# GDR-8050L v256 READ(10) scheduler-to-descriptor probe

- ok: `true`
- firmware_derived_host_lba: `true`
- firmware_derived_delta: `false`
- scheduler_to_read10_wrapper_proven: `true`
- read10_handler_to_scheduler_return_proven: `true`
- scheduler_phase04_to_descriptor_call_proven: `true`
- descriptor_copy_from_scheduler_proven: `true`

## What this proves

This controlled CPU slice follows the closer natural path: READ-class scheduler `0x9001C710` loads the command function pointer from SRAM `0x06F4`, calls the real READ(10) wrapper `0x9002EA7C`, the wrapper calls the real READ(10) handler `0x9001EED0`, the handler assembles CDB-shadow LBA into `0x05EC` and writes `0x05F0=0x11` / `0x06F1=0x04`, then control returns to the scheduler. The scheduler observes phase `0x04` and calls descriptor setup at `0x9001C78A -> 0x9001B4B3`, which reaches `0x9001B5EF`, copies `0x05EC -> 0x06E4`, and arms `0x06E0=0xF0`. The zero-flags case shows the READ(10) handler itself sets the descriptor gate bit at `0x9001EEDA`, so this path no longer depends on pre-seeding `0x05B6=0x04`.

## What this does not prove

It still does not derive the Redump/unlocked media-window delta from firmware execution. Keep `firmware_derived_delta=false` until a firmware window/selector path is proven to consume or compute the media offset.

## Cases

| case | flags | LBA | wrapper | handler | 0x05EC match | scheduler descriptor call | descriptor copy | 0x06E4 match | 0x06E0=F0 | ok |
|---|---:|---:|---:|---:|---:|---:|---:|---:|---:|---:|
| `scheduler_read10_gate_on_video_lba` | `0x04` | `0x00000010` | `True` | `True` | `True` | `True` | `True` | `True` | `True` | `True` |
| `scheduler_read10_gate_on_redump_boundary_lba` | `0x04` | `0x0004ABBF` | `True` | `True` | `True` | `True` | `True` | `True` | `True` | `True` |
| `scheduler_read10_gate_on_dispatch_boundary_lba` | `0x04` | `0x00202000` | `True` | `True` | `True` | `True` | `True` | `True` | `True` | `True` |
| `scheduler_read10_gate_on_unlocked_max_lba` | `0x04` | `0x00345B5F` | `True` | `True` | `True` | `True` | `True` | `True` | `True` | `True` |
| `scheduler_read10_gate_auto_from_zero_flags` | `0x00` | `0x0004ABBF` | `True` | `True` | `True` | `True` | `True` | `True` | `True` | `True` |

## Remaining proof gap

The parser/dispatch/scheduler/descriptor chain for host READ(10) LBA is now proven in controlled CPU slices. The remaining parser/descriptor-related work is to tie this to any live firmware session state that selects the unlocked/media window, not to promote bridge-supplied mapping as firmware-derived.
