# Project Frankenstein: Volume XIII

## SCSI Error Dispatcher & Sense Data Mapping

This volume details the internal error-handling mechanisms of the Hitachi-LG GCC-4241N. Specifically, it identifies the routines responsible for generating Sense Data (SK/ASC/ASCQ). Mapping these is vital for diagnostic debugging and for implementing "Silent Success" overrides during the Xbox authentication handshake [cite: User Summary, gcc_hitachi_flasher.c, pp_win.c].

## 1. The Native Error Routine (ROM 0x00003B20)

In the 4241N firmware, most failed command branches converge at a central error dispatcher. This routine is responsible for setting the SCSI Status to `0x02` (Check Condition) and populating the Sense Buffer [cite: 4241N_Mechanical_Analysis.txt, gcc_hitachi_flasher.c].

Property | VMA Address / Offset | Description
--- | --- | ---
Error Dispatcher Entry | `0x00003B20` | Central routine for generating command failures.
Sense Buffer (SRAM) | `0x40000A10` | Location where the 18-byte Sense Data packet is constructed.
Status Register | `0x40000A08` | Holds the current SCSI Status (e.g., 0x02).

### Theory of Sense Data Generation

When a command handler (like Mode Sense $5A) encounters an invalid field, it calls the error dispatcher with specific arguments in the data registers [cite: Volume IX: Mode Select (0x55) Structural Analysis]:

- d0: Sense Key (SK) - e.g., `0x05` for Illegal Request.
- d1: ASC/ASCQ - e.g., `0x2400` for Invalid Field in CDB.

## 2. Common Error Codes in Project Frankenstein

Understanding these codes allows the `pp_win` tool to diagnose handshake failures [cite: gcc_hitachi_flasher.c, pp_win.c].

SK / ASC / ASCQ | Common Label | Interpretation in Hybrid Context
--- | --- | ---
`05 / 21 / 00` | LBA Out of Range | LBA walls at `0x3034E` or `0x2C2CC` are active [cite: 129_perfect_trampoline_v18.py].
`05 / 24 / 00` | Invalid Field in CDB | Incorrect sub-command or signature (HIT/HL) used [cite: pp_win.c].
`02 / 04 / 01` | Logical Unit Not Ready | The drive controller has halted or is performing a physical burn [cite: gcc_hitachi_flasher.c].

## 3. The "Silent Success" Override (RAM Cave)

A sophisticated hybrid firmware can intercept the call to `0x00003B20` to hide failures from the Xbox console. This is implemented by hooking the error routine and forcing a "Good" status [cite: 129_perfect_trampoline_v18.py, pp_win.c].

    ; MN103S Assembly: Silent Success Override
    ; Target: SRAM Cave 0x40008700
    Error_Override_Hook:
        mov     0x40000A10, a0  ; Point to Sense Buffer
        clr     d0              ; d0 = 0 (No Error)
        movbu   d0, (a0)        ; Clear Sense Key
        movbu   d0, (12,a0)     ; Clear ASC
        movbu   d0, (13,a0)     ; Clear ASCQ

        mov     0x40000A08, a0  ; Point to SCSI Status
        mov     0x00, d0        ; 0x00 = Status GOOD
        movbu   d0, (a0)

        ret                     ; Resume command processing

## 4. Diagnostic Utility with `pp_win.c`

By using Peek (OpCode 0xE7 'HIT'), the developer can inspect the SRAM at `0x40000A10` immediately after a command failure to see exactly why the drive rejected the host request [cite: pp_win.c].