Project Frankenstein: Volume XIII

SCSI Error Dispatcher & Sense Data Mapping

This volume details the internal error-handling mechanisms of the Hitachi-LG GCC-4241N. Specifically, it identifies the routines responsible for generating Sense Data (SK/ASC/ASCQ). Mapping these is vital for diagnostic debugging and for implementing "Silent Success" overrides during the Xbox authentication handshake [cite: User Summary, gcc_hitachi_flasher.c, pp_win.c].

1. The Native Error Routine (ROM 0x00003B20)

In the 4241N firmware, most failed command branches converge at a central error dispatcher. This routine is responsible for setting the SCSI Status to 0x02 (Check Condition) and populating the Sense Buffer [cite: 4241N_Mechanical_Analysis.txt, gcc_hitachi_flasher.c].

Property	VMA Address / Offset	Description
Error Dispatcher Entry	`0x00003B20`	Central routine for generating command failures.
Sense Buffer (SRAM)	`0x40000A10`	Location where the 18-byte Sense Data packet is constructed.
Status Register	`0x40000A08`	Holds the current SCSI Status (e.g., 0x02).

Theory of Sense Data Generation

When a command handler (like Mode Sense $5A) encounters an invalid field, it calls the error dispatcher with specific arguments in the data registers [cite: Volume IX: Mode Select (0x55) Structural Analysis]:

d0: Sense Key (SK) - e.g., 0x05 for Illegal Request.
d1: ASC/ASCQ - e.g., 0x2400 for Invalid Field in CDB.

2. Common Error Codes in Project Frankenstein

Understanding these codes allows the pp_win tool to diagnose handshake failures [cite: gcc_hitachi_flasher.c, pp_win.c].

SK / ASC / ASCQ	Common Label	Interpretation in Hybrid Context
`05 / 21 / 00`	LBA Out of Range	LBA walls at `0x3034E` or `0x2C2CC` are active [cite: 129_perfect_trampoline_v18.py].
`05 / 24 / 00`	Invalid Field in CDB	Incorrect sub-command or signature (HIT/HL) used [cite: pp_win.c].
`02 / 04 / 01`	Logical Unit Not Ready	The drive controller has halted or is performing a physical burn [cite: gcc_hitachi_flasher.c].

3. The "Silent Success" Override (RAM Cave)

A sophisticated hybrid firmware can intercept the call to 0x00003B20 to hide failures from the Xbox console. This is implemented by hooking the error routine and forcing a "Good" status [cite: 129_perfect_trampoline_v18.py, pp_win.c].

; MN103S Assembly: Silent Success Override
; Target: SRAM Cave 0x40008700
Error_Override_Hook:
    mov     0x40000A10, a0  ; Point to Sense Buffer
    clr     d0              ; d0 = 0 (No Error)
    movbu   d0, (a0)        ; Clear Sense Key
    movbu   d0, (12,a0)     ; Clear ASC
    movbu   d0, (13,a0)     ; Clear ASCQ
    
    mov     0x40000A08, a0  ; Point to SCSI Status
    mov     0x00, d0        ; 0x00 = Status GOOD
    movbu   d0, (a0)
    
    ret                     ; Resume command processing

4. Diagnostic Utility with `pp_win.c`

By using Peek (OpCode 0xE7 'HIT'), the developer can inspect the SRAM at 0x40000A10 immediately after a command failure to see exactly why the drive rejected the host request [cite: pp_win.c].