# Historical HTML Claim Review — Batch 04

## Scope

Reviewed eleven documents covering memory maps, MN103S ISA, sense handling,
interrupt and command dispatch, DMA, ATAPI controller behavior, DRAM limits,
reset/exception handling, cache theory, and bridge compatibility.

## Result

New substantive claims: **94**  
Cumulative historical claims: **249**

| Batch-04 status | Count |
|---|---:|
| Validated | 20 |
| Partially corroborated | 11 |
| Historical/Untrusted | 26 |
| Superseded | 1 |
| Rejected | 30 |
| Negative Knowledge | 0 |
| Open Question | 6 |

## Primary corrections

### Model hardware

The GCC-4241N service manual directly confirms:

- MN103S63G-class controller;
- ATAPI and DMA hardware;
- 2 MB external SDRAM;
- 512 KB flash;
- BH6590KU motor/actuator/stepping/tray driver.

This corrects the previous rejection of BH6590KU presence. It does not validate
the claimed Xbox tracking-gain register or calibration requirement.

### Memory-map limits

The historical global VMA map is rejected as an authoritative map. It mixes raw
image offsets, possible aliases, and inferred physical ranges. Current A101
analysis uses a 0x90000000 ROM base and identifies 0x10C80000 as a staging
candidate. The service manual's 2 MB SDRAM also conflicts with treating the
historical one-megabyte span as the complete physical SDRAM range.

### ISA

The generic MN103S register and instruction families are validated from primary
documentation. The historical bit-manipulation examples are wrong: BTST, BSET,
and BCLR immediate operands are masks, not human bit numbers. CALL and CALLS are
also distinct call forms rather than interchangeable spellings.

### Error and sense handling

The generic SCSI status and sense-code meanings are validated. The historical
claims that individual sense tuples uniquely prove specific internal patch
sites, HIT/HL signature failures, or flash-burn state are rejected. The proposed
"Silent Success" hook is rejected as unsafe because forcing GOOD status does
not complete the underlying command semantics.

### Interrupts and exceptions

The fixed historical vector assignments at offsets 0x00, 0x08, 0x10, and 0x18
are rejected. Primary MN103S documentation uses reset/NMI architecture addresses
and programmable vector-address registers for level interrupts. Exact GCC
interrupt routing remains a product-specific recovery task.

### DMA and ATAPI controller

DMA and ATAPI hardware are validated by the service manual. The invented
0x9000C000 DMA map and 0x9000D000 SBC map are rejected. The 512 KiB/256-block
host stream and 4,080-byte stub are validated from current source; the drive's
internal DMA implementation and SRAM collision thresholds remain unresolved.

### Cache

Cache support exists in some MN103S products, but a split cache and the listed
GCC cache-control registers are not established. The exact 0x90000000 cache
recipe is rejected. Execute-after-write coherency remains a conditional
engineering concern to test if product-specific cache evidence appears.

### Bridges

Adapter transparency is a real qualification requirement. A single Peek/Poke
probe is not sufficient to qualify a bridge for the full flash sequence, and
`#pragma pack(8)` is a host-ABI concern rather than a JMicron hardware property.

## Status revisions caused by primary evidence

- `HCLM-B02-022`: Rejected -> Validated (BH6590KU presence).
- `HCLM-B01-016`: Rejected -> Open Question (chip present; register and Xbox
  gain requirement unproven).
- `HCLM-B01-005`: Historical/Untrusted -> Partially Corroborated
  (0x10C80000 staging candidate).

## Full Batch-04 claim index

| Claim ID | Source | Section | Status | Normalized claim |
|---|---|---|---|---|
| HCLM-B04-001 | HTML-015 | 1. Global Memory Map (MN103S VMA) | validated | GCC-4241N hardware contains 512 KB flash and 2 MB external SDRAM. |
| HCLM-B04-002 | HTML-015 | 1. Global Memory Map (MN103S VMA) | rejected | The document's complete VMA map—ROM 0x00000000-0x0007FFFF, SRAM 0x40000000-0x40008EFC, and SDRAM 0x10C00000-0x10CFFFFF—is authoritative for A101. |
| HCLM-B04-003 | HTML-015 | 2. Handshake Staging: The DRAM Buffers | partially_corroborated | 0x10C80000 is a GCC-4241N A101 DRAM staging-buffer candidate. |
| HCLM-B04-004 | HTML-015 | Buffer B: Secondary Cache | historical_untrusted | 0x10CC0000 is an established alternate handshake-response cache. |
| HCLM-B04-005 | HTML-015 | 3. Critical Status Flags | partially_corroborated | A101 firmware actively accesses low address 0x2CC, but its exact semantic role is unresolved. |
| HCLM-B04-006 | HTML-015 | 3. Critical Status Flags | historical_untrusted | GDR-8050L SRAM address 0x5DB is the donor flag that bypasses LBA restrictions and preserves spindle state. |
| HCLM-B04-007 | HTML-015 | 3. Critical Status Flags | partially_corroborated | Low address 0x840 is used by donor firmware and is a candidate command-related state location, but a universal 12-byte CDB-cache identity is unproven. |
| HCLM-B04-008 | HTML-015 | Theory of Data Flow: The Challenge Cycle | rejected | The Xbox sends a 20-byte challenge through MODE SENSE 0x5A, donor crypto writes a response at 0x10C80014, and READ DVD STRUCTURE 0xAD returns 2,048 bytes from 0x10C80000. |
| HCLM-B04-009 | HTML-015 | 4. The RAM Cave Layout | rejected | The fixed 0x4000807A-0x40008F00 SRAM partition is a safe executable hybrid layout for dispatcher, memdump, mechanical, and crypto handlers. |
| HCLM-B04-010 | HTML-014 | Data Completion & Reconciliation | rejected | The addendum resolves every previous TBD and supplies exact coordinates for a functional hybrid implementation. |
| HCLM-B04-011 | HTML-014 | 1. 8050L Donor: Logical Constants & Context | open_question | The PCJD4 signature string is located at donor VMA 0x9002E810. |
| HCLM-B04-012 | HTML-014 | 1. 8050L Donor: Logical Constants & Context | historical_untrusted | The donor Group-7 command jump table begins at 0x90033100. |
| HCLM-B04-013 | HTML-014 | 1. 8050L Donor: Logical Constants & Context | open_question | The donor SHA-1 context uses 96 bytes at SRAM 0x4100 and the RC4 S-box resides at SRAM 0x4200. |
| HCLM-B04-014 | HTML-014 | 2. GCC-4241N Recipient: Mechanical Hook Resolution | historical_untrusted | A101 START/STOP UNIT dispatch is at raw offset 0x7222E and can be redirected to 0x40008350. |
| HCLM-B04-015 | HTML-014 | 3. Handshake Buffer: Detailed Memory Mapping | rejected | Buffer A stores a 20-byte challenge, a 20-byte response, and a 2,048-byte security-sector mirror from FF 02 FD FF FE. |
| HCLM-B04-016 | HTML-014 | SDRAM Buffer B | historical_untrusted | 0x10CC0000 contains an RC4 key schedule and LBA-wall scratchpad at the listed offsets. |
| HCLM-B04-017 | HTML-014 | 4. RAM Cave Layout: Final Partitioning | rejected | The listed cave partition prevents collisions and provides a complete safe placement plan for hybrid handlers and stack. |
| HCLM-B04-018 | HTML-017 | 1. Register Architecture | validated | MN103S is a 32-bit architecture with four 32-bit data registers D0-D3 and four 32-bit address registers A0-A3. |
| HCLM-B04-019 | HTML-017 | 1. Register Architecture | validated | SP is the stack pointer and PSW contains condition and interrupt-control state. |
| HCLM-B04-020 | HTML-017 | 2. Core Instruction Set | validated | The MN103S ISA includes MOV, MOVBU, MOVHU, CLR, CMP, BTST, BSET, BCLR, JMP, CALL/CALLS, conditional branches, and return instructions. |
| HCLM-B04-021 | HTML-017 | 2. Core Instruction Set: Bit Manipulation | rejected | The examples interpret BTST 0, BSET 3, and BCLR 7 immediate operands as human bit indices. |
| HCLM-B04-022 | HTML-017 | 3. Addressing Modes | validated | Immediate, register-indirect, displacement/indexed, and absolute addressing forms are supported by the MN103S instruction family. |
| HCLM-B04-023 | HTML-017 | 2. Core Instruction Set: Control Flow | rejected | CALL and CALLS are interchangeable spellings with identical stack and return behavior. |
| HCLM-B04-024 | HTML-017 | 1. Register Architecture | historical_untrusted | GCC-4241N stack pointer is fixed at 0x40008F00. |
| HCLM-B04-025 | HTML-017 | 4. Practical Payload Snippet | rejected | Writing byte value 1 to address 0x2CC is sufficient to authorize Xbox media. |
| HCLM-B04-026 | HTML-017 | Document scope | rejected | The volume is a sufficient product-specific ISA and payload reference for GCC-4241N hybrid development. |
| HCLM-B04-027 | HTML-019 | 1. The Native Error Routine | validated | SCSI status 0x02 means CHECK CONDITION and indicates that sense data describes an error or exception. |
| HCLM-B04-028 | HTML-019 | 2. Common Error Codes | validated | Sense tuple 05/21/00 means ILLEGAL REQUEST / LOGICAL BLOCK ADDRESS OUT OF RANGE. |
| HCLM-B04-029 | HTML-019 | 2. Common Error Codes | validated | Sense tuple 05/24/00 means ILLEGAL REQUEST / INVALID FIELD IN CDB. |
| HCLM-B04-030 | HTML-019 | 2. Common Error Codes | validated | Sense tuple 02/04/01 means NOT READY / LOGICAL UNIT NOT READY, BECOMING READY. |
| HCLM-B04-031 | HTML-019 | 1. The Native Error Routine | historical_untrusted | A101 central error dispatcher is at 0x00003B20 with status at 0x40000A08 and an 18-byte sense buffer at 0x40000A10. |
| HCLM-B04-032 | HTML-019 | Theory of Sense Data Generation | historical_untrusted | The native error routine takes sense key in D0 and combined ASC/ASCQ in D1. |
| HCLM-B04-033 | HTML-019 | 2. Common Error Codes | rejected | Receiving 05/21/00 proves that the alleged A101 LBA-wall branches at 0x3034E or 0x2C2CC are active. |
| HCLM-B04-034 | HTML-019 | 2. Common Error Codes | rejected | Receiving 05/24/00 uniquely proves that the HIT or HL signature or subcommand is incorrect. |
| HCLM-B04-035 | HTML-019 | 2. Common Error Codes | rejected | Receiving 02/04/01 means the controller has halted or is physically burning flash. |
| HCLM-B04-036 | HTML-019 | 3. The Silent Success Override | rejected | Clearing sense bytes and forcing status GOOD is a safe general method for hiding command failures from the Xbox. |
| HCLM-B04-037 | HTML-019 | 4. Diagnostic Utility with pp_win.c | historical_untrusted | Peeking 0x40000A10 after failure reliably retrieves the current 18-byte GCC-4241N sense packet. |
| HCLM-B04-038 | HTML-022 | Document scope | partially_corroborated | MN103S firmware uses interrupt dispatch and command-dispatch structures that must be recovered before safe hooking. |
| HCLM-B04-039 | HTML-022 | 1. The Interrupt Vector Table | rejected | Fixed offsets 0x00, 0x08, 0x10, and 0x18 are respectively reset, timer, SCSI-bus, and tray/external IRQ vectors for GCC-4241N. |
| HCLM-B04-040 | HTML-022 | Theory: Suppressing Interrupts | validated | PSW interrupt-control fields can mask maskable level interrupts during a critical region. |
| HCLM-B04-041 | HTML-022 | Theory: Suppressing Interrupts | historical_untrusted | Servo interrupts must be suppressed during SHA-1 to prevent digest corruption from timing jitter. |
| HCLM-B04-042 | HTML-022 | 2. Command Dispatcher Jump Tables | partially_corroborated | Incoming command opcodes are routed through dispatch logic or tables. |
| HCLM-B04-043 | HTML-022 | Group 0 Jump Table | historical_untrusted | The Group-0 table begins at 0x721E6 and START/STOP UNIT entry 0x1B targets 0x7222E. |
| HCLM-B04-044 | HTML-022 | Group 7 Jump Table | historical_untrusted | The Group-7 vendor table begins at 0x72266 and opcode 0xE7 targets 0x72282. |
| HCLM-B04-045 | HTML-022 | Group 7 Jump Table | superseded | Opcodes 0xEE and 0xEF should be assigned as new Peek and Poke commands. |
| HCLM-B04-046 | HTML-022 | 3. Mode Page Table | validated | Mode page 0x3E is used in the validated Xbox authentication interface. |
| HCLM-B04-047 | HTML-022 | 3. Mode Page Table | historical_untrusted | A101 MODE SENSE dispatcher is at 0x27198 and page-0x3E entry is at 0x271E0. |
| HCLM-B04-048 | HTML-022 | 4. CDB Length Table | validated | SCSI/ATAPI command families commonly use 6-byte, 10-byte, and 12-byte CDB formats. |
| HCLM-B04-049 | HTML-022 | 4. CDB Length Table | historical_untrusted | A101 has the listed uniform CDB-length tables at 0x72000, 0x72020, and 0x72040. |
| HCLM-B04-050 | HTML-023 | 1. The DMA Hardware Profile | validated | The GCC-4241N MN103S63G-class controller contains DMA and ATAPI DMA-interface hardware. |
| HCLM-B04-051 | HTML-023 | Theory: Direct Memory Access | validated | DMA can move data between controller resources without instruction-by-instruction CPU copying. |
| HCLM-B04-052 | HTML-023 | 2. DMA Register Map | rejected | GCC-4241N DMA source, destination, count, and control registers are at 0x9000C000, 0x9000C004, 0x9000C008, and 0x9000C00C. |
| HCLM-B04-053 | HTML-023 | 3. Security Sector Streaming | rejected | READ DVD STRUCTURE 0xAD/0xC0 must DMA exactly 2,048 bytes from 0x10C80040 to the host. |
| HCLM-B04-054 | HTML-023 | 3. DMA Implementation | historical_untrusted | The pseudo-code identifies the correct source, destination, count, and priority settings for a GCC-4241N security response. |
| HCLM-B04-055 | HTML-023 | 4. DMA & Flash Finalization | validated | The current host flasher transmits 512 KiB as 256 blocks of 2,048 bytes. |
| HCLM-B04-056 | HTML-023 | 4. DMA & Flash Finalization | open_question | The drive bootloader necessarily uses the documented DMA register set to move each incoming flash block. |
| HCLM-B04-057 | HTML-023 | Critical Alignment Requirement | historical_untrusted | Because 0x4000807A is not 4-byte aligned, any DMA transfer from the alleged cave must use byte mode or trigger an address exception. |
| HCLM-B04-058 | HTML-024 | 1. SBC Hardware Architecture | validated | GCC-4241N contains an integrated ATAPI host interface and host-DMA signaling. |
| HCLM-B04-059 | HTML-024 | 1. SBC Hardware Architecture | historical_untrusted | The controller exposes a conventional parallel-SCSI Command/Data/Status/Message phase machine exactly as described. |
| HCLM-B04-060 | HTML-024 | Theory: The CDB Cache | rejected | Interrupt offset 0x10 means an SBC IRQ has deposited a 12-byte CDB at 0x40000840. |
| HCLM-B04-061 | HTML-024 | 2. SCSI Controller Register Map | rejected | SBC_DATA, SBC_STAT, SBC_CTRL, and SBC_CDB_LEN are at 0x9000D000 through 0x9000D00C. |
| HCLM-B04-062 | HTML-024 | 3. Manual Status Delivery | rejected | Writing the listed values to 0x9000D008 and 0x9000D000 safely forces STATUS GOOD and COMMAND COMPLETE after native logic halts. |
| HCLM-B04-063 | HTML-024 | 4. Bus Controller Interaction with SRAM | historical_untrusted | GCC command, status, and sense state reside at 0x40000840, 0x40000A08, and 0x40000A10. |
| HCLM-B04-064 | HTML-024 | Diagnostic Warning: Bus Timeout | validated | A host pass-through request can time out when firmware stops responding or fails to complete the command protocol. |
| HCLM-B04-065 | HTML-024 | Diagnostic Warning: Bus Timeout | historical_untrusted | Every such timeout necessarily requires a hardware power cycle. |
| HCLM-B04-066 | HTML-026 | 1. The 512KB Accumulation Wall | validated | The current GCC flasher streams exactly 524,288 firmware bytes in 256 transfers of 2,048 bytes. |
| HCLM-B04-067 | HTML-026 | 1. The 512KB Accumulation Wall | partially_corroborated | The 512 KiB firmware accumulation region begins at 0x10C80000 and ends at 0x10D00000. |
| HCLM-B04-068 | HTML-026 | Critical Risk: Buffer Overrun | rejected | Any write beyond 0x10D00000 immediately overwrites the stack pointer or peripheral I/O and silently bricks the drive. |
| HCLM-B04-069 | HTML-026 | 2. Memory Mirroring & DMA Safety | rejected | All large data must use 0x10xxxxxx and DMA from any 0x90xxxxxx mirror necessarily triggers a bus error. |
| HCLM-B04-070 | HTML-026 | 3. SRAM Cave Isolation | historical_untrusted | The 0x4000807A payload cave remains executable and intact while firmware is streamed into external SDRAM. |
| HCLM-B04-071 | HTML-026 | The Flasher Stub Collision | validated | The current host flasher requires a 4,080-byte programming stub delivered as two 2,048-byte frames containing 2,040 payload bytes each. |
| HCLM-B04-072 | HTML-026 | The Flasher Stub Collision | historical_untrusted | A payload larger than 3,634 bytes necessarily collides with the 4,080-byte stub and crashes during ignition. |
| HCLM-B04-073 | HTML-027 | 1. The SCSI Bus Reset | partially_corroborated | A host or bus reset aborts or clears active command state and causes device reinitialization behavior. |
| HCLM-B04-074 | HTML-027 | 1. The SCSI Bus Reset | historical_untrusted | The original Xbox asserts this reset during every cold boot and soft reboot. |
| HCLM-B04-075 | HTML-027 | 1. The SCSI Bus Reset | rejected | GCC-4241N bus-reset interrupt vector is fixed at offset 0x10. |
| HCLM-B04-076 | HTML-027 | The Persistence Problem | historical_untrusted | Bus reset clears authorization state at 0x2CC and therefore requires a custom persistence hook. |
| HCLM-B04-077 | HTML-027 | 2. Hardware Exception Vectors | rejected | NMI, address error, and illegal-instruction vectors are fixed at offsets 0x02, 0x04, and 0x06. |
| HCLM-B04-078 | HTML-027 | 2. Hardware Exception Vectors | validated | MN103S processors provide reset, non-maskable interrupt, maskable interrupt, and return-from-interrupt mechanisms. |
| HCLM-B04-079 | HTML-027 | 3. Diagnostic Black Box | open_question | After a crash, GCC-4241N records exception cause at 0x40000AF0 and fault PC at 0x40000AF4. |
| HCLM-B04-080 | HTML-027 | 4. Implementing the RST Persistence Hook | rejected | Saving and restoring 0x2CC around native reset cleanup is a safe method to preserve Xbox authorization across resets. |
| HCLM-B04-081 | HTML-028 | 1. The MN103S Split-Cache Architecture | partially_corroborated | Some MN103S products support caching, but a split I-cache/D-cache implementation in GCC-4241N is not established by the supplied model documentation. |
| HCLM-B04-082 | HTML-028 | 1. The MN103S Split-Cache Architecture | rejected | Every pp_win Poke writes only into D-cache rather than physical RAM. |
| HCLM-B04-083 | HTML-028 | 2. Cache Control Registers | rejected | CHCTR, DCACHE_FLG, and ICACHE_INV reside at 0x90000000, 0x90000004, and 0x90000008. |
| HCLM-B04-084 | HTML-028 | 3. Poke-to-Execute Workflow | partially_corroborated | Self-modifying or newly uploaded executable code may require instruction/data coherency handling before execution on a cached implementation. |
| HCLM-B04-085 | HTML-028 | 4. Coherency Synchronization | rejected | Writing 0x0000000C to 0x90000000 followed by three NOPs performs a complete GCC-4241N D-cache flush and I-cache invalidation. |
| HCLM-B04-086 | HTML-028 | 4. Coherency Synchronization | historical_untrusted | MODE SELECT 0x55 is an established generic trigger for the proposed cache-synchronization routine at 0x40008A00. |
| HCLM-B04-087 | HTML-029 | Document scope | partially_corroborated | A PATA-to-SATA or USB bridge used with GCC-4241N must preserve the ATAPI packet commands and transfer phases required by vendor tools. |
| HCLM-B04-088 | HTML-029 | 1. The SAT Layer | historical_untrusted | The operating system necessarily wraps GCC-4241N SCSI CDBs in SAT ATA Register FIS structures for every SATA bridge. |
| HCLM-B04-089 | HTML-029 | 2. Bridge Compatibility | partially_corroborated | Some bridges or drivers may reject, truncate, or mishandle vendor-specific ATAPI packet commands. |
| HCLM-B04-090 | HTML-029 | 2. Bridge Compatibility | historical_untrusted | Unsupported vendor commands specifically return hardware error 0x04, and failed HL ignition specifically hangs Windows. |
| HCLM-B04-091 | HTML-029 | 3. Translation Latency & Jitter | open_question | Bridge translation latency can corrupt or destabilize the GCC firmware-streaming protocol. |
| HCLM-B04-092 | HTML-029 | 4. Diagnostics | rejected | A successful peek and poke at 0x400012E8 is sufficient to prove complete bridge transparency for flashing and ignition. |
| HCLM-B04-093 | HTML-029 | 5. Recommended Adapters | open_question | Marvell 88SA8052 and JMicron JM20330 are validated recommended bridge controllers for Project Frankenstein vendor-command workflows. |
| HCLM-B04-094 | HTML-029 | 5. Recommended Adapters | rejected | JMicron JM20330 hardware requires host software to use #pragma pack(8) to prevent SAT corruption. |
