vgsp: CONT-100 - mme_ir_pack UNITS FIX: ptr is an MME instruction address (driver codeOffset += codeSize/3, mmeDownload.cpp:5775), each instruction = 3 IR words; old gsp_phys_gr_mme_ir_pack[ptr+k] emitted a pointer-0 image covering only ~312 of 933 instructions, now [ptr*3+k] with next-SA clamp in instructions + maxa in words; correct units need 2960 words > working block ceiling so pack falls back to drain (do not re-enable pack=1 without A/B) - BISECT DONE: culprit macro = slot 0 SETUP_FIXED_CONST (r1345 nop_drop=0x5 slots{0,2}: MME-CALL-DROP 36 word(s) dropped_mask=0x5, 12 beef launches poisons=0; r1347 nop_drop=0x1 slot0 only: MME-CALL-DROP 11 word(s) dropped_mask=0x1, 11 beef launches poisons=0 WITH slot 2 executing); post-call wall both no-poison boots: trap=80002058 data=019a0900 grfifo 06061602->00000001 (method 0x2058=SET_PIPELINE_PROGRAM_ADDRESS_B(1) <- relocated 0x2054-pair operand, then park); offline engine-faithful sim: all executed macros ENDNEXT clean, slot 34 emits draw 0x1618<-0x61000008/0xd74/0xd78/0x1614, slot 0 emits 0x2380<-0x7000 + 0x2384/0x2388<-STATE 0xd18 parts (0 under replay) = incomplete CB selector; driver slot-0 calls carry VPC_CONSTANT_DWORD(VPC_VIEW_ID) gf100varray.c:56; 0xbadf1201 is fixed priv-error constant (pc=513 artifact) - GATE1 black 0/900 pages - next: seed golden STATE 0xd18 (SET_MME_SHADOW_SCRATCH(0x18) method 0x3460) before calls (SETUP_FIXED_CONST merges it into CB_SELECTOR_B/C); find real value in client setup pushes (scan 0x3460 write / fixed-constant base) or golden run; poison-free control nop_drop=1<<0 - SESSION 153 r1345-r1347

0 files changed, 0 insertions, 0 deletions