# GDR-8050L v256 descriptor-gate microprobe

- ok: `true`
- descriptor_gate_proven: `true`
- descriptor_gate_bit_mask: `0x04` at SRAM `0x05B6`
- descriptor_setup_to_builder_proven: `true`
- firmware_derived_delta: `false`

## What this proves

This offline CPU microprobe starts at firmware `0x9001B54E`, reaches the gate test at `0x9001B5E8`, and proves that when SRAM `0x05B6` has mask `0x04` set, the function naturally enters `0x9001B5EF`, copies the seeded assembled LBA from `0x05EC` to descriptor SRAM `0x06E4`, and writes transfer flag `0x06E0 = 0xF0`.

It also includes negative cases proving that the same function skips `0x9001B5EF` when that gate bit is clear.

## What this does not prove

It still does **not** prove that the full live READ parser route reaches `0x9001B54E`/`0x9001B5EF`, and it does **not** promote the unlocked Redump delta to firmware-derived.

## Cases

| case | 0x05B6 | expect copy | input LBA | gate hit | 0x9001B5EF hit | 0x06E4 bytes | 0x06E0=F0 | ok |
|---|---:|---:|---:|---:|---:|---:|---:|---:|
| `gate_on_video_lba` | `0x04` | `True` | `0x00000010` | `True` | `True` | `10000000` | `True` | `True` |
| `gate_on_read12_sample_lba` | `0x04` | `True` | `0x0004ABBF` | `True` | `True` | `BFAB0400` | `True` | `True` |
| `gate_on_boundary_lba` | `0x04` | `True` | `0x00202000` | `True` | `True` | `00202000` | `True` | `True` |
| `gate_on_unlocked_max_lba` | `0x04` | `True` | `0x00345B5F` | `True` | `True` | `5F5B3400` | `True` | `True` |
| `gate_off_zero_flags` | `0x00` | `False` | `0x0004ABBF` | `True` | `False` | `????????` | `False` | `True` |
| `gate_off_wrong_low_bit` | `0x02` | `False` | `0x0004ABBF` | `True` | `False` | `????????` | `False` | `True` |
| `gate_on_all_flags` | `0xFF` | `True` | `0x0004ABBF` | `True` | `True` | `BFAB0400` | `True` | `True` |

## Handoff

The next proof target is now narrower: drive the already-proven firmware READ CDB parser path ending at `0x9001E541 -> 0x05EC` into the descriptor setup function at `0x9001B54E`, then through the gate bit at `0x05B6` into `0x9001B5EF`.
