# GDR-8050L v256 firmware READ-window path probe

- ok: `true`
- live_trace_ok: `true`
- firmware_derived_host_lba: `true`
- firmware_derived_delta: `false`
- current_gap: `firmware_lba_ingestion_proven_but_window_delta_still_bridge_media_profile_selected`

## Interpretation

v253 keeps the live bridge behavior unchanged.  The v230/v231/v234/v250/v253 evidence proves firmware-side READ(10)/READ(12) host-LBA ingestion into SRAM `0x05EC`.  v250 proved the raw descriptor-builder copy block, and v253 adds a descriptor-gate probe proving the seeded `0x05EC` value can flow through the `0x9001B54E` setup/gate path into `0x9001B5EF` when SRAM `0x05B6` mask `0x04` is set.  The offline natural READ CDB sweep still reaches a D108 host-interface data-phase model decision at `0x9001CD59` and then command completion at the main loop; it does not yet prove the full live READ parser route enters `0x9001B54E`/`0x9001B5EF`.

## Live trace summary

- rows: `265`
- scsi_rows: `258`
- read_rows: `38`
- locked_read_rows: `28`
- unlocked_read_rows: `10`
- unexpected_check_condition_count: `0`
- dynamic_media_window_read_rows: `38`
- effective_delta_counts: `{'0': 28, '198144': 10}`

## CPU sweep post-LBA path cases

| case | assembled | D108 model decision | 0x05EC post-read | 0x9001B5EF descriptor copy | 0x06E4 writes |
|---|---:|---:|---:|---:|---:|
| `read10_video_low_lba_0x00000010` | `0x00000010` | 1 | 0 | 0 | 0 |
| `read10_boundary_lba_0x00202000` | `0x00202000` | 1 | 0 | 0 | 0 |
| `read12_sample_lba_0x0004ABBF` | `0x0004ABBF` | 1 | 0 | 0 | 0 |
| `read12_boundary_lba_0x00202000` | `0x00202000` | 1 | 0 | 0 | 0 |
| `read10_unlocked_max_lba_0x00345B5F` | `0x00345B5F` | 1 | 0 | 0 | 0 |

## Descriptor-builder microprobe

- descriptor_builder_seeded_lba_proven: `True`
- descriptor_builder_case_count: `4`
- descriptor_builder_passed_count: `4`

This proves the descriptor block itself copies seeded `0x05EC` into `0x06E4`; it still does not prove the live READ route reaches that block.

## Descriptor-gate microprobe

- descriptor_gate_proven: `True`
- descriptor_setup_to_builder_proven: `True`
- descriptor_gate_negative_proven: `True`
- descriptor_gate_bit_mask: `0x04` at SRAM `0x05B6`
- descriptor_gate_case_count: `7`
- descriptor_gate_passed_count: `7`

This proves a seeded `0x05EC` value can flow through the `0x9001B54E` descriptor setup function and its `0x05B6` gate into `0x9001B5EF`.  It still does not prove the full READ parser route reaches that function.


## Static firmware breadcrumbs

- firmware_resolved: `True`
- has_05ec_store_9001e541: `True`
- has_05ec_read_candidate_9001b5ef: `True`
- has_descriptor_06e4_write_candidate: `True`
- has_0760_state_refs: `True`

These static breadcrumbs identify the next firmware PCs to drive dynamically; they are not treated as media-window proof by themselves.

## Next probe target

Drive the firmware path beyond `0x9001E541`/`0x06F1` into the descriptor builder around `0x9001B5EF`, then trace `0x06E4`/`0x0760`/`0x0780` state through the transfer decision.  Only after that path consumes or derives the unlocked delta should `firmware_derived_delta` become true.

## Static direct-reference counts

| group | hits | reads | writes | first PCs |
|---|---:|---:|---:|---|
| `assembled_lba_05ec` | 5 | 1 | 4 | `0x9001B5EF, 0x9001E541, 0x9001EEE9, 0x900244AD, 0x900244B7` |
| `current_lba_0760` | 81 | 52 | 29 | `0x9001D876, 0x9001DCA2, 0x9001DCA9, 0x9001E0CC, 0x9001E0E8, 0x9001E10F` |
| `transfer_counter_076c` | 3 | 1 | 2 | `0x9001E359, 0x9001E368, 0x9001E4B5` |
| `transfer_counter_077c` | 2 | 1 | 1 | `0x9001EF54, 0x9001EF66` |
| `descriptor_lba_06e4` | 6 | 4 | 2 | `0x9001B5F2, 0x9001BDEB, 0x90025F89, 0x90025FA8, 0x90025FBF, 0x90025FCD` |
| `cdb_shadow_05d0` | 18 | 15 | 3 | `0x900011B6, 0x900011FB, 0x90001216, 0x90001231, 0x90001387, 0x9001AB8A` |
| `packet_state_05f0` | 181 | 7 | 174 | `0x9001AC02, 0x9001B441, 0x9001B4E9, 0x9001B52E, 0x9001B545, 0x9001B54E` |
| `packet_phase_06f1` | 183 | 6 | 177 | `0x9001AC68, 0x9001AD75, 0x9001ADB7, 0x9001AE24, 0x9001AE5A, 0x9001B2CF` |
| `lba_state_0778` | 9 | 1 | 8 | `0x9001B308, 0x9001E360, 0x9001E427, 0x9001E43D, 0x9001E4B9, 0x9001E4D3` |
| `transfer_state_0780` | 54 | 7 | 47 | `0x9000FE53, 0x9000FE68, 0x9001537B, 0x90019188, 0x9001A128, 0x9001A1CC` |
| `host_gate_0a8d` | 2 | 1 | 1 | `0x90014D21, 0x90031178` |
| `host_if_d108` | 0 | 0 | 0 | `` |
| `host_if_d109` | 0 | 0 | 0 | `` |
| `host_status_d954` | 41 | 13 | 28 | `0x9000107F, 0x900012F0, 0x900012FB, 0x900014A5, 0x900014B0, 0x9000158F` |
