# Analyzer Findings Register

**PFES revision:** 0.13.0
**Findings:** 35

| ID | Domain | Status | Finding |
|---|---|---|---|
| ANL-FIND-001 | workflow | Validated | The analyzer is a staged evidence pipeline; stage boundaries are contracts and must not be collapsed casually. |
| ANL-FIND-002 | performance | Validated | A full Stage5B run costs over 100 minutes on the user system; formatting, helper and source-only work must avoid unnecessary reruns. |
| ANL-FIND-003 | tooling | Validated | Ghidra is unavailable on the primary machine; objdump, custom scripts and project MN103S tooling are the supported primary path. |
| ANL-FIND-004 | interface | Validated | Canonical installed script filenames are stable interfaces even when package names or producer versions change. |
| ANL-FIND-005 | provenance | Validated | Byte identity does not erase provenance. Storage deduplication is only acceptable when every source instance remains separately addressable. |
| ANL-FIND-006 | provenance | Validated | Update-utility-extracted GCC-4244N B103 and canonical HITMEM B103 must remain distinct logical evidence records. |
| ANL-FIND-007 | provenance | Validated | Stock/update-derived and E7-patched GDR-8164B 0L06 rows must remain distinct in rankings and comparisons. |
| ANL-FIND-008 | container | Partially Corroborated | Sydex/CopyQM self-extracting update utilities require a pre-ingest container layer before ordinary Stage1 payload extraction. |
| ANL-FIND-009 | container | Partially Corroborated | fwdv1301.exe and fwdv1302.exe contain SXD streams at offset 0x426A with a preceding WB block; exact track/sector reconstruction remains unresolved. |
| ANL-FIND-010 | negative_knowledge | Negative Knowledge | Carved SXD streams, 2 KiB Aaru bins, zero30-repaired tracks and other diagnostics must not be promoted as firmware without track reconstruction and CRC closure. |
| ANL-FIND-011 | normalization | Validated | Stage2 separates DLD firmware and optional stub roles and matches PRM metadata without decrypting or interpreting firmware. |
| ANL-FIND-012 | routing | Validated | Stubs are treated as plaintext and never enter the firmware decryptor. |
| ANL-FIND-013 | routing | Validated | GDR-3120L is a validation reference and Xbox-ripping target, not a recipient-candidate promotion target. |
| ANL-FIND-014 | routing | Validated | The current Stage3/4 lineage recognizes canonical HITMEM ROMs as direct plaintext and passes them to analysis without KPA transformation. |
| ANL-FIND-015 | transform | Validated | The GCC old-DLD/TSOP transform uses the GCC bit permutation plus XOR 0xA7A7A7A7 and round-trips accurate A100 and A101 evidence. |
| ANL-FIND-016 | transform | Partially Corroborated | The GDR transform maps are implemented in the decryptor lineage; model-family scope must remain evidence-bound rather than universalized. |
| ANL-FIND-017 | transform | Validated | Weak raw/new-style KPA output is routed to review, not promoted to Stage5 analysis. |
| ANL-FIND-018 | disassembly | Validated | Stage5A uses mn10300-elf-objdump with binary input, big-endian decode and explicit adjusted VMA. |
| ANL-FIND-019 | disassembly | Partially Corroborated | Firmware VMA selection by 0x40-versus-0x90 pointer-lane counts is a useful heuristic, not proof of the physical memory map. |
| ANL-FIND-020 | stage5b | Validated | Stage5B is an evidence collector. It does not patch, verify checksums, certify profiles, or mark hardware live-safe. |
| ANL-FIND-021 | stage5b | Negative Knowledge | Absence of a direct literal command compare is not evidence that the command handler is absent. |
| ANL-FIND-022 | stage5b | Open Question | GDR-8164B shows DVD-ROM identity but no direct 0xAD compare surface in the focused analysis; indirect, table-driven, predecoded or state-machine dispatch remains the leading explanation. |
| ANL-FIND-023 | stage5b | Validated | Command recovery must keep separate evidence buckets for direct opcode compare, table dispatch, semantic handler behavior and cross-family structural match. |
| ANL-FIND-024 | stage5b | Validated | Donor-only Xbox authentication evidence is expected to be absent from ordinary recipient PC firmware and must not be scored as a generic defect. |
| ANL-FIND-025 | stage5b | Validated | CD_READY means media presence/readiness and is independent of authentication or unlocked media view. |
| ANL-FIND-026 | stage5b | Partially Corroborated | The current v25 output architecture contains per-payload records, compact records and 19 category-organized JSONL evidence streams. |
| ANL-FIND-027 | stage5b | Partially Corroborated | The preserved latest full-run log indexes Stage5B inputs through 434 and writes both compact and legacy Stage6 candidate products. |
| ANL-FIND-028 | profiles | Validated | Stage6 profile candidates and recipient rankings remain generated candidates until independent validation closes the claim. |
| ANL-FIND-029 | reporting | Validated | Purchase-validation candidates, broad unowned-record watchlists and near-purchase rollups are separate products with different semantics. |
| ANL-FIND-030 | workflow | Validated | Every future analyzer run command block should end by archiving the generated result set. |
| ANL-FIND-031 | workflow | Validated | Use targeted input subsets and smoke outputs to validate analyzer changes before committing to a full Stage5B rerun. |
| ANL-FIND-032 | source_lineage | Partially Corroborated | The directly preserved sources are reference snapshots; later workspace producer lineages include Stage3 v5, Stage4 v5 and Stage5B v25. |
| ANL-FIND-033 | evidence | Validated | Generated evidence should retain manifests, inventories, logs, finding stores, helper reports, exact input hashes and producer identity together. |
| ANL-FIND-034 | safety | Validated | A high analyzer score or parser candidate is never sufficient evidence for flashing, purchasing or live-drive safety. |
| ANL-FIND-035 | workflow | Validated | Analyzer facts must remain separate from historical HTML claims even when a later analyzer result corroborates or rejects a historical claim. |
