# Historical HTML Claim Review — Batch 01

## Scope

Reviewed HTML-009, HTML-011, and HTML-038: the baseline/audit/summary family.

## Result

Substantive claims reviewed: **35**

| Status | Count |
|---|---:|
| Validated | 3 |
| Partially corroborated | 4 |
| Historical/Untrusted | 13 |
| Superseded | 3 |
| Rejected | 8 |
| Negative knowledge | 1 |
| Open question | 3 |

## Controlling Conclusion

The baseline family cannot serve as an authoritative hybrid implementation specification. HTML-009 explicitly deprecates itself and states that the GDR-8050L-to-GCC-4241N hybrid will not work. Earlier claims of complete donor isolation, 100% relocatability, verified recipient anchors, safe LBA-wall patches, and retail-grade readiness are not accepted.

Useful lower-level observations were retained with narrower status:

- both devices are MN103S-family targets;
- 0x90008847 participates in a Mode Sense-related path;
- the 0xAD command contains the FF 02 FD FF FE byte pattern;
- media transition invalidates authorization state;
- fail-closed behavior after validation failure remains sound safety guidance.

## Negative Knowledge

- Do not use 0x90000000 as a general peripheral base.
- Do not treat standard opcodes 0x55/0x5A as established firmware-stage/ignition commands.
- Do not treat the five A101 NOP patches as validated.
- Do not treat the donor block as proven dependency-free or safely relocatable.
- Do not treat ordinary LBA 16 as the validated complete authentication source.
- Do not attach the BH6590KU gain claim to GCC-4241N.
- Do not assign a PCJD4 SRAM location; the older audit explicitly says it was not confirmed.

## Full Claim Index

| Claim | Source | Section | Status | Normalized claim |
|---|---|---|---|---|
| HCLM-B01-001 | HTML-009 | Document preface | validated | The Final Technical Summary is deprecated, and the proposed GDR-8050L-to-GCC-4241N hybrid will not work. |
| HCLM-B01-002 | HTML-009 | Document preface | rejected | HTML-009 is a definitive implementation reference for transplanting GDR-8050L security logic into GCC-4241N. |
| HCLM-B01-003 | HTML-009 | 1. Core Architecture & Memory Mapping | validated | GDR-8050L and GCC-4241N are Panasonic/Matsushita MN103S-family targets. |
| HCLM-B01-004 | HTML-009 | 1. Core Architecture & Memory Mapping | historical_untrusted | GCC-4241N internal SRAM is based at 0x40000000, with a hybrid cave at 0x4000807A and authorization flag 0x2CC. |
| HCLM-B01-005 | HTML-009 | 1. Core Architecture & Memory Mapping | historical_untrusted | External SDRAM at 0x10C80000 is the 512 KiB image staging area and challenge workspace. |
| HCLM-B01-006 | HTML-009 | 1. Core Architecture & Memory Mapping | rejected | 0x90000000 is a general peripheral-I/O base for servo, DMA, cache, and SCSI registers. |
| HCLM-B01-007 | HTML-009 | 2. The Cryptographic Core | partially_corroborated | GDR-8050L code at 0x90008847 participates in a Mode Sense security-state path. |
| HCLM-B01-008 | HTML-009 | 2. The Cryptographic Core | open_question | The routine at 0x90008847 is a portable SHA-1/RC4 engine consuming a 20-byte page-0x3E challenge. |
| HCLM-B01-009 | HTML-009 | 2. The Cryptographic Core | historical_untrusted | Timer IRQ vector 0x00000008 must be masked through PSW during digest generation to prevent SCSI jitter. |
| HCLM-B01-010 | HTML-009 | 2. The Cryptographic Core | rejected | Injected hybrid code requires D-cache flush and I-cache invalidate through CHCTR at 0x90000000. |
| HCLM-B01-011 | HTML-009 | 3. Communication & Identity Protocol | superseded | A successful hybrid must patch Inquiry data at 0x40000D40 to report GDR/DVD-ROM identity and write protection. |
| HCLM-B01-012 | HTML-009 | 3. Communication & Identity Protocol | historical_untrusted | A101 LBA walls at 0x3034E and 0x2C2CC can be bypassed through the seek state machine and registers near 0x40000B20. |
| HCLM-B01-013 | HTML-009 | 3. Communication & Identity Protocol | partially_corroborated | Xbox authentication uses the physical-address pattern 0x02FDFFFE. |
| HCLM-B01-014 | HTML-009 | 4. Physical Integration & Safety | rejected | Opcode 0x5A with an HL signature is a firmware ignition command independent of checksum validation. |
| HCLM-B01-015 | HTML-009 | 4. Physical Integration & Safety | partially_corroborated | Execution or commit should be aborted after checksum failure to avoid bricking the drive. |
| HCLM-B01-016 | HTML-009 | 4. Physical Integration & Safety | rejected | Xbox discs require boosting BH6590KU tracking gain at register 0x0044 in a GCC-4241N hybrid. |
| HCLM-B01-017 | HTML-009 | 4. Physical Integration & Safety | validated | A tray-open/media-transition event invalidates authorization and requires reauthentication. |
| HCLM-B01-018 | HTML-009 | 4. Physical Integration & Safety | historical_untrusted | Port B GPIO and external IRQ 0x18 clear authorization flag 0x2CC when the tray opens. |
| HCLM-B01-019 | HTML-009 | 5. Deployment Workflow | rejected | The hybrid stages a 512 KiB image through opcode 0x55, verifies a final 0x00 block, ignites with 0x5A/HL, and recovers through 0x9000D008. |
| HCLM-B01-020 | HTML-011 | 1. Finalized Target Anchors | historical_untrusted | A101 authorization state is stored at SRAM offset 0x06A0. |
| HCLM-B01-021 | HTML-011 | 1. Finalized Target Anchors | historical_untrusted | A101 has safe injection caves at 0x017D6 and 0x4E12D, with 138,963 bytes at the latter. |
| HCLM-B01-022 | HTML-011 | 1. Finalized Target Anchors | historical_untrusted | 0x10C80000 is a verified A101 sector-read workspace. |
| HCLM-B01-023 | HTML-011 | 2. Security Sector & Handshake Logic | partially_corroborated | Xbox media contains a PCJD4 lead-in signature used by authentication logic. |
| HCLM-B01-024 | HTML-011 | 2. Security Sector & Handshake Logic | rejected | The complete Xbox security dependency is a 2,048-byte sector read from logical LBA 16. |
| HCLM-B01-025 | HTML-011 | 2. Security Sector & Handshake Logic | historical_untrusted | Payload v3 verified the required behavior through a manual LBA 0 read. |
| HCLM-B01-026 | HTML-011 | 2. Security Sector & Handshake Logic | historical_untrusted | Hybrid state 2 bypasses native spin-down commands. |
| HCLM-B01-027 | HTML-011 | 3. LBA Wall Neutralization | historical_untrusted | NOP patches at 0x3034E, 0x2C2CC, 0x31A85, 0x3781A, and 0x3782A safely neutralize all A101 LBA restrictions. |
| HCLM-B01-028 | HTML-011 | 4. Disaster Recovery | open_question | Direct T48 programming requires XOR mask 0xA7A7A7A7 and the listed 32-bit bit-swap map. |
| HCLM-B01-029 | HTML-011 | 5. MN103S Assembler Syntax Notes | superseded | The then-current assembler uses constants without # and register-indirect calls as calls (reg). |
| HCLM-B01-030 | HTML-038 | 1. Relocation Audit: Donor Engine Isolation | rejected | A 2,615-byte donor engine of 15 subroutines has zero external dependencies and is 100% relocatable into GCC-4241N. |
| HCLM-B01-031 | HTML-038 | 2. Target Memory Anchors | historical_untrusted | Volume I verified A101 anchors at 0x06A0, 0x017D6, 0x4E12D, and 0x10C80000. |
| HCLM-B01-032 | HTML-038 | 3. Lead-In Signature Check | negative_knowledge | The PCJD4 lead-in signature location in clean A101 SRAM was not confirmed. |
| HCLM-B01-033 | HTML-038 | 3. Lead-In Signature Check | superseded | If PCJD4 is not in SRAM, the hybrid should perform a manual mechanical read of LBA 0 or PFI. |
| HCLM-B01-034 | HTML-038 | 4. LBA Wall Neutralization Map | historical_untrusted | The five listed NOP patches are a verified A101 LBA-wall neutralization map. |
| HCLM-B01-035 | HTML-038 | 5. Disaster Recovery | open_question | The listed XOR key and bit-swap map are verified pre-encryption constants for T48 recovery. |
