must
+  happen on FRESH pointers in the same pass as the dump).
+* Content search for the distinctive init-stream prefix (`00 80 01 20
+  b5 c5 00 00 04 00 04 20`) found the window pages:
+  0x107c47000+0x0 (the injected init page), 0x103c06000+0x858,
+  0x11dbfa000+0x858, 0x126d69000+0x59c — the later pages hold the same
+  engine-init streams at arbitrary offsets; the VA<->page relation is
+  NOT linear (the +0x59c push appears in pages whose +0x0 is zero), so
+  the mapping cannot be reconstructed by offset alone.
+* NEXT: (a) dump the memdesc + kcore-walk its page-list pointers in ONE
+  guest pass (fresh addresses); or (b) inject the content-matched pages
+  at trial VAs and watch the service's reads; or (c) the service-side
+  decode of the window page lists. The client (2632) blocks in
+  os_schedule at the allocation — the unread later pushes are the
+  suspected gate.