# GDR-8050L v250 descriptor-builder microprobe

- ok: `true`
- firmware_descriptor_builder_seeded_lba_proven: `true`
- firmware_derived_delta: `false`

## What this proves

This offline CPU microprobe proves that the firmware block at `0x9001B5EF` reads the LBA from SRAM `0x05EC`, writes it into descriptor SRAM `0x06E4`, and arms transfer flag `0x06E0 = 0xF0` when the block is entered directly.

## What this does not prove

It does **not** prove the live READ command route reaches `0x9001B5EF`, and it does **not** promote the unlocked Redump delta to firmware-derived. The remaining target is to drive the natural firmware route from the READ CDB parser at `0x9001E541` into this descriptor builder.

## Cases

| case | input LBA | descriptor bytes expected | descriptor bytes written | 0x06E0=F0 | ok |
|---|---:|---:|---:|---:|---:|
| `video_low_lba_0x00000010` | `0x00000010` | `10000000` | `10000000` | `True` | `True` |
| `read12_sample_lba_0x0004ABBF` | `0x0004ABBF` | `BFAB0400` | `BFAB0400` | `True` | `True` |
| `boundary_lba_0x00202000` | `0x00202000` | `00202000` | `00202000` | `True` | `True` |
| `unlocked_max_lba_0x00345B5F` | `0x00345B5F` | `5F5B3400` | `5F5B3400` | `True` | `True` |

## Next local target

Add a controlled continuation/hook to the READ CDB CPU sweep so the natural path after `0x9001E541` can be driven into `0x9001B5EF`, instead of only stopping at the D108 host-interface data-phase model decision.
