
# ---- archived on 2026-05-27 13:00 ----

[addresses]
0x002D11F4 SIM_FATAL_STAGER  # scenario maps to reason byte [12:59]
0x002D724C BROKER_FAULT_NOTIFIER  # sends task 17 msg 0x44 [12:59]
0x002EF9E4 BUSY_DELAY  # spin-wait used by reboot_fn [13:00]

# ---- archived on 2026-05-27 13:01 ----

[addresses]
0x002F0BC8 FATAL_RESUME_THUMB  # transition point in fatal handler [13:01]

# ---- archived on 2026-05-27 13:46 ----

[addresses]
0x002E9A32 IRQ2_CCONT_TOPHALF  # IRQ2 top-half — ack MAD latch + enqueue(task1, msg=0x51); runs every CCONT cascade incl RTC-MIN [13:45]
0x002E8DD0 CCONT_BOTTOM_HALF_PUBLISHER  # task-1 bottom-half — read CCONT 0x0E pending, ACK, publish per-int 0x7901-0x7906 via 0x2EACDC [13:45]
0x002C8A60 CLOCK_TICK_PUBLISHER  # clock-tick handler — fires every RTC-MIN; loads r0=0x46BC, bl 0x2E87C8 (publish time-changed) [13:45]
0x002C8A6C GET_DATETIME  # display getter — calls GET_TIMESTAMP 0x2CB588, formats; 0 hits at idle unless minute-change consumer runs [13:45]
0x002CB622 CONSUME_ROUTING_BYTE  # gate on [0x11149A] bit 5 (=0x20 set at boot); pass-through path to CLOCK_TICK_PUBLISHER [13:45]
0x002E87C8 EVENT_PUBLISH_HELPER  # build 16B event block, store event_id (r0<<16), dispatch via 0x2E8808 [13:45]
0x002EACAA BROKER_ROUTER  # publish-side router: 0x2EACAA(0, event_id, 0) — calls BROKER_GATE then BROKER_DELIVER [13:45]
0x002EACDC BROKER_PUBLISH  # thunk to BROKER_ROUTER — wraps publish call with (0, event_id, 0); analog of 3330 publish_wrapper@0x53ed4c [13:45]
0x002EAD12 BROKER_REGISTER  # subscribe register: [0x11FF28]=enable + memcpy 32B bitmap -> [0x11FF4C]; 4 callers in 0x243xxx all dormant [13:45]
0x002EA8A8 DEFERRED_TASK_DECODER  # per-int decoder: msg-0x5DC=INT0 0x5DE=INT2 0x5E1=INT5 0x5E2=INT6 — gates clock advance [13:45]
0x002EA914 CLOCK_ADVANCE_HANDLER  # INT5/0x5E1 handler — gated on dialog [0x10E5F4] in {43,112,119}; posts msg 0x49C4 redraw [13:45]
0x00278670 READINESS_AGGREGATOR  # 9-flag readiness aggregator at [0x11156C..+8]; 9th set triggers post-ready 0x2E72B8 [13:45]
0x002E72B8 POST_READY_COMPLETION  # post-ready — sends msg 21 to task 1 (only); fan-out to tasks 5/6/17/19 happens downstream [13:45]
0x00278E50 SUBSCRIBE_ENGINE  # subscribe engine — final hop into BROKER_REGISTER (0x2EAD12); 0 hits in dormant boot [13:45]
0x00264E14 OPCODE_DISPATCHER  # 70-caller opcode dispatcher; jump-table 0xFB4..0xFCB → 10 subsystem-init fns → SUBSCRIBE_ENGINE [13:45]
0x00265588 STATE_FANOUT  # task-14 sub-state dispatcher (per [0x10B1FC+i]); 18-state jump table [13:45]
0x00267024 TASK_RECV_LOOP  # generic recv loop used by task 14 (and similar) — blocks when mailbox empty [13:45]
0x00267700 TASK_14_ENTRY  # task 14 entry — readiness flag [0x111570]=1, 8x fan-out STATE_FANOUT(0..7) all bail at state=0, blocks on recv [13:46]
0x002F0BCC RAND_LCG  # ANSI-C LCG seed*0x41C64E6D+0x3039 ; seed = [0x111864]; return (seed<<1)>>17 [13:46]
0x002F0BE0 SRAND_LCG  # stores r0 -> [0x111864]; called once at boot from 0x297AE2 via time-fn 0x2CB588 [13:46]
0x002CB588 GET_TIMESTAMP  # time-fn — checks clock-valid [0x111497]==0x2A; if valid → time-of-day; else → const 0x7FFFFFFF (drives deterministic RNG) [13:46]
0x002E9B80 HW_RTC_READ  # reads CCONT day/hr/min/sec via remap table 0x32E878 (logical 0x09-0x0C -> phys 0x07-0x0A) → elapsed seconds [13:46]
0x0011FF28 broker_enable_flag  # 0=broker disabled (events dropped at gate); set by BROKER_REGISTER 0x2EAD12 (0 callers dormant boot) [13:46]
0x0011FF4C broker_subscription_bitmap  # 32-byte bitmap of subscribed event ids; written by BROKER_REGISTER; all-zero in dormant boot [13:46]
0x0011FD08 dispatch_index_byte  # task 5 UI_TASK dispatcher index (read by 0x2E4492 → table 0x321EA0 8B stride); slot 23/0x17 = CLOCK_ADVANCE_HANDLER [13:46]
0x0011149A routing_byte_gate  # CONSUME_ROUTING_BYTE gate; bit 0x20 set at boot (passes RTC-tick to CLOCK_TICK_PUBLISHER) [13:46]
0x00111497 clock_valid_flag  # 0x2A = clock SW-base is valid (gate for srand(time)) [13:46]
0x00111494 sw_clock_base  # 16B software clock struct base; +16 = SW time-of-day base seconds [13:46]
0x0010E5F4 active_dialog_id  # CLOCK_ADVANCE_HANDLER gate: standby-clock-redraw fires only when dialog id in {43,112,119} [13:46]
0x0011156C readiness_flag_table  # 9-byte readiness-flag table (READINESS_AGGREGATOR writes one per ready msg); all 1s = post-ready fires [13:46]
0x00111864 rand_seed  # ANSI-C LCG seed (RAND_LCG); seeded once from GET_TIMESTAMP (=0x7FFFFFFF in emu since clock-valid never sets) [13:46]

# ---- archived on 2026-05-27 14:17 ----

[addresses]
0x002E4492 FEATURE_DISPATCHER  # feature dispatch fn — reads [0x11FD08] as index, table-lookup at DISPATCHERS_TABLE 0x321EA0 (8B stride), bx r1 to slot[idx]; slot 23/0x17 = DEFERRED_TASK_DECODER. NokiX-labeled UI_MENU which is misleading. [14:17]
0x002E4710 TASK_HANDLER_BX_R1  # alt dispatcher entry — bx r1 to handler(r0=msg), returns to 0x2E4714; per memory tag, also calls DEFERRED_TASK_DECODER on certain msgs [14:17]

# ---- archived on 2026-05-27 15:18 ----

[addresses]
0x002BBF00 PPM_STRING_LOOKUP  # PPM string lookup (lang, id) — handles id<51 special, else id-51 in body table [15:18]

# ---- archived on 2026-05-27 16:37 ----

[addresses]
0xDEADBEEF DSP_WATCHDOG_TIMER  # fires every 5s if DSP no heartbeat [16:37]

# ---- archived on 2026-05-27 19:49 ----

[addresses]
0x002EF3C8 GENSIO_READ_HELPER  # GENSIO txn helper — start txn @0x2002D, poll status @0x2006D bit1, read data; called for ADC/CCONT-data reads; our 0x2D data path returns stale (only 0x6D status modeled as always-ready) [19:48]
0x002E4278 BOOT_FINALIZE_GATE  # boot finalize gate — waits ([0x20006]-[0x20004])>=30 sleep ticks (~0.9ms at 33055Hz, NOT 30ms as earlier comment said); posts init-complete on success → launches logo [19:48]

# ---- archived on 2026-05-29 07:56 ----

[addresses]
0x002C1996 SOFT_WDT_SUPERVISOR  # TASK_0_IDLE soft-WDT handler — clears [0x11FEAC+0x6E] supervisor counter (the one the SWDSP/DSP-reset chain overflows) + on failure-flag fan-out issues REASON_SETTER(4=FACTORY_RESET)+RESET_POSTER. NokiX-labeled RESET_WATCHDOGS which is misleading; the chip-level kicker is DEV_RESET_WATCHDOGS @ 0x2EEB94 (= CCONT_RESET_WDT) [23:03]
0x002C1774 SIM_STATE_DRIVER  # called as tail of every wrapper in SIM_EVENT_PUBLISH_BLOCK (0x2D77F0+); r0=SIM_INFO_* enum index (1-12), r1=payload from 0x29D840. Probable SIM state-machine transition fn (3330 SIM_INFO_PIN2_VERIFY_OK/REQUIRED/BLOCKED/NO_PIN2/etc map here) [23:51]
0x002E87C8 EVENT_PUBLISH_HELPER  # publish event-bus msg (r0=event_id, r1=payload) — used by SIM_EVENT_PUBLISH_BLOCK and elsewhere [23:51]
0x002D78D4 SIM_SCM_INIT_RESULT_PUBLISH  # SIM_STATE_DRIVER(enum=8, payload=status_byte) — wrapper. payload==1 → SIM_INFO_INIT_OK; else → SIM_SCM_INIT_NOT_AVAIL. log=0x5036 event=0x53FD. 3330 case 8 (0x511bb0)
0x002D7910 SIM_SCM_INIT_OK_PUBLISH  # SIM_STATE_DRIVER(enum=9) — wrapper. SIM_SCM_INIT_OK signal. log=0x5037 event=0x53FE. 3330 case 9
0x002D75C4 SIM_FDN_INIT_OK_PUBLISH  # SIM_STATE_DRIVER(enum=10) — wrapper. SIM_FDN_INIT_OK signal. log=0x5039 event=0x5400. 3330 case 10
0x002D780C SIM_INFO_PIN2_STATE_PUBLISH  # SIM_STATE_DRIVER(enum=11, payload=0..4) — wrapper. payload-indexed PIN2 state cycle: 0=VERIFY_REQUIRED 1=VERIFY_OK 2=BLOCKED 3=PERM_BLOCKED 4=NO_PIN2. log=0x503A event=0x5401. 3330 case 0xb
0x002D77CE SIM_UI_STATE_PUBLISH  # SIM_STATE_DRIVER(enum=12, payload=ui_state_id) — wrapper. payload IS the UI state byte (e.g. 0x7C=INIT_OK 0x72=PIN_REQUIRED 0=REJECTED 100=PIN_VERIFY_OK 0x65=WRONG_OLD_PIN etc.) per 3330 case 0xc. The LAYER-4 UI dispatcher — this is the one not getting msg 0x12E in the SIM-rejected bug. log=0x503B event=0x5402
0x002D7964 SIM_UI_SUBSTATUS_PUBLISH  # SIM_STATE_DRIVER(enum=13, payload=14 hardcoded) + sub-cycle (1..13). 3330 case 0xd 13-state cycle. log_block 0x5001+. Twin wrapper at 0x002D754A invoked from BROKER region
0x002D7752 SIM_INFO_STATUS_PUBLISH  # SIM_STATE_DRIVER(enum=16, payload=status) — wrapper. payload=1=INIT_OK, 14=NOT_PRESENT, 15=PIN_VERIFY_REQUIRED. Runtime-confirmed via SIMPINON/SIMABSENT WATCH at 0x2C1774. log=0x502E event=0x53B5. 3330 case 8 status-branch
0x002D75F2 PERIPH_USE_MODE_PUBLISH  # SIM_STATE_DRIVER(enum=2) — wrapper. 3330 case 2 = use mode (PORTABLE / CAR_HFU1 / CAR_HFU2 / HEADSET cycle). log=0x5029 event=0x53B0
0x002D76A2 PERIPH_IGN_PUBLISH  # SIM_STATE_DRIVER(enum=3) — wrapper. 3330 case 3 = IGN_ON / IGN_OFF. log=0x5031 event=0x53F8
0x002D761E PERIPH_HOOK_PUBLISH  # SIM_STATE_DRIVER(enum=4) — wrapper. 3330 case 4 = HOOK_ON / HOOK_OFF. log=0x502C event=0x53B3
0x002D764A PERIPH_HEADSET_PUBLISH  # SIM_STATE_DRIVER(enum=5) — wrapper. 3330 case 5 = HEADSET_CONNECTED / HEADSET_REMOVED. log=0x502B event=0x53B2
0x002D7676 PERIPH_CHARGER_PUBLISH  # SIM_STATE_DRIVER(enum=6) — wrapper. 3330 case 0/1 = CHARGER_CONNECTED / CHARGER_REMOVED (case 6 here). log=0x502A event=0x53B1
0x002D76EA PERIPH_ENUM7_PUBLISH  # SIM_STATE_DRIVER(enum=7) — wrapper. 3330 case 7 (semantics TBD; near peripheral block). log=0x5032 event=0x53F9
0x002D784C SIM_ENUM15_PUBLISH  # SIM_STATE_DRIVER(enum=15) — wrapper. 3330 case TBD (likely case 0xf, not in user-pasted excerpt). log=0x502F event=0x53B7
0x002DA974 PN_TASK  # Phonet protocol task — NokiX MBUS.rx anchor; mid-fn at first BL to BROKER_PUBLISH [02:07]
0x002E5838 PN_MBUS_SEND_FRAME  # firmware native MBus frame TX; reached via BL chain from PN_TASK per NokiX MBUS.rx; signature: NokiX-MBUS.rx-walk [02:07]
0x002E9DEA XBUS_SEND_FRAME  # firmware native XBus frame TX; companion to PN_MBUS_SEND_FRAME [02:07]
0x002E4116 DISABLE_IRQ  # IRQ mask off; used by MBUS.rx hook installer [02:07]
0x002E4130 ENABLE_IRQ  # IRQ mask on; used by MBUS.rx hook installer [02:07]
0x002E33EC BATTERY_CHARGE_ANIM  # NokiX battery_charge sig; charging-anim frame counter [0x111701] cycles 0..4 (moving bars) [20:13]
0x0032D6D8 NET_TRIGCONV_TABLE  # NokiX trigconv sig 0064004B0032...; network-strength conversion table (8 words) [20:13]
0x0032D6B8 BATTERY_BAR_CONV_TABLE  # battery mV->bar thresholds; 14 words in mV (0xC1C=3100..0xF06=3846); 4 temp-variant tables stepping -0x20 [20:13]
0x002E553C MEM_ALLOC  # best-fit aligned heap allocator (r0=align r1=size); free-list head [0x11182C]; epilogue 0x2E560E pops {r4-r7,pc} [23:26]
0x002E52B0 HEAP_FREELIST_INSERT  # sorted free-list insert; nodes {key@0,next@4}; head [0x11182C] [23:26]
0x002E52F6 HEAP_FREELIST_REMOVE  # free-list remove (counterpart to insert) [23:26]
0x002E4248 SOFTTIMER_DECREMENT  # soft-timer countdown decrement; elapsed=Timer0[0x20010]-snapshot[0x1115F8] [23:26]
0x002E4278 IDLE_SOFTTIMER_GATE  # TASK_0_IDLE periodic soft-timer gate (was mislabeled BOOT_FINALIZE_GATE); reads list head [0x104864] [23:26]
0x00298B20 SOFTTIMER_WALK  # soft-timer list walker (FIQ4 handler 0x2E4426 + idle gate); ages/expires timers [23:26]
0x00298ACC SOFTTIMER_FIRE_FREE  # expired soft-timer fire+free (unlink + heap free) [23:26]
0x002E4426 FIQ4_TIMER0_HANDLER  # FIQ4 scheduler-tick handler; calls 0x298B20; acks [0x20008]=0x10 [23:26]
0x002E4112 TIMER0_REARM  # Timer0 re-arm: t0_dest[0x20012]=current+interval(~0x19); drives the real FIQ4 tick [23:26]
0x00104864 SOFTTIMER_LIST_HEAD  # soft-timer list head ptr (ctrl struct base 0x104844); 0xFFFFFFFF=empty [23:26]
0x0011182C HEAP_FREELIST_HEAD  # heap free-list head (sorted blocks {key@0,next@4}) [23:26]
0x002275B4 NETMON_SET_MODE  # set_netmonitor_mode NokiX-confirmed: modes 0xF0reset/0xF1off/0xF2field/0xF3dev, test# below 0xF0 selects a display [00:14]
0x00227690 NETMON_RESET_CLASSIFIER  # reads reason [0x11FDA0], scans table 0x311C34, routes 0x68+0x73 to SWDSP bucket, bumps D36 counters [0x11FDB8+] [00:15]
0x00223C10 NETMON_SETTINGS_RW  # eeprom-backed netmon settings/counters helper, fields 0x601-0x606, bridges reboot_reason [0x11FF94] to [0x11FDA0] [00:15]
0x00311C34 NETMON_RESET_REASON_TABLE  # 6x8B [code][b1][name5]: 6B=SWWD 01=UNKNO 68=SWDSP 69=SWSIM 6C=SWIDL 06=STACK [00:15]
0x0011FDA0 NETMON_RESET_REASON  # raw reboot-reason copy classified for D35/D36 [00:15]
0x002D8AB0 BYTESUM_DATETIME  # bounded byte-checksum loop after ADD_DATETIME [00:17]
0x0011FDB8 NETMON_COUNTER_BLOCK  # base of netmon 16-bit counters: D36 resets, D40 handover, D65 SMS [00:18]
0x0010B6D4 NETMON_CELL_RECORDS  # PDF D1-D5 cell data: 52-byte records, idx0=serving cell idx1-6=neighbours, ARFCN RxLev C1 C2 BSIC at record offsets, base+idx*52 used in 0x26A876 [00:35]
0x0010B56E NETMON_SERVING_CELL_IDX  # PDF D1 serving-cell index into NETMON_CELL_RECORDS, compared in formatter 0x26A8A0 [00:35]
0x0010B56C NETMON_CELL_LIST_CTRL  # PDF D1/D3 cell-list control, offsets +0x10 +0x11 +0x12 used by cell-list mgr 0x26A914 [00:35]
0x0010B6DD NETMON_CELL_CHANTYPE  # PDF D1 oooo channel-type code array, indexes NETMON_CHANTYPE_TOKENS, read 0x26ADBC [00:35]
0x0032E6F8 NETMON_CHANTYPE_TOKENS  # PDF D1 oooo channel-type token-ptr table, 8 entries each a PPM string-index list, used 0x26ADDE [00:35]
0x0026A834 NETMON_CELL_LIST_RENDER  # PDF D1/D3 renderer iterates NETMON_CELL_RECORDS serving plus neighbours 1-4 [00:35]
0x0026A876 NETMON_CELL_RECORD_FMT  # PDF D1/D2/D3 per-cell processor, record = NETMON_CELL_RECORDS + idx*52 [00:35]
0x003114E0 NETMON_DISPLAY_TABLE  # master display table 71 entries 12B = layout+label+num, displays D2-D133, lookup base 0x3114DC used by 0x227612 [00:50]
0x00311A18 NETMON_FIELD_TABLE  # field-def table 8B entries word0=RAMaddr-or-getterfn byte5=type1u8/3getter/4s16/8u16/9pct byte6=unit-char, ~32 entries battery+charging group [00:50]
0x002240B4 NETMON_FIELD_RESOLVE  # field-id to value: index NETMON_FIELD_TABLE id*8, type-dispatch read u8/s8/s16 or call getter, output to 0x10E3B0 [00:50]
0x002254E8 NETMON_DISPLAY_RENDER  # per-display renderer: reads idx NETMON_DISPLAY_INDEX, looks up NETMON_DISPLAY_TABLE, walks layout tokens, formats via NETMON_FIELD_RESOLVE [00:50]
0x0011FD7D NETMON_DISPLAY_INDEX  # current netmon display index 0-70 into NETMON_DISPLAY_TABLE, read by renderer 0x22551E [00:50]
0x0010E3B0 NETMON_TEXT_BUF  # netmon per-field display text buffer formatted by NETMON_FIELD_RESOLVE [00:50]
0x0011FD90 NETMON_BATT_MF_DERIVCOUNT  # PDF D22 Eaaa DerivCount membership 0.00-1.00, field id 0x0E unit E [00:50]
0x0011FD80 NETMON_BATT_MF_CHARGEAMOUNT  # PDF D22 Cbbb ChargeAmount membership, field id 0x0F unit C [00:50]
0x0011FD82 NETMON_BATT_MF_VOLDIFFTOMAX  # PDF D22 Dccc VolDiffToMax membership, field id 0x10 unit D [00:50]
0x0011FD84 NETMON_BATT_MF_VOLDROPCNT  # PDF D22 Rddd VolDropCnt membership, field id 0x11 unit R [00:50]
0x0011FD8A NETMON_BATT_MF_VOLDIFFTIME  # PDF D22 Ieee VolDiffTime membership, field id 0x12 unit I [00:50]
0x0011FD8C NETMON_BATT_MF_AVERDIFF  # PDF D22 Afff AverDiff membership, field id 0x13 unit A [00:50]
0x0011FD86 NETMON_BATT_MF_TEMP  # PDF D22 Tggg Temperature membership, field id 0x14 unit T [00:50]
0x0011FD88 NETMON_BATT_MF_VOLT  # PDF D22 Vhhh Voltage membership, field id 0x15 unit V [00:50]
0x00310A2C NETMON_D39_RESETCNT_LAYOUT  # PDF D39 reset-reason counters UN WD DSP SIM IDLE STACK, label 0x2283C4 - has DSP column [00:50]
0x00310D3C NETMON_D70_DSPTEMP_LAYOUT  # PDF D70 DSP temporary counters TR1 TR2 TRA TC, label 0x2286E0, field ids 0x11D-0x122 [00:50]
0x00310D74 NETMON_D71_DSPTEMP2_LAYOUT  # NetMon D71 Temporary DSP counters, label 0x228710 [00:50]
0x00310E54 NETMON_D75_SIGLEVEL_LAYOUT  # NetMon D75 DSigL USigL downlink/uplink DSP signal level, label 0x228798 [00:50]
0x00310E88 NETMON_D76_EXTAUD_LAYOUT  # NetMon D76 ExtAudStatus external audio/DSP status, label 0x2287C0 [00:50]
0x00310F1C NETMON_D79_ECHO_LAYOUT  # NetMon D79 EAA Ada ERL echo-canceller DSP, label 0x228828 [00:50]
0x003113E4 NETMON_D131_DSPRESETCNT_LAYOUT  # NetMon D131 DSP resetcnt dedicated DSP reset counter, label 0x228B70 [00:50]
0x0011FD9E NETMON_FIELD_03  # netmon field id 0x03 type 1 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FE90 NETMON_FIELD_05  # netmon field id 0x05 type 1 unit W battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD9C NETMON_FIELD_07  # netmon field id 0x07 type 1 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD92 NETMON_FIELD_08  # netmon field id 0x08 type 9 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD94 NETMON_FIELD_09  # netmon field id 0x09 type 9 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD98 NETMON_FIELD_0A  # netmon field id 0x0A type 9 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD96 NETMON_FIELD_0B  # netmon field id 0x0B type 9 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD9A NETMON_FIELD_0C  # netmon field id 0x0C type 9 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x0011FD8E NETMON_FIELD_0D  # netmon field id 0x0D type 9 unit  battery/charging group, read via NETMON_FIELD_RESOLVE [00:50]
0x00299AF8 BLOCKING_MALLOC  # blocking allocator calls heap core retries on NULL via memory semaphore 1564 callers [00:56]
0x002E533E HEAP_ALLOC_CORE  # underlying heap allocator returns NULL when no free block [00:56]
0x00299B26 MALLOC_FAIL_RETRY  # alloc-fail block-retry PC parks on memory semaphore then retries malloc_fail sig hook [00:56]
0x00104844 HEAP_ACCT_STRUCT  # heap accounting struct used-bytes at +8 FREE decrements [00:56]
0x0010E72E NETMON_D30_API_AUD1_CTRL  # PDF D30 A1Cnf = API_AUD1_CTRL audio-path control, field id 0x16, MCU-DSP audio reg shadow [01:09]
0x0010E73C NETMON_D30_API_AUD2_CTRL  # PDF D30 A2Cnf = API_AUD2_CTRL, field id 0x17 [01:09]
0x0011FE70 NETMON_D30_API_SIDETONE  # PDF D30 ST = API_SIDETONE, field id 0x18 [01:09]
0x0010E728 NETMON_D30_API_AU3  # PDF D30 AU3 = API_AU3, field id 0x19 [01:09]
0x0010E760 NETMON_D30_API_1TONE  # PDF D30 1Tone = API_1_TONE DTMF gen freq1, field id 0x1A [01:09]
0x0010E718 NETMON_D30_API_2TONE  # PDF D30 2Tone = API_2_TONE DTMF gen freq2, field id 0x1B [01:09]
0x0010E761 NETMON_D30_API_CONFIG  # PDF D30 Conf = API_CONFIG, field id 0x1D [01:09]
0x0010E74E NETMON_D30_API_HFVOL  # PDF D30 HFVol = API_HF_VOL audio output volume, field id 0x1F [01:09]
0x002BAC58 MDIRCV_QUEUE_DEPTH  # RE-01 corroborated (disfw 0x2BAC58 + WATCH/MDILOG). Returns DSP->MCU MDIRCV queue depth = head[0x101CA] - tail[0x101C8] (mod 100); first call of BROKER_DECODE. 0 => empty => BROKER_DECODE returns 0 (task-4 loops back to recv). NOT a timeout/synthesis: 0xE4 only returned when queue NON-EMPTY. [07:40]
0x002BAC72 MDIRCV_DEQUEUE  # RE-01 corroborated (disfw 0x2BAC72 + dispatch trace). Dequeues one MDIRCV entry: reads entry word r7 at [0x10100+tail*2], group=r7>>8 (r9/r8), builds broker msg struct via EEPROM_READ_BYTES(0x299AF8) [type=0x18 sub=2 grp=r9 raw=r7], advances tail [0x101C8]. The decoded id (r0) is what becomes 0xE4 in task-4. => 0xE4 is an ACTUAL DSP->MCU MDIRCV message, not MCU-side synthesis. [07:40]
0x002EDC40 TASK4_BROKER_DECODE_CALL  # RE-01 corroborated (disfw 0x2EDC40 banner bl-caller of BROKER_DECODE + WATCH=0x2EDC4C step 105941998 r0=0xE4 r6=1 LR=0x298C49). Task-4 MDI_RECEIVER call site: on recv msg==4 (or r6 flag) calls BROKER_DECODE(0x2BACEC) which drains MDIRCV; r4=returned id; ==228(0xE4) => SWDSP fault dispatch at 0x2EDC52->0x2D11F4. [07:40]
0x00244464 BROKER_DSP_HEALTHY_CHECK  # RE-02 corroborated (disfw 0x244464 + WATCH 0x244464 step 38.09M/57.48M/... r5=0x11FEAC r0=0x73 r4=0x6E). Task-2 broker supervisor per-kick check: ldrb [r5+0x73]=[0x11FF1F] DSP-healthy flag; flag!=0(healthy)->0x244472 counter[0x11FF1A]=0; flag==0(unhealthy)->0x24446C counter++; strb at 0x244474; 0x2444A0 cmp#15 -> >=15 falls to TASK2_REBOOT_REISSUE_SITE 0x2444C8 bl REBOOT_FN([0x11FF94]). [07:46]
0x00244474 BROKER_SUPERVISOR_COUNTER_STORE  # RE-02 corroborated (disfw 0x244474 strb [r4=0x6E,r5=0x11FEAC] + RAMWATCH 0x11FF1A 00->01 attributed PC=0x244472, one insn prior). The single store for both counter++ (unhealthy) and counter=0 (healthy) branches of BROKER_DSP_HEALTHY_CHECK. Steady-state: bumps 0->1 every ~19.4M steps then SOFT_WDT_SUPERVISOR(0x2C199C) clears 1->0; never reaches 15 in clean 250M run. [07:46]
0x0011FF1F BROKER_DSP_HEALTHY_FLAG  # RE-02: DSP-healthy flag = [0x11FEAC+0x73]. RAMWATCH=0x11FF1F over full 250M boot+idle = ZERO writes (NEVER written in clean run); stays at boot-init value 0 (=unhealthy). RAMWATCH=0x11FF10 len16 confirms negative: writers exist for 0x11FF15/18/19/1A/1B/1E but NOT 0x11FF1F. => the healthy-flag SETTER is part of the DSP keep-alive handshake that the emulated DSP never performs (no DSP->MCU heartbeat into MDIRCV) => flag stuck 0 => counter bumps each kick. Confirms DSP-keep-alive-timeout hypothesis from the consumer side. Writer is DSP-handshake-gated (Phase2+ target). [07:46]
0x002BB3D8 MDISND_AUDIOPATH_ENABLE  # RE-03: MCU->DSP [0x100E0]=1 audio/COBBA path enable, gated cmp r4,#47 (0x2F) at 0x2BB3D0; also sets [0x30000]=4 + [0x20008]=2. EVENT-DRIVEN not periodic: post-boot fires only in bursts (mono 30.7-32.8M cluster + 71.4M cluster, gaps 0.0M..38.7M irregular) — NOT a steady keep-alive poll. One-direction write, no reply expected. (MDILOG over [0,106M] + disfw) [07:52]
0x002E6E8C SWDSP_DSPINT_PULSE_ONESHOT  # RE-03: MCU->DSP DSPINT [0x20002]|=2 pulse, IRQ-disabled wrap (0x2E4116/0x2E4130). ONE-SHOT at mono=13.1M only — not periodic. Not a keep-alive poll. (MDILOG + disfw) [07:52]
0x002BAD68 MDIRCV_HEAD_INIT_BOOT  # RE-03: MCU-side MDIRCV head [0x101CA] init/advance during BOOT upload handshake (head=(ptr-0x10000)/2). Companion 0x2BACD8. Last write mono=3.78M; NO post-boot DSP-driven MDIRCV head advance exists in clean run => no unsolicited DSP heartbeat is produced by emulated DSP (this is the gap Phase 2/3 fills). (MDILOG + disfw) [07:52]
0x002EDC52 SWDSP_FAULT_DISPATCH_RE03_VARIANT  # variant=A (DSP-initiated heartbeat). This is the 0xE4->SWDSP_STAGER(0x2D11F4) branch target in task-4. EVIDENCE (RE-03): MDILOG over [0,~106M] shows NO periodic MCU->DSP poll. MCU->DSP traffic = boot upload/self-test (<3.8M) + event-driven audio-enable bursts (0x2BB3D8 [100E0]=1, irregular gaps 0.0-38.7M) + one DSPINT pulse (0x2E6E8C @13.1M). SENDLOG: zero direct 0xE4 sends (corroborates). No steady-cadence request-reply => NOT variant B. Healthy flag [0x11FF1F] (Plan01: never written clean run) would be refreshed by UNSOLICITED DSP->MCU MDIRCV traffic the emulated DSP never emits => Variant A. SINGLE-MESSAGE in steady state (no multi-msg handshake observed). FIQ0-DELIVERABLE: yes (Variant A = write MDIRCV + raise FIQ0 per dsp_default.c self-test responder; IRQ4-free, respects post-boot-IRQ4 hazard). NOTE entry — Plan 01-03 owns promote. [07:52]

# ---- archived on 2026-05-29 09:24 ----

[addresses]
0x002A429E BROKER_DSP_HEALTHY_FLAG_SETTER  # sets [0x11FF1F]=[0x11FEAC+0x73] via ldrb [r1=0x11FF1F]+1 strb (state-machine advance, NOT bool); reached from TASK_2_LOC 0x2444D8 (holds r6=0x11FF1F) -> LOC_SUBMSG_DISPATCH 0x2A4224 (subtype [r5+3]); MDI group [r4+3]~0x47/0x82/0x83 routes via 0x244546 to 0x2A4224; precond prior val==26(0x1A), payload word [r5+10..11]<=0; supervisor 0x244464 treats nonzero=healthy. NOTE flag is a LOC/DSP state byte cycling 0->..->26->27; single inject may not flip 0->nonzero (multi-msg walk) - Plan02 to confirm by injection. CONFIDENCE MEDIUM. [08:32]
0x002A4224 LOC_SUBMSG_DISPATCH  # task-2 LOC sub-message dispatcher; routes on subtype [r5+3] (3/5/0x11/0x13/0x47/0x82/0x83); compares [0x11FF1F] vs 26/27 (0x1A/0x1B) state-machine; increments [0x11FF1F] at 0x2A429E; called from TASK_2_LOC 0x24454E when [0x11FF1F]!=0 [08:32]
0x002444D8 TASK_2_LOC  # task-2 LOC/measurement msg dispatcher; loads r6=0x11FF1F at entry (0x2444DE); GET_TASK_MESSAGE loop, group [r4+3] range 0xC0..0x193; group==0x42 -> 0x24457E sets sub-struct [0x11FF1F+3/+4/+5]; groups ~0x47/0x82/0x83 -> 0x244546 -> LOC_SUBMSG_DISPATCH 0x2A4224 [08:32]
0x00240F88 BROKER_DSP_HEALTHY_FLAG_INIT_ZERO  # INIT path: strb r1(=0),[r0=#115,r4=0x11FEAC] => clears [0x11FF1F]=0 during broker-struct (re)init fn 0x240F24 (sets r8=#115/0x73, r4=0x11FEAC base); the ONLY clear-to-zero writer; called from TASK_2_LOC entry 0x2444DA [08:32]

# ---- archived on 2026-05-29 10:14 ----

[addresses]
0x00298ACC SWDSP_E4_SOFTTIMER_FIRE_POST  # P02.1-01: ACTUAL 0xE4 producer to task-4. Soft-timer expiry handler; enqueues expired timer msg-node (msg=0xE4) into task-4 mailbox ring at 0x298B02/B04 (mailbox_ring_table+0x8 idx-by-task). Confirmed: RAMWATCH 0x105F08 write @step105941590 PC=298B02 then recv 0x2EDC36 returns r0=0xE4 @105941993. NOTE: already named SOFTTIMER_FIRE_FREE in overlay; this entry records its role as the 0xE4 poster. Reconciles Phase1(MDIRCV-drain) vs Phase2(LR0x298C49 re-issue): the FIRE is a soft-timer post, NOT a fresh BROKER_DECODE; r6=1 at fire => decode SKIPPED (0x2EDC3E bne) [09:51]
0x00298B20 SWDSP_E4_SOFTTIMER_WALK  # P02.1-01: soft-timer list walker (= SOFTTIMER_WALK overlay). FIQ4_TIMER0_HANDLER 0x2E4426 -> here -> SOFTTIMER_DECREMENT 0x2E4248 ages, expiry (ldrh[r0+4]==0) -> SWDSP_E4_SOFTTIMER_FIRE_POST 0x298ACC. This is the classification MECHANISM: a DSP-keep-alive watchdog timer the DSP must disarm; silent emu DSP => expires ~106M => posts 0xE4 [09:51]
0x002EDC3C SWDSP_E4_REDISPATCH_GATE  # P02.1-01: task-4 loop gate. r6=1 => 0x2EDC3E bne 0x2EDC4C SKIPS BROKER_DECODE. At the FIRE (step105.94M) recv 0x2EDC36 returns r0=0xE4 DIRECTLY (soft-timer-posted msg), r6=1 => no decode, dispatch cmp#228. At BOOT (1.44M) recv returns task-msg 4, r6=0path => BROKER_DECODE drains MDIRCV ring. RECONCILES the two accounts: Phase1 saw the BOOT ring-drain; Phase2/the FIRE is the soft-timer re-issue. [09:51]
0x00267700 SWDSP_E4_WATCHDOG_ARM_TASK14  # task-14 init: arms per-state watchdog timer-sets via STATE_FANOUT (states 0..7) then event-loops; row-6 arm includes the 0xE4 MDI/DSP watchdog. PASS-gated: armed once @step 4.95M only when DSP self-test passes [10:08]
0x00265588 SWDSP_E4_STATE_FANOUT  # per-state arm/disarm dispatcher (jump table 0x2655BC by [0x10B1FC+state]); state-6 handler 0x265340 arms 9 row ids incl 0xE4 from table 0x32C3DC [10:08]
0x00265340 SWDSP_E4_ARM_LOOP_STATE6  # state-6 arm loop: ldrh id from 0x32C3DC[(state*10+i)*2]; bl 0x298738(id) x9. 0xE4 = table entry @0x32C456 (row6 col1). r0=0xE4 arm captured @step 4953348 LR=0x265355 [10:08]
0x002987C6 SWDSP_E4_SOFTTIMER_ARM_BY_ID  # soft-timer arm/cancel manager 0x298738: keyed by timer-id (==msg id at node+10); matches [node+10]==r5(id). Timeout from per-id config [0x104970+id*12+4]; the 0xE4 node is never re-armed/cancelled post-arm [10:08]
0x00278670 SWDSP_E4_READINESS_AGGREGATOR  # subsystem-readiness reporter (10 callers, ids 0x0A..0x13); all fire ONCE in boot burst @~4.94M, none post-boot — the MDI/DSP subsystem never reports the steady-state completion that advances task-14 state-6 to cancel the 0xE4 watchdog [10:08]
0x00267710 SWDSP_E4_STATE_BYTE_DRIVER  # writes task-14 state byte [0x10AE61]=0..7 then 0xFF (step 4.95M burst); state->6 @4953113 immediately precedes the 0xE4 arm @4953348 (2nd-surface arm corroboration) [10:08]

# ---- archived on 2026-05-29 11:36 ----

[addresses]
0x00267038 SWDSP_E4_TASK14_STATE_DECODE  # recv loop decodes msg id 0xFCD..0x100B: state=(id-0xFCD)/9, state-6 completion id=0x1004 (col1=0xE4 watchdog cancel); drives STATE_FANOUT 0x267734 [11:00]

# ---- archived on 2026-05-29 19:05 ----

[addresses]
0x00299A36 HEAP_FREE  # heap dealloc: r0=ptr, reads [ptr-4] size, DECREMENTS HEAP_ACCT_STRUCT+8 by size+4 (writeback 0x299A66), coalesce 0x2E5492, 1998 callers. RENAME of misleading MALLOC_TRY (06-03 DIAG-03; verified disfw on Factory-Reset v5.79) [19:05]
0x00299A84 HEAP_ALLOC  # non-blocking heap alloc wrapper: r0=size, tail-calls HEAP_ALLOC_CORE 0x2E533E, increments HEAP_ACCT_STRUCT+8 by (blk&~1)+4, epilogue 0x299ABA r0=ptr. MALLOC 0x299AEC tail-calls here (06-03 DIAG-03) [19:05]
0x002BACB8 MDIRCV_BROKER_MSG_ALLOC  # 06-03 DIAG: per-MDIRCV-message broker-buffer alloc inside MDIRCV_DEQUEUE — bl BLOCKING_MALLOC(0x299AF8) r0=payload+5, ptr stored [r5] then filled type=0x18 sub=2. THE LEAKING ALLOC SITE for the 0xE4 deep-idle heap leak [19:05]
0x002EDC1E TASK4_BROKER_MSG_FREE  # 06-03 DIAG: TASK_4_MDI_RECEIVER frees the broker buffer here (bl HEAP_FREE 0x299A36, r0=r4=msg) on the NORMAL dispatch path. The 0xE4 path (gate 0x2EDC4C cmp#228 -> SWDSP_FAULT_DISPATCH 0x2EDC52) NEVER reaches here => the missing-free for the deep-idle leak [19:05]

# ---- archived on 2026-05-30 23:11 ----

[addresses]
0x002E5492 HEAP_BLOCK_WALK  # heap free-list/block validate walk from base 0x1167C0; wedge-loop 0x2E54A2 grows as leaked blocks accumulate; coalesce target of HEAP_FREE [20:27]
0x002C1948 PHONEBOOK_MSG_TO_TASK2  # allocs [r5+2]+10 buffer (0x2C195E), fills via UI_PHONEBOOK 0x2F0244, TASK_SENDs to task-2; 977 leak (never freed by task-2) [00:06]

# ---- archived on 2026-06-05 08:07 ----

[addresses]
0x0011186C IDLE_WAIT_GATE  # TASK_0_IDLE sleep/wake gate: set=1 @0x2E0EA2, cleared=0 by FIQ_DISPATCH_LOOP @0x2E6FC2; web never re-dispatches TASK_0_IDLE so SOFT_WDT never re-runs -> broker 0x6C climb [09:37]
0x0025C32E SCREEN_WALKER_WDT_KICK  # 2nd SOFT_WDT_SUPERVISOR caller (display/table 27-item walk) [09:37]
0x002E0E32 IDLE_LOOP_BACK  # TASK_0_IDLE loop-back target: bl SOFT_WDT_SUPERVISOR 0x2C1996; reached from boot fall-through 0x2E0E2A b AND back-edge 0x2E0EB2 beq (gate==0). Native ~22K steps; web frozen at 300 @~54.6M cyc [H4-SCHED-RE]
0x002E0EAE IDLE_GATE_SPIN  # TASK_0_IDLE WFI-equivalent: ldrb gate / cmp #0 / beq IDLE_LOOP_BACK (gate==0) / b self (gate!=0). The idle wait. FIQ_DISPATCH_LOOP clears gate to release [H4-SCHED-RE]
0x002DA37C PN_ROUTE_DISPATCH  # TASK_7/PN routing-table dispatcher: 8-byte-stride table @0x32B478 keyed by device-id [r5+6] (5 entries); bx handler @0x2DA386 or TASK_SEND @0x2DA392 (sender LR 0x2DA397). THE storm loop on web: forwards msg 0x6C54+0x7A14 to task 2 forever @>54.6M cyc; 0 hits on native [H4-SCHED-RE]
0x002DA392 PN_ROUTE_SEND_SITE  # the bl TASK_SEND inside PN_ROUTE_DISPATCH; storm dispatch site. WATCH=0 on native 25M steps; web 7000+/9M steps post-freeze [H4-SCHED-RE]
0x002E4426 FIQ4_TIMER0_HANDLER  # FIQ4 scheduler-tick handler (dispatched by FIQ_DISPATCH_LOOP from 0x2E701C); worker at 0x298B20. Reads readiness_flag_table+0x88 [0x1115F4] [H4-SCHED-RE]
0x002E4418 FIQ5_TIMER1_HANDLER  # FIQ5 Timer1-overflow handler (bl from FIQ_DISPATCH_LOOP 0x2E7016); calls LED_TIMEOUT_WALKER 0x298F68 (soft-timer aging walk), acks [0x20008]=0x20. Fires ~every 25.8M cyc (Timer1 16-bit wrap @T0_HZ 33055) [H4-SCHED-RE]
0x002E82DA SIM_GATE_GREETING_LOAD  # ldrb r0,[0x11FCB8+r0] loads sim_gate_byte[0x11FD1B]; FIRST native-vs-web divergent read (09-02 DIFFTRACE; web bypass-poke=0x06 vs native=0x00)
0x002BAC9E MDIRCV_RING_ENTRY_READ  # ldrh r7,[r4] in MDIRCV_DEQUEUE 0x2BAC72; reads ring word [0x10100+tail*2]; web ka_replay=2 vs native ka_replay=0 ring content diverges (09-02 DIFFTRACE)
0x00244472 BROKER_SUPERVISOR_COUNTER_INC  # increments [0x11FF1A] (PC writes r0; ~every 19.6M cyc); climbs 0->15 under DSPKA_REPLAY=2 then reason-0x6C @0x2444A0 cmp#15. Cleared by SOFT_WDT_SUPERVISOR 0x2C199C on healthy runs; clears=0 under replay-burst (09-02 Task2) [12:23]
0x002C199C SOFT_WDT_COUNTER_CLEAR  # strb 0 -> [0x11FEAC+0x6E]=[0x11FF1A]; unconditional at SOFT_WDT_SUPERVISOR entry. Runs on healthy native (perpetual ka=0 AND DSPNOKEEPALIVE) every ~19.6M cyc; runs 0 times under DSPKA_REPLAY=2 = the 0x6C root (idle-clear starvation) (09-02 Task2) [12:23]
0x002EDB04 TASK_4_MDI_RECEIVER  # MDI receiver: MDI-activity counter [edc68+2] bumped by every non-0xE4 msg; on 0xE4 watchdog, counter==0 -> SWDSP_STAGER(1) reason-0x68, else DSP-alive+reset counter. The 0x68 cancel = ongoing non-0xE4 MDI traffic (H4 09-02) [13:45]
0x002ED6A0 MDI_BROKER_DELIVER_CATCHALL  # unrecognised-MDI-id catch-all -> BROKER_DELIVER -> PN_ROUTE_DISPATCH task-2 re-fan (the 0x6C storm path); reached for any MDI low byte not 0x8D/0x8E/handled (H4 09-02) [13:45]
0x002C1948 MDI_0x7x_HANDLER_TASKSEND2  # MDI id (id&0xf0)==0x70 handler: BROKER_PUBLISH 0x6400 + TASK_SEND(2) -> contributes to the task-2 storm under burst (H4 09-02) [13:45]
0x002A486C BROKER_DSP_HEALTHY_FLAG_SET  # LOC submessage handler tail: sets [0x11FF1F]=1 (DSP-healthy), [+0x72]=2, sends XBUS frame. Gated on LOC/network activity -> NEVER runs at no-SIM standby -> [0x11FF1F] stays 0 -> counter kept in check only by idle SOFT_WDT clear (H4 09-02) [13:45]
0x00298B66 TASK_BLOCK_DISPATCH  # scheduler block/dispatch + node-free path; walks tcb_table 0x106130 + [0x104868] soft-timer chain; frees via 0x2E520C->HEAP_FREE @0x298C44 (H5 09-03) [20:13]
0x002E520C DEV_FREE_VENEER  # ARM device-free veneer; indexes per-task pool-base table flash 0x32E318 ([0x104845] sel); tail-reaches HEAP_FREE (H5 09-03) [20:13]
0x0032E318 TASK_POOL_BASE_TABLE  # flash per-task RAM pool-base ptr table indexed by [0x104845] (H5 09-03) [20:13]
0x002D62C2 MMI_BLOCK_BITSCAN  # deep-idle 16-bit bit-scan over FLASH_BLOCKS-table mask [0x10D4F8+idx*24+36]; the LCD-stall/idle web deep-idle wedge spinner (H5 09-03) [20:13]
0x00290500 KEYPAD_RECV_PUMP  # TASK_1_KEYPAD inner recv pump; calls TASK_RECV_BLOCKING 0x2992D4; ret slot 0x290507 (H5 09-03) [20:13]
0x002E0EA2 IDLE_GATE_SET  # strb r9(=1) -> IDLE_WAIT_GATE [0x11186C]; TASK_0_IDLE arms the wait. On CURRENT build (post-H4-fix 50beb3b) the idle loopback re-runs SOFT_WDT_SUPERVISOR continuously on web (set-site freezes ~870 @100M but LOOP_BACK keeps climbing) -> no 0x6C (09.1-01) [21:50]
0x002E6FC2 IDLE_GATE_CLEAR  # mov r0,#0; strb r0->[0x11186C]; FIQ_DISPATCH_LOOP 0x2E6FBE first act on EVERY FIQ entry -> releases the idle spin. The native re-dispatch wake edge (09.1-01) [21:50]
0x00298B20 SOFTTIMER_WALK  # FIQ4_TIMER0_HANDLER worker: walks soft-timer list [0x298eac+0x20], decrements head, frees expired nodes (SOFTTIMER_FIRE_FREE unlink+free) -> the soft-timer/heap free-list maintenance the H5 UAF list depends on; runs in FIQ4 path regardless of idle redispatch (09.1-01) [21:50]
0x002E70A8 BOOTSTAGE_DRAW_SEND_0x16  # boot-stage: DRAW_CHARS(0x7203)+TASK_SEND(task=1,msg=0x16); ready-path stage absent on 3410 [00:27]
0x002E729C BOOTSTAGE_DRAW_SEND_0x15  # boot-stage: DRAW_CHARS+TASK_SEND(task=1,msg=0x15); final ready advance; 3410 never sends 0x15 [00:27]
0x002E70FE BOOTSTAGE_DRAW_SEND_0x17  # common boot-stage: DRAW_CHARS(0x7201)+TASK_SEND(task=1,msg=0x17); 3410 twin 0x3D5F76 [00:27]
0x002D7346 ANALOG_READY_SEND_0x4C  # task17 self-send msg 0x4C -> TASK_5 ASIC-IRQ-enable handshake (mutex18; TASK_SEND task=17 msg=0x4C) [05:55]
0x0022919E TASK5_MSG_0x4C_ENABLE_IRQ  # TASK_5/task17 msg-0x4C case: programs [0x20024]|=1 [0x20020]|=1 then TASK_SEND task=1 msg=0x4D ack [05:55]
0x00290D60 ANALOG_INIT_FIRES_0x4C  # task17 one-time analog init (guard [0x11173C]); calls ANALOG_READY_SEND_0x4C; reached when readiness HW probe reports ready [05:55]
0x002F2258 DSP_BLOCK_DESC_TABLE  # NULL-terminated table of 28 BE flash pointers to DSP code-block descriptors (0x300CD8-0x307DFC); IRQ4 upload handshake indexes this [22:09]
0x0032C4E8 BROKER_TRACE_CHANNEL_TABLE  # trace-channel NAME registry (osmocom dct3-gsmtap taxonomy); entries 8F<idx> <fixedlen> 00; idx 0x18=MDISND 0x19=MDIRCV 0x20/0x23=SIM (EXACT match to dct3-gsmtap types). VESTIGIAL in v5.79: ref'd ONLY by dead BROKER_CHANNEL_PUBLISH_DEAD 0x2EC3FA literal pool; NOT wired at runtime. Live publish uses native event-ids via BROKER_ROUTER_SPINE 0x2EACAA [16:31][16:52]
0x0011FF4C BROKER_SUBSCRIPTION_BITMAP  # per-channel trace-enable bitmap; BROKER_GATE 0x2EABC0 tests [0x11FF4C+(msgid>>11)] bit AND global broker_enable_flag [0x11FF28]. Set by host 0x40/0x70 debug-enable (PhoNet). 0 at clean boot = all trace channels off [16:31]
0x002EC3FA BROKER_CHANNEL_PUBLISH_DEAD  # DEAD/vestigial in v5.79: 0 BL callers + 0 pointer refs; sole consumer of 0x8F channel table 0x32C4E8 (which is ref'd ONLY by this fn's literal pool). The osmocom 0x8F-channel taxonomy (idx 0x18=MDISND etc) is NOT wired at runtime in this build. Live trace path = BROKER_ROUTER 0x2EACAA (41 leaf sites in 0x24xxxx, native event-ids cat 0x80/0x84) [16:52]
0x002EACAA BROKER_ROUTER_SPINE  # LIVE trace publish spine: 41 leaf-emitter BL callers in 0x24xxxx -> BROKER_GATE 0x2EABC0 -> BROKER_DELIVER 0x2EABE8 -> XBUS_SEND_FRAME. POKE run (broker forced on [0x11FF28]=1) emits ONLY cat 0x80/0x84 (msgid 0x8000-0x800A,0x8408); MDI cat 0x8F NEVER fires => MDIRCV 0x8F19 silent = 3rd independent 0x68-gap confirm (no DSP->MCU MDI traffic in emu) [16:52]
0x00135664 DSP_READY2_FLAG_UNWRITTEN  # dsp-ready-2 flag (set by DSP_ISR_BOOTREADY 0x2CB418; 8850 profile dsp_uploaded). RAMWATCH = 0 writes in 30M on 3310 native => the DSP boot-ready ISR path never completes => SWDSP opcode handshake never initiated (confirm correct 3310 addr; 3410 used 0x11038C/0x12BA10) [22:06]
0x0010AED8 SWDSP_STATE_RECORDS  # per-state record array (0x58=88B stride) indexed by task-14 state [0x10AE61]; OPCODE_DISPATCHER 0x264E14 reads puVar4=base+state*0x58 to build the next msg. State machine working memory [05:42]
0x0010AE58 SWDSP_TASK14_STRUCT  # task-14 state struct: [+8] flag, [+9]=state byte [0x10AE61]. Read by OPCODE_DISPATCHER/STATE_FANOUT as DAT_002651E4. State machine cursor [05:42]
0x0029921C TASK_SEND_PRIM  # task-send primitive TASK_SEND(r0=task_id, r1=msg_ptr); indexes mailbox_ring_table 0x105E90 by task*28. 122 callers. EMPIRICAL: 0 calls with r0=14 (0xe) in 60M boot => SWDSP task-14 mailbox never written [05:57]
0x0024EB26 SWDSP_TASK14_L1_SENDER  # the SOLE immediate-task-14 sender (TASK_SEND@0x24ED86 + twin 0x2996B8@0x24ED78); L1/LOC msg formatter, 6 callers in 24xxxx/25xxxx (L1 message handlers). Builds msg id 2/6 (task-14 low-id path). EMPIRICAL: runs 0× => task-14 wedged at first recv. Gated on L1 activity our DSP-silent model never produces. SWDSP state ids 0xFCD come via task-14's OWN BROKER_DECODE of DSP d2m, which needs this wake first [05:57]
0x001F0000 T14INJECT_TRAMPOLINE  # boot_trace T14INJECT diag trampoline: malloc 0x40 + buf[0]=CALLR0 + FUN_00299134(14,buf). EXPERIMENT 2026-06-05: injecting id 0xFCD/0x1004 @50M DOES wake task-14 (recv returns 1 vs 0, state byte [0x10AE61] FF->0/6 @ PC 0x267054) = ENTRY HYPOTHESIS VALIDATED. But crafted buf only sets [0] => task-14 reads uninit fields ([+3]/[+5]/payload) => WILD-PC @135M cyc. Need the full broker-decoded msg format (DSP-side, resident-ROM-adjacent) [06:09]
0x00267054 SWDSP_TASK14_MSG_DECODE  # TASK_RECV_LOOP entry-id path (lines 754-760): for id 0xFCD..0x100B reads ONLY *psVar3 (off0=id), sets task14 [0x10AE61]=col + [+8]=[+0x50+col], HEAP_FREE, loops. NO other buffer fields read => crafted-buffer is NOT the inject crash cause. Heavy paths (other ids) read off 0x02 (deref'd PTR! crash risk) + 0x04-0x35. Struct = short*, 0x36B. 135M WILD-PC on inject is DOWNSTREAM not buffer [06:14]
0x00298C64 INJECT_MECH_WILD_POP  # T14INJECT crash = INJECTION-MECHANISM ARTIFACT (CONFIRMED 2026-06-05): control inject to task 19 (INJTASK=19) crashes IDENTICALLY (WILD-PC 0xFFFFFFFE via pop{pc}@0x298C64 SEMAPHORE_OPEN epilogue, step ~50.0015M, ~135M cyc). So mid-fn CALL-hijack + unlinked malloc'd mailbox msg corrupts free-list regardless of target task. NOT a task-14/SWDSP failure. Lever (task-14 wakes+state set) still valid; watchdog-cancel verdict OPEN. FIX: faithful inject via sweep_inject_mdircv (MDIRCV+FIQ0) OR CALL only at idle-spin 0x2E0EAE [06:23]
0x00299134 TASK_SEND_TYPED  # TASK_SEND(r0=task,r1=msg) sibling of TASK_SEND_PRIM 0x29921C; indexes mailbox_ring_table 0x105E90. SWDSP OPCODE_DISPATCHER sends to task12/14 via this [06:36]
0x0032C2CC SWDSP_MSGID_TABLE  # 32-bit BE id table, index=(state*9+col)->id 0xFCD..0x100B; 0x1004(state6/col1=wdog-cancel) at +0x8C. INVERSE of recv-loop state=(id-0xFCD)/9. Action table 0x32C3DC [06:36]
0x00278248 SWDSP_DSPMSG_HANDLER  # builds 8B msg id 0xFAC strh->[buf] then TASK_SEND_TYPED(14,buf); one of ~30 internal SWDSP task-14 senders (ids 0xFA1..0x1016). Producer of the 0xFCD-range ids; NOT ring-injectable [06:36]
0x002C342C BROKER_TRACE_PUBLISH  # (r0=trace_id,r1=byte)->BROKER_GATE 0x2EABC0/BROKER_DELIVER. Consumer of literal 0x1004 @0x2A76A0 = OUTBOUND trace id, NOT a task-14 send (disambiguates the two 0x1004 uses) [06:36]
0x002988D2 SOFTTIMER_ARM_BY_SLOTID  # soft-timer ARM/re-arm primitive (r0=slot-idx, r1=delta); per-slot struct = per_task_pending_count+0xEC+idx*12; matcher cmp[node+10],slotid then delta-queue insert via 0x298814. Healthy 0xE4 branch calls (36,0x9CD); the named-but-misplaced 0x2987C6 is a fall-through block of the slot service, not this [06:43]
0x002EDC5A SWDSP_E4_WDOG_REARM  # 0xE4 healthy branch: counter [0x111862]!=0 -> SOFTTIMER_ARM(slot36,0x9CD) re-arms watchdog window + strh 0 -> [0x111862] reset. UNCONDITIONAL re-arm => watchdog is PERPETUAL (View A) [06:43]
0x00232824 SWDSP_E4_WDOG_INITARM  # INITIAL arm of slot-36 watchdog: SOFTTIMER_ARM(36,0x9CD) + [0x111862]=0. One of 3 slot-36 arm sites (this, SWDSP_STAGER 0x2D12A4, healthy-tick 0x2EDC5A); ZERO disarm sites for slot 36 anywhere => never cancelled [06:43]
0x002C3CB8 TASK4_D2M_HANDLERS_NO_T14  # task-4 d2m group handlers (jumptable 0x2EDB48, ids 0x83-0x8F -> 0x2C3690/0x2C3C9C/0x2C3BEC/0x2C3CF0/0x2C3CFC/0x2C3D4C/0x2C3CD4/0x2C3FC4/0x2C3D20/0x2C3CB8/0x2C35CA) + catchall 0x2ED6A0 + 0x70-class 0x2C1948: 19 TASK_SEND_TYPED calls, ALL target tasks 3/10/11/13. ZERO to task-14/12, ZERO into SWDSP engine. No ring d2m kicks SWDSP (Q2=b) [06:43]
0x0020D6C0 SWDSP_L1_REQ_FORMATTER  # L1/LOC request->task-14 formatter (switch on req-type, reads L1 state [0x10E151]/[0x10E160]/DSP-state [0x110440]); sends task-14 ids 0xA29/0xA3C/0xA40/0xA49/0xA4D + a task-12 send @0x23CA50. One of the 3 boot-bootstrap task-14 senders (0x20D72C,0x23CA46,0x24ED78=FUN_0024EB26) gating SWDSP start; ALL L1-cell-sync/DSP-measurement gated => DSP-silent model never fires them [06:43]
0x00265588 SWDSP_STATE_FANOUT  # two-level state dispatch: state byte [0x10AE61]->per-state idx[tbl 0x265928]->jumptable DAT_002655bc->handler->OPCODE_DISPATCHER 0x264E14. CORRECTION 2026-06-05: does NOT cancel the 0xE4 watchdog (firmware-wide scan: no soft-timer disarm, no [0x111862] touch, no 0x1004 literal in fanout). Self-drive engine only [06:45]
0x00267024 SWDSP_TASK14_RECV_LOOP  # task-14 recv loop: msg id=[r5] 16-bit; accepts 0xFCD..0x100B, state=(id-0xFCD)/9. MEASURED recv returns 0x in 40M => wedged from boot (needs L1/LOC kick, NOT ring-injectable). CORRECTION: reaching state-6 does NOT cancel the 0xE4 watchdog (refuted 2026-06-05) [06:45]
0x00264E14 SWDSP_OPCODE_DISPATCHER  # SWDSP opcode->msg builder (strh id->msg[0], TASK_SEND_TYPED to task12/14); 70 callers all SWDSP self-drive. CORRECTION: downstream engine; does not feed/cancel the watchdog counter [06:45]
0x002EDB16 MDI_ACTIVITY_COUNTER_INC  # ldrh r0,[r5,#2];add#1;strh -> bumps [0x111862] per non-0xE4 MDI msg to TASK_4. SOLE feed of the watchdog counter. MEASURED 2026-06-05: with default ka_replay=1 (39-record cap) counter hits 0 at the 203M tick -> 0x68. With DSPKA_REPLAY=0 (perpetual) counter=51 at both 106M+203M ticks -> NO 0x68 to 250M. The in-code dsp_default.c essay claiming silent/replay=1 is safe-to-2.8B is STALE/REFUTED [06:58]
0x002BACF0 BROKER_DECODE_EMPTY_GUARD  # BROKER_DECODE head: MDIRCV_QUEUE_DEPTH 0x2BAC58; if depth==0 -> returns 0 (no dequeue). ANSWERS dan-IRQ-hypothesis 2026-06-05: a bare FIQ0/IRQ (DSP doorbell w/ empty ring) does NOT feed the watchdog counter -> task-4 0x2EDC46 cmp r4,#0 beq loops back without bumping [0x111862]. Watchdog liveness REQUIRES an actual ring ENTRY (depth>0) per ~97M window, NOT just an interrupt. DSPINT 0x30000bit2 is MCU->DSP (outbound, irrelevant to inbound liveness) [07:16]
0x002BAB9E FIQ0_TASKSEND4  # FIQ0 handler 0x2BAB82 tail: sets [0x2000A]bit, [0x20008]=1, TASK_SEND_IRQ(task=4,msg=4) UNCONDITIONALLY on every DSP MDIRCV doorbell. task-4 then BROKER_DECODEs the ring; empty ring => msg discarded (BROKER_DECODE_EMPTY_GUARD). So the doorbell is necessary but NOT sufficient - the ring must carry an entry. Content beyond group byte largely irrelevant (any non-0/non-0xE4 decode bumps counter) [07:16]

# ---- archived on 2026-07-15 01:55 ----

[addresses]
0x00287ABA SETFAID  # FAID write svc-cmd: validates 8-bit sum + 0x4F marker, writes 12B FAID to EEPROM[0x14]; universal NokiX sig [22:26]
0x002875F8 FAID_SUM8  # 8-bit additive checksum (sum&0xFF over N bytes); used by setfaid + FAID validation [22:26]
0x002E36B0 MBUS_RX_DISPATCH  # MBus RX FIQ ISR posts task=7 msg=0x0003 (data received) -> FBUS/service handler task [23:48]
0x002EBD26 FFS_RECORD_READ  # read FFS record by id (id r1, buf r2): find-by-id 0x2EBC3C + copy 0x2EBC64 [23:48]
0x00243CE8 FBUS_F40  # FBUS command dispatcher (r2-4/r2-0xB jump table); NokiX fbus_f40 locator; stdio-over-FBUS hook target [21:52]
0x002E98D4 CCONT_BUS_WRITE_RMW  # CCONT/GenSIO serial-ctrl-bus RMW writer: cmd=[0x2002C] data=[0x2002D] status-poll [0x2006D]&3; table 0x32E88A maps logical reg->bus addr. NOT FBUS [12:00]
0x002E9A52 CCONT_RTC_INIT  # CCONT/RTC power-up init: direct [0x200AD]=0xCF [0x200AE]=0x20 [0x200ED]=0x20 [0x200EE]=0x80 then programs CCONT regs 0,1,3,5,6,7 via CCONT_BUS_WRITE_RMW + 5000-tick xtal delay. Debunks FBUS-init premise [12:00]
0x002E35DC SERIAL_USART_RX_BYTE  # MBUS/FBUS accessory USART RX-byte handler: ldrb [0x2001A]=data -> [0x10BE6C]; sets [0x20019]|=7 [0x20018]|=0x40. Called by SERIAL_USART_RXDATA_FIQ [12:00]
0x002EFB7A SERIAL_USART_RXDATA_FIQ  # FIQ handler (dispatch slot @0x2E7022) for accessory-USART RX-data-ready; tail-calls SERIAL_USART_RX_BYTE 0x2E35DC [12:00]
0x002EFB1C SERIAL_USART_STATUS_FIQ  # FIQ handler (dispatch slot @0x2E7028) for accessory-USART status/error: reads [0x20019] bits5/6/7 + [0x20018] bit7; acks via [0x2000A]|=8 [12:00]
0x002E353E SERIAL_USART_TX_PUMP  # MBUS/FBUS accessory USART TX pump: writes next byte strb [0x2001A] @0x2E35C4, triggers via [0x20018]|=0x20; half-duplex turnaround w/ BUSY_DELAY; feeds PN_TASK(7) [12:00]
0x002E36D2 SERIAL_USART_RX_FRAME_SM  # accessory-USART RX frame state machine (state byte [0x10BE60], 0..7); acks IRQ [0x20008]=4; delivers frame to PN_TASK(7) via TASK_SEND_IRQ [12:00]
0x002E3812 SERIAL_USART_RESET  # USART mode/baud init: writes PUP_CONTROL [0x20015]; clears baud field bits[2:0] via &=0xF8 (=000=9600 per memory-map) then |=8; resets USART via [0x20018]=0x80 poll-bit7. Baud field NEVER set to 100(115200) anywhere in flash. Single caller 0x2E5958 [12:13]
0x002E9E90 MBUS_RX_DELIVER  # delivers assembled MBUS frame @0x10BE6C: mallocs copy (len+8/+6), TASK_SEND_IRQ to task 7 (PN_TASK) [16:45]
0x00241430 MBUS_CMD_DISPATCH_CORE  # type-0x40 service-command dispatch core; selects 1 of 4 descriptor tables (0x320C88/0x320D08/0x320D88/0x320E08) by category r0, indexes by cmd[r6+1]*64; msg-id 0x100..0x121 via 8-byte table @0x321058 [16:45]
0x002BABA4 MDISND_ENQUEUE  # MCU-to-DSP request-queue writer: copies record {len [01:17]
0x000100A4 MDISND_TAIL  # MDISND ring write pointer, word units, ring 0x52 words base 0x10000; DSP-visible trigger cell for the DSPVIS self-test responder [01:17]

# ---- archived on 2026-07-18 19:20 ----
# Phase-II net/audit/verdict.md Section D), deduped per §3.2 + Section E.
# Entries whose addr/name already exist in overlay.yaml are auto-skipped by
# promote (reconciled via the in-place rename/correct pass).

[addresses]
# --- Phase-I §3 : DSP ops / MDI (stub zone, XARM) ---
0x00299510 GU_TASK_CREATE_LOOP  # iterates 24-entry task table @0x31C30C, 12B stride, calls create fn 0x2E42DA(stack,entryPC) [DIS][DATA]
0x0031C30C GU_TASK_CREATE_TABLE  # 24x12B task descriptors: +0 entryPC(BE,thumb) +4 stack +6 prio +7/8/9 mbx-depths [DIS][DATA]
0x002BAB36 GU_DSP_MAILBOX_WRITE_HW  # m2d mailbox HW word write ch3 [0x100DC] busy-gated, kick 0x30000=4/0x20008=2; byte-identical 8850/7110 [DIS][XARM]
0x002BACEC GU_DSP_D2M_DRAIN  # IRQ-masked HW d2m ring drain (calls ring-count 0x2BAC58, reads ring word 0x2BAC72) [DIS][XARM exact 7110]
0x002BAC58 GU_D2M_RING_AVAIL  # d2m ring available count = [0x101C8]-[0x101CA] mod 100; DSP advances HEAD 0x101C8 [DIS][XARM]
0x002BAC72 GU_D2M_RING_READ  # reads d2m tail elem 0x10000+[0x101CA]*2, advances tail; frame LOW=opcode HIGH=len; no phantom 0x102CA [DIS][XARM]
0x00111862 GU_D2M_ALIVE_COUNTER  # u16 liveness ++ per d2m frame @0x2EDB16; ==0 at 0xE4 tick => reason 0x68 [DIS][XREF]
0x002E4116 GU_IRQ_MASK_ENTER  # crit-section enter: save+disable MAD2 IRQ mask 0x2000C, nesting ctr 0x1115F4 [DIS][XARM exact x3]
0x002E4130 GU_IRQ_MASK_EXIT  # crit-section exit: restore MAD2 IRQ mask 0x2000C via nesting ctr 0x1115F4 [DIS][XARM exact x3]
0x002E9F6C GU_MDISND_M2D_FRAME_BUILDER  # task3: batches <=25 words, posts m2d(18XX) frames to DSP via 0x2ED7F4; word doorbell 0x100DC [DIS][XARM 80% 8850]
0x002EDB04 GU_MDIRCV_D2M_DISPATCH  # task4: drains d2m ring, dispatches on [msg+3]; msg 0xE4 supervisory tick, counter [0x111862]==0 => reason 0x68 [DIS][XARM 74% 8850]
0x002AC9DA GU_D2M_OP_ROUTE_TASK8  # route d2m opcode 0x8D/8E/95 to task8 via SEND_TASK_MESSAGE [DIS][XREF sole caller MDIRCV]
0x002ED776 GU_MDI_PUBLISH_CORE  # MDI publish core: routes by 0x1800(m2d)/0x1900(d2m) prefix to 0x2EABE8 [DIS][XARM exact 8850]
0x002ED7F4 GU_M2D_PUBLISH  # m2d publish wrapper: id=0x1800|arg -> 0x2ED776 [DIS][XARM exact 8850]
0x002ED802 GU_D2M_REPUBLISH  # d2m republish wrapper: id=0x1900|arg -> 0x2ED776; sole caller 0x2EDB1E [DIS][XREF]
0x002EABC0 GU_MDI_SUBSCRIBER_CHECK  # id->subscriber-mask test: table 0x32EAE8[(id>>8)&7] & mask 0x11FF4C, gated 0x11FF28 [DIS][XARM 99% 8850]
0x002EABE8 GU_MDI_FRAME_POST  # builds 16+len broker header+payload (malloc), routes via 0x2E9DEA, in-flight ctr 0x11185C [DIS][XARM 84%]
0x002ED702 GU_MDI_M2D_WORD_TRACE  # above-line per-word m2d broker trace class 0x1800 (no DSP HW) [DIS][XREF sole caller MDISND]
# --- Phase-I §3 : DSP boot / init (XARM) ---
0x002F098E GU_DSP_BOOTREADY_SET  # sets boot-ready flag [0x111861]=1 + publishes msg3 to lists 0x32EB50/54 [DIS][XARM exact 8850 0x30C7EA + 7110 0x4EFD56]
0x002AE058 GU_DSP_READY_BROADCAST  # publishes msg 0x7D00, seeds DSP cfg 0x10FF5C/60 from flash 0x329308/0x3292DC [DIS][XARM exact 8850]
0x00241F50 GU_DSP_BOOTDONE_HANDLER  # LOC(task2) d2m sub-handler: sets DSP-state 0x111390.b0, calls bootready + 0x2AE058 [DIS][XARM exact 8850 0x241970]
0x002E98D4 GU_ASIC_SERIAL_REG_WRITE  # ASIC serial-ctrl register WRITE via MAD2 0x2002D/0x2006D; bank tbl 0x32E878 shadow 0x1116C4 [DIS][XARM 91-99%]
0x002E99A4 GU_ASIC_SERIAL_REG_READ  # ASIC serial-ctrl register READ companion; same bank tbl 0x32E878 shadow 0x1116C4 [DIS][XARM 91-99%]
# --- Phase-I §3 : DSP-reset chain (XARM) ---
0x002D11F4 GU_DSP_FAULT_REBOOT  # DSP keep-alive fault->reboot escalation; r0=1/2/3 -> reason 0x68/0x69/0x73; 6-gate; callers MDIRCV/MDISND [DIS][XARM exact 0x2CC9A4]
0x002E0F20 GU_DSP_REBOOT_REQ  # reboot request: fast-send msg 27 to DEV_IO(task1) + event-trace(28,0x7D) [DIS][XARM 92% 7110]
0x002E0ED8 GU_DSP_REBOOT_REASON_SET  # store r0 -> reboot reason latch [0x11FF94] [DIS][XREF]
0x002E0ED2 GU_DSP_REBOOT_ENABLE_GATE  # ldrb [0x11181C] reboot-enable gate !=0 [DIS][XREF 2D11F4]
# --- Phase-I §3 : SIM HW (XARM vs 8850) ---
0x002EAE44 GU_SIML2_TASK  # SIM_L2 task21 entry: state var 0x10FAA8, ring 0x10FAAC, arms 0xC350 timer [DIS][XARM exact 8850 0x304FAC]
0x002EADC0 GU_SIML2_RING_MGR  # SIM L2 8x24B ring 0x10FAAC: op1=PUSH@tail+193, op2=POP@head+192, count+194 [DIS][XARM exact 8850 0x304F28]
0x002CF0A2 GU_SIML2_PRODUCER  # builds type2 descriptor, PUSHes ring op1, task_send(21,msg2) to SIML2 [DIS][XREF]
0x002F0C1C GU_SIMUPL_TASK  # SIM upper-layer task20 entry: GET_TASK_MESSAGE 0xC0..0x1D2 window, dispatch 0x2474DC [DIS][DATA slot20][XREF]
0x002CEF5C GU_SIM_HWWIN_WRITE  # write 8B cmd block to API-RAM/MAD window 0x3F0020+(ch<<13); byte0=0xFE opcode [DIS][XARM exact 8850]
0x002CF1F4 GU_SIM_HWWIN_READ  # read 8B block from hw window (via 0x2D6184) into buffer, SIML2 reg RMW [DIS][XARM exact 8850]
0x002D605E GU_SIO_WRITE_BYTES  # resource-locked serial write primitive to hw window, toggles [0x20033] bit0 [DIS][XARM 98% 8850]
0x002D6184 GU_SIO_READ_BYTES  # resource-locked serial read: indirect byte-fetch via [0x1114BC] fnptr, MSB-first shift [DIS][XARM exact 8850]
# --- Phase-I §3 : FAID / security-code (XARM vs NHM-5 v5.57) ---
0x0025E15C GU_SECCODE_EEPROM_SM  # security-code/lock state-machine dispatch; reads sec EEPROM 0x74B-0x755, sentinel 0x7FFFFFFF; emits UI msgs [DIS][XARM exact NHM-5 0x259CCC]
0x0025D3CC GU_SECCODE_VERDICT_DRIVER  # seeds 0x10BA84=0x7FFFFFFF, reads rec 0x753-0x755, sentinel==erased -> UI 0x8226 blocked [DIS][XARM exact NHM-5 0x258F3C]
0x0025DCCC GU_SECCODE_REC8_READER  # 8-record EEPROM reader base 0x74B idx=state-2 (2..9) param 0x7FF0 [DIS][XARM exact NHM-5 0x25983C]
0x0025F37C GU_SECCODE_STATUS_QUERY  # reads RAM struct 0x10B888[+3] (sec level/state), adds 0x2C substruct, tail-calls 0x25D34C [DIS][XARM exact NHM-5 0x25AEEC]
0x0025D34C GU_SECCODE_LEVEL_GLYPH  # level enum 0x10B889 -> lock status glyph U/A/L/space; display-glyph builder, NOT the verdict node [DIS][XARM exact NHM-5 0x258EBC]
0x0026E7DC GU_SECCODE_MSG_HANDLER  # msg-handler arm: loads req struct [0x10F680] +3/+7/+11 -> drives GU_SECCODE_EEPROM_SM 0x25E15C [DIS][XREF sole caller]
0x002445F4 GU_FAULT_NOTE_DISPATCH  # reason-code->note-id map + CONTACT SERVICE display; incr fault ctr [0x111723], at ==6 shows reason19 [DIS][XARM exact NHM-5 0x240158]
0x002E4076 GU_EEPROM_READ_WRAP  # EEPROM read wrap (r1=logical id,r2=0x7FF0); 182 callers [DIS][XARM 97% NHM-5]
0x002E4034 GU_EEPROM_WRITE_WRAP  # EEPROM write wrap; 260 callers [DIS][XARM exact NHM-5]
0x00111723 GU_FAULT_SERVICE_COUNTER  # byte fault counter; ==6 latches permanent CONTACT SERVICE note19 [DIS][DATA]
0x0010BA84 GU_SECCODE_VERDICT_STAGE  # 32-bit staging cell; pre-seeded 0x7FFFFFFF then loaded from EEPROM verdict rec; ==sentinel means erased/blocked [DIS][DATA]
# --- Phase-I §3 : UI (XARM) ---
0x002E8900 GU_UI_TASK  # task5 MMI message pump: mailbox recv->marshal->8-stage dispatch->internal-ring drain; ctx 0x10F678 [DIS][XARM 93% 8850]
0x002E8A1A GU_UI_MSG_POST  # engine-wide UI msg poster: push id+payload into internal ring 0x10F68C; 1288 callers incl 0x8226 FAID-blocked prompt [DIS][XREF]
0x002E884A GU_UI_MSG_MARSHAL  # UI msg marshal: parse [msg+0] id, count=id>>14, copy payload words to ctx 0x10F678+8/12/16, free msg [DIS][XREF sole caller 0x2E890C]
0x002E87C8 GU_UI_MSG_BUILD_SEND  # UI msg build+send: alloc 16B, fill id+payload, count==0 tail-call SEND_UI_MESSAGE 0x2E8808; 232 callers [DIS][XREF]
# --- Phase-I §3.1 : task-entry facts (deep matrix stays open) ---
0x00290730 GU_DEVIO_TASK  # task1 DEV_IO entry: msg-normalizer+14-state device-IO dispatcher; consumes DSP-reboot msg27 + MDIRCV poke msg0x53 [DIS][DATA slot1][XREF]
0x002444D8 GU_LOC_TASK  # task2 LOCAL/LOC DSP-ops mailbox pump: filter band 0xC0..0x1D2, dispatch class-64 to DSP-ops subhandler 0x243CE8 [DIS][DATA slot2]
# --- Phase-II Section D : L1 / radio / DSP measurement ---
0x002C3BEC GU2_D2M_RECV_BLOCK_CONSUMER  # MDIRCV OP_80 RECEIVED_BLOCK consumer: [msg+4] logchan, 24-bit framenum [msg+7..9]->[0x110FB4], gate [0x110FE0]==1 [DIS][OMEGA47 9.1]
0x002EDB48 GU2_MDIRCV_BOOT_DISPATCH_TABLE  # d2m BOOT jump table (op-0x83)<<2: 0x83->0x2C3690 0x84->0x2C3C9C 0x86->0x2C3F88 0x88->0x2C3CFC 0x89->0x2C3D4C 0x8B->0x2C3FC4; 0x80->0x2C3BEC 0x99->0x2C35CA [DATA][DIS]
0x0020D6C0 GU2_L1_MEAS_REQ_FORMATTER  # L1->task14 measurement-request formatter: band split ids 0xA2x->RR16(0x2B0744), 0xA3x/0xA4x->task14; reads [0x10E151]/[0x10E160+2] [DIS]
0x0024EB26 GU2_L1_MDI_PACKET_BUILDER  # m2d MDI packet builder pathA 0x02 CHANNEL_CONFIGURE / pathB 0x1C measurement list; 8B envelope, TASK_SEND(14) [DIS byte-verified][OMEGA47 9.1]
0x00267700 GU2_TASK14_L1RADIO_ENTRY  # RTOS slot-14 entry (self-registers id14); 8-slot L1/radio-DSP transaction manager (slot-state 0x10AE90, 88B records 0x10AED8) [DIS][XREF]
0x0010E160 GU2_L1_REQ_PARAM_BLOCK  # L1 request-param block: [+2]=req/dispatch state (switch key -0x1F), [+0x30]=payload word copied to task14 msg[+4] then zeroed [DIS]
0x0010E151 GU2_L1_CHAN_STATE_BYTE  # L1 current-channel/state byte copied into task14 msg[+2] by formatter 0x20D6C0 [DIS]
0x0010E204 GU2_L1_ACTIVE_CHAN_TABLE  # L1 channel-slot table, 15 records x4B; formatter scans [+2]==2 active, reads [+0]->msg[+2], [+1]->dispatch [DIS][DATA]
0x0010AED8 GU2_TASK14_SLOT_RECORDS  # task14 L1 transaction slot records: 8 x 88B (stride 0x58), zeroed on free [DIS][DATA]
0x0010AE90 GU2_TASK14_SLOT_STATE  # task14 per-slot state array (8 bytes / mirror 0x10AEA8 0xFF-init); classifier 0x267754 returns 3 if any==7 else 2 [DIS]
0x002B0744 GU2_RR_TASK16_SEND  # thin wrapper: TASK_SEND(16=RR) via 0x29921C; formatter routes L1 ids 0xA29/0xA2B/0xA2C/0xA2F here (RR band) [DIS][XREF]
0x0022E650 GU2_L1_MEAS_TASK10_ENTRY  # RTOS slot-10 entry; L1/radio-measurement task. Consumes d2m RSSI(0x83)/ALL_RSSI(0x8B)/NBR_TIMING(0x88); dispatch loop 0x22E95C [DIS][XREF]
0x0022E5C4 GU2_L1_MEAS_TASK10_INIT  # task-10 init: seeds meas state [0x111878]=22, sets master gate [0x110FE0]=1; registers RTOS id 10 [DIS][XREF]
0x002C3690 GU2_D2M_RSSI_RESULTS_0x83  # MDIRCV boot-table[0x83] RSSI_RESULTS consumer: gate [0x110FE0]==1; forwards to task 10 (SEND_TASK_MESSAGE) [DIS][OMEGA47 9.1/9.3]
0x002C3FC4 GU2_D2M_ALL_RSSI_0x8B  # MDIRCV boot-table[0x8B] ALL_RSSI_RESULTS consumer: gate [0x110FE0]==1; result bufs 0x110FDC/0x110FE4 [DIS][OMEGA47 9.3]
0x002C3CFC GU2_D2M_NBR_TIMING_0x88  # MDIRCV boot-table[0x88] NEIGHBOUR_TIMING_OFFSET consumer: gate [0x110FE0]==1; forwards raw frame to task 10 [DIS][OMEGA47 9.1]
0x002C3D4C GU2_D2M_CHAN_CHANGED_0x89  # MDIRCV boot-table[0x89] CHANNEL_CHANGED_CNF consumer: gate [0x110FE0]==1; request-flag echo vs [0x11161C+2], calls RR 0x2B33F6 [DIS][OMEGA47 9.2 step4]
0x00110FE0 GU2_DSP_MEAS_OPER_GATE  # DSP measurement operational gate: all d2m meas handlers (0x83/0x8B/0x88/0x89) require [0x110FE0]==1 else drop; == 2D dedicated/radio-active gate [DIS]
0x00110FB4 GU2_RCVBLK_FRAMENUM  # 24-bit RECEIVED_BLOCK frame number [msg+7]<<16|[msg+8]<<8|[msg+9], written by 0x2C3C06 [DIS][OMEGA47 9.1]
0x0024E09C GU2_M2D_FREQBAND_TLV_LOOKUP  # m2d 0x7F-TLV builder: band-key lookup in 0x32ACBC, if [+1]==2 emits {0x7F,rec[0],rec[1]} into neighbour frame [DIS][DATA]
0x0032ACBC GU2_M2D_FREQBAND_TLV_TABLE  # flash 30x4 band-key table; 0x24E09C matches [+0]==key,[+1]==2 -> 2B record appended to m2d neighbour frame as 0x7F TLV [DATA][DIS]
# --- Phase-II Section D : SIM acceptance broadcasts (above §2.4 line, 3330i admissible) ---
0x002D7752 GU2_SIM_STATUS_PUBLISH  # SIM-server status/result broadcaster: broker publish 0x502E + UI send 0x53B5; 13 callers in SIM read SM [DIS][XREF 13]
0x002E5EFE GU2_PHONE_STATE_EVENT  # system/phone-state event notify: r0=event id (0..35, gate 0x11FCE6), r1=param; 37 callers (SIM LOCI event 17) [DIS][XREF 37]
0x00215766 GU2_SIM_EF_ACCESS  # core EF access: gate selected-file cache [0x110C38]==r0 ->status2; else APDU read 0x2BEC0A; returns SIM file status [DIS][XREF 80]
0x00216FCE GU2_SIM_EF_READ_SST  # per-EF read+SST-nibble extractor via 0x215766; stores service nibble -> 0x10A688/689/68A for 6F37/6F39/6F41 [DIS][XREF 3]
0x00215BE8 GU2_SIM_EF_LEN_RESOLVER  # file-id -> length/handler resolver; indexes EF desc table 0x32CB10 [DIS][DATA]
0x0021D610 GU2_SIM_EFREAD_SEQUENCER  # SIM data-read master sequencer: clears latch 0x11FF74; phased EF read; each read -> dispatcher 0x21CFA8 [DIS]
0x0021CFA8 GU2_SIM_EFREAD_RESULT_SM  # SIM EF-read result dispatcher: maps file status codes to next-action handlers; drives read chain [DIS]
0x0032CB10 GU2_SIM_EF_DESC_TABLE  # SIM EF file-map {file_id BE, length BE} rows; +DF-path list 0x32CB80; consumed by EF-length resolver 0x215BE8 [DATA][3330i]
0x00110BF0 GU2_SIM_DATA_CACHE  # SIM EF data cache struct base (IMSI/LOCI/SST/FPLMN decoded fields); inited by sequencer 0x21D610 [DATA]
0x00110C38 GU2_SIM_SELECTED_EF  # currently-selected EF id cache (halfword); gate in EF access 0x215766 [DIS][DATA]
0x0011FF74 GU2_SIM_EFREAD_LATCH  # SIM EF-read in-progress/result latch; cleared at sequencer entry 0x21D610 [DIS]
0x0029D0F4 GU2_SIM_SERVER_TASK19  # SIM-server/registration task 19: self-registers id19; reads SIM EF cache 0x110BF0; owns EF-read module 0x215-0x21E [DIS][INF name]
# --- Phase-II Section D : MM / dedicated LAPDm ---
0x002C3F88 GU2_D2M_BLOCK_REQUEST_86  # d2m 0x86 BLOCK_REQUEST handler: gate [0x110FE0]==1; switch [msg+4] logchan -> block class -> GU2_UL_BLOCK_MDISND_1B 0x2A6CF8 [DIS][OMEGA47 9.1]
0x002A6CF8 GU2_UL_BLOCK_MDISND_1B  # uplink LAPDm SEND_BLOCK builder: alloc 32B, strb 0x1B[+3]=MDI SEND_BLOCK, memcpy 23B LAPDm from template 0x32E1E4, TASK_SEND(3=MDISND) [DIS][OMEGA47 9.1]
0x0032E1E4 GU2_LAPDM_FILL_TEMPLATE  # 23-byte idle/fill LAPDm frame: 01 03 01 + 20x 0x2B fill; L2 overwrites with real L3 before send [DATA][OMEGA47 9.1]
0x002A486C GU2_MM_REG_COMPLETE_STATE  # network registration/LU-complete state handler: sets [0x11FF1E]=2, [0x11FF1F]=1 (registered), OR-sets bit0 [0x111390], arms T3212-like timer 27 [DIS byte-verified]
0x0011FF1F GU2_MM_REGISTERED_FLAG  # MM registered-idle latch [0x11FEAC+0x73]; set =1 by 0x2A486C at LU-complete [DIS byte-verified]
0x0023D638 GU2_MM_TASK_MAIN  # MM task (id 15) main loop: self-registers id15, state struct 0x110424, MM state [0x110454] dispatched 1/2/3/7/9/10 [DIS][3330v MM]

# ---- archived on 2026-07-18 20:32 ----

[addresses]
0x002874EC GU2_LOCALSEC_SEND_SEQ  # task2-driven m2d type-0x70 local/security send sequence: emits MSID sub0x13/FAID sub0x14/IMEI sub0x15/SIML sub0x16 to MDISND(3) subtype-2; called from task2 0x241034; clears SIML state [0x10EB1A] [DIS][XREF][OMEGA47 7]
0x002875B6 GU2_LOCALSEC_SIML16_BUILD  # SIML sub-id 0x16 builder: alloc30, [+0]=2 subtype,[+2]=0x1A len,[+3]=0x70 TYPE,[+4]=0x16 subid,[+5]=24 blocklen; reads 24B ENCRYPTED block from PMM/EEPROM offset 0x20 via 0x2EF2C4 into [+6]; TASK_SEND(3); echoed by d2m 0x74 subtype 0x35 [DIS byte-verified][OMEGA47 7 0x16 24B]
0x002C1948 GU2_D2M_LOCAL_RESP_CONSUMER  # MDIRCV OP_7x (MDI 0x74) local/security response consumer: alloc [msg+2]+10 echo buffer, copies [msg+4..] len [msg+2] via 0x2F0244; forwards to task-2 (payload at M+8); publishes 0x6400 [DIS][XREF][OMEGA47 7]
0x002411F8 GU2_D2M_0x74_SUBDISPATCH_FULL  # task2 handler for d2m 0x74 local/security response (forwarded by 0x2C1948): full subtype [M+8] table {0x0A,0x0D,0x10,0x33,0x34,0x35,0x36,0xC8,0xD0} (NOT 0x32). Stubs: 0x0A/0xC8->0x2412F2; 0x0D/0xD0->0x241276(alive); 0x10->0x227576; 0x33->0x227B20; 0x34->0x2879C4(MSID); 0x35->0x287BE8(SIML rec store); 0x36->0x287A68(SIML verdict); default->0x241250 [DIS][OMEGA47 7]
0x0024131C GU2_D2M_74_SIML_SUBDISPATCH  # d2m 0x74 SIML sub-router (near 0x2411F8): keyed on msg[+5] vs consts around 0x6511; routes SIM-lock/security subtypes -> 0x287A68(verdict), 0x287BE8(record store/decode-load), 0x2879C4(MSID). Frame is the DSP/local-security d2m 0x74 response [DIS][XREF]
0x00287BE8 GU2_D2M_SIML35_RECORD_STORE  # d2m 0x74 subtype 0x35 record-store handler (dispatched from 0x2411F8/0x24131C, keyed on msg[+5]): checksum-eor-fold validates DSP response vs [msg+60] (GATE only, no byte change), then VERBATIM-memcpys the decoded 24B record from msg+12 into 0x10EB48+cursor*24 (cursor=[0x10EB18+10]) via stock alignment-opt memcpy 0x2F0244 -- NO MCU transform; sets aux[cursor]+20=3, bumps cursor; self-clocks next 0x70/0x16 request (EEPROM off 0x20+idx*24 via PMM 0x2EF2C4, TASK_SEND 3), loop <=10 records. Faithful producer of the decoded table mdi_gsm.c fakes; pairs with builder 0x2875B6 [DIS byte-verified 0x287C84-C94][DATA][XREF 0x241314]
0x00287A68 GU2_D2M_SIML36_VERDICT  # d2m 0x74 subtype 0x36 handler (from 0x2411F8 stub 0x24130A): reads DSP pass byte [M+10]; pass==0 -> stores 1 (unlocked/allowed) else 0 to verdict boolean [0x10EB18+0]; posts event #2 via 0x298DF6. pass=0 semantics CONFIRMED. Single-byte RAM write, NOT the 0x10EB48 table [DIS][OMEGA47 7 final-SIML pass=0]
0x0010EB48 GU2_SIML_DECODED_TABLE  # decoded SIM-lock table base, stride 24B, up to 10 records; WRITTEN VERBATIM by 0x35 handler 0x287BE8 (DSP-decoded records), WALKED by evaluator 0x286F68. Record layout: compare[0..7] packed-BCD IMSI mask (0xEE=reject-all), enable[+8] lock-enable/type nibble, status[+17], compare-digit[+21]; rec0 boot-default = 8xEE + enable FF + status FF. v5.79 analogue of jmacato (github.com/jmacato) v4.18 0x117B10 [DIS][DATA][XREF 0x287BE8/0x286F68][OMEGA47]
0x0010EB18 GU2_SIMLOCK_CTRL  # SIM-lock control/sequencer struct: decoded table base = this+0x30 (=0x10EB48); walk cursor byte +0x0A (=0x10EB22); record cursor +10; verdict bool +0; seq state [+1]=2 after send, [+7]=1 req-in-flight; [0x10EB1A] cleared at seq entry [DIS][DATA][XREF]
0x0010EB2C GU2_SIMLOCK_REC_AUX  # per-record aux/history state array indexed by record idx; evaluator+reader gate on [idx]==3 (set by 0x287BE8 store) [DIS][DATA]
0x00111722 GU2_SIMLOCK_EDIT_CURSOR  # current-record edit index byte used by the lock field-setters (0x2873BA/0x2873EC); distinct from the eval walk cursor 0x10EB22 [DIS]
0x00286F68 GU2_SIMLOCK_EVAL  # SIM-lock evaluator: loads =0x10EB48 (r8), walks stride 24 cap 10 via cursor [0x10EB18+10]; clears [0x10EB18+5] on entry; enable[+8] bit tests, BCD-match via 0x28655A (0xF wildcard) vs compare[0..7], status[+17]; returns verdict r4 9=reject/continue, 10=accept, 16=restriction [DIS][DATA][XREF]
0x0028655A GU2_SIMLOCK_BCD_MATCH  # nibble-wise packed-BCD comparator (0xF nibble = wildcard/terminator); evaluator uses it to match SIM IMSI against record compare[0..7] mask [DIS]
0x0021C630 GU2_SIMLOCK_ACCEPT_GATE  # SIM IMSI-acceptance gate: builds arg frame, calls evaluator 0x286F68; verdict==10 ->accepted(1), 16->2, 17->3, else 0. 5 callers in SIM EF-read region 0x21Cxxx/0x21Dxxx [DIS][XREF 5]
0x002873BA GU2_SIMLOCK_SET_ENABLE  # runtime writer: RMW enable byte record[+8] (sets high nibble/type via orr), record indexed by edit cursor 0x111722 [DIS]
0x002873EC GU2_SIMLOCK_SET_STATUS  # runtime writer: stores record[+20]=arg0 and record[+21]=arg1 (from param struct [r4+11]/[r4+12]); indexed by edit cursor 0x111722 [DIS]
0x002869E6 GU2_SIMLOCK_REC_SERIALIZE  # record reader/serializer: copies record[0..7] compare (memcpy 0x2F0244), enable[+8], [+20], [+12..15], status[+17] OUT into a caller struct; NOT a writer [DIS]
0x002F2044 GU2_SIMLOCK_ROM_INIT  # flash ROM .data scatter-load descriptor [be32 len=0x12][be32 dst=0x10EB48][8xEE 10xFF]: static BOOT-DEFAULT init of rec0 reject-all (compare=8xEE, enable[+8]=FF, status[+17]=FF), in the 210-desc RAM-init table 0x2F1060..0x2F22CC. This is the DEFAULT; 0x287BE8 later overwrites records from DSP-decoded message payload [DATA]
0x002EF2C4 GU2_PMM_EEPROM_BLOCK_READ  # PMM/EEPROM block read(r0=offset/rec,r1=dst,r2=len): source of FAID(0x14 12B), IMEI(0x15), SIML(0x16 24B from off 0x20) local-security blocks [DIS][XREF FAID/IMEI/SIML builders]

# ---- archived on 2026-07-19 08:38 ----
0x002BADC2 GU3_DSP_HPI_BOOTSTRAP_UPLOADER  # DSP HPI bootstrap uploader: [0x10000]=0/[0x10002]=0xFFFF (step1), writes 5w header @0x100F6, MAD2 0x20002 bit0 run/hold, 115=0x73 ping-pong 0x100FE/0x10100, uploads flash 0x200040 stride-32 -> HPI 0x10200, reads status/ver -> mirror 0x11038C+10/+12 [DIS][XARM][OMEGA47] [21:44]
0x002BAF20 GU3_DSP_HPI_OFFSET_MAP_INIT  # shared-RAM offset-map + clear: loads offset consts 0x1C8/0x1CA(MDIRCV h/t) 0xA6(MDISND h) 0xE2 0xDE 0xE0 0xDA 0xDC 0xCC 0xE4, then zeroes HPI 0x10000 for 0x800 words (step1 RAM test/clear) [DIS][OMEGA47] [21:44]
0x002BB430 GU3_DSP_CODEBLOCK_UPLOAD_DRIVER  # codeblock upload driver (=DSP_MSG_PUMP): reads req 0x100E2, streams chunks from descriptor tbl [0x1103B0] via memcpy 0x2EFA04, writes 5w header 0x100F6, reply 0x100E4=0x0002(more)/0x0004(done), clears 0x100E2 on done, DSPIF [0x30000]=4; also services ND cmd 0x100DE(1->0x2DD790/2->0x2DD778) + short word 0x100DA. Invoked from DSP IRQ 0x2E6F1E [DIS][XREF][OMEGA47][EMU] [21:44]
0x002BB0B4 GU3_COBBA_PARAM_DISPATCH  # cobba/DSP init-param dispatcher (=COBBA_DISPATCH): busy-gate [0x100E0]==0 @0x2BB0CE, 54-way jump table, handlers RMW 18-word param block 0x100A8-0x100CB, commit -> cmd word [0x100E0]=1 + DSPIF [0x30000]=4 + [0x20008]=2 (step6) [DIS][XREF][OMEGA47][EMU] [21:44]
0x002BB6DC GU3_DSP_ASIC_ID_COPY  # ASIC-ID copy (step7): reads MAD2 [0x20000] -> [0x101E2] (observed 0x0040) [DIS][OMEGA47] [21:44]
0x0011038C GU3_DSP_BOOT_STATUSVER_MIRROR  # RAM mirror of HPI bootstrap status(+10 <-0x10000)/version(+12 <-0x10002); version init 0xFFFF -> 0x0001 on bootstrap complete [DIS][OMEGA47 §6.2] [21:31]
0x002EE070 GU3_DSP_CODEBLOCK_REQ_SITE  # site referencing HPI codeblock-request word 0x100E2 (jmacato (github.com/jmacato) 0x0E2 + IRQ4); DSP-side codeblock handshake MCU end - role TO-FIND track [DIS][OMEGA47 §6.2] [21:31]
0x002321DA GU3_RR_CAMP_STATE11_HANDLER  # task-10 cell-sel FSM state-11 handler: on d2m 0x89 (msg id [+4]==0x1802, opcode [+0]==0x89) reads camp-status [0x110F96]; if in {0x50,0x51,0x52} camped-stable branch 0x232228 (issues NO new cmd = CAMPED); else 0x232206 emits next L1 config (task3, template 0x32E1A8 via 0x299134); re-arms state=11 [DIS][EMU-agrees] [21:42]
0x00110F96 GU3_NET_CAMP_STATUS  # network/serving-cell camp-status byte; values 0x50/0x51/0x52 = camped-stable (halts further cell-config in FSM state-11 0x2321DA); other = keep configuring [DIS] [21:42]
0x002D4E10 GU3_NET_STATUS_COMMIT  # commits DSP-staged serving-cell status record into net-status struct 0x110F8C; camp-status [0x110F96]=[0x110F8C+10]=record[1]; arg!=0 stages(alloc+copy), arg=0 flushes; RESOLVES camp-status writer OPEN [DIS][XREF 6: FSM 0x2324A2, 0x89-hdlr 0x2C3DCE, net-mod 0x2D4F64/50F6/5184/5234] [21:52]
0x002B3384 GU3_NET_STATUS_RR_POPULATE  # RR-side populate of net-status struct 0x110F8C from record [0x11160C+8]; camp-status [+10]=src[48], reg-status [+11]=src[46]; 1 caller 0x2B349E [DIS][XREF] [21:52]
0x00110F8C GU3_NET_STATUS_STRUCT  # net-status struct base (DSP serving-cell verdict mirror): +4/+6 cell id hw, +8 0x110F94, +9, +10=camp-status 0x110F96 {0x50/51/52 stable}, +11=reg-status 0x110F97; both writers copy from DSP record, never MCU-computed [DIS][DATA] [21:52]
0x0022E95C GU3_TASK10_CELLSEL_FSM_DISPATCH  # task-10 cell-selection FSM state dispatch: state var [struct+2] (ldrsh); if >28 -> 0x233530 else 29-arm jumptable; states 8->20->11 camp progression [DIS] [21:42]
0x00111742 GU3_TASK10_CELLSEL_FSM_STATE  # task-10 cell-selection FSM state var (=struct 0x111740+2); walks 8->20->11 during cell selection; state 11 = channel-config-confirm/camp-gate wait [DIS] [21:45]
0x0023D34C GU3_MM_IDLE_CAMP_PREDICATE  # returns 1 iff no MM-specific-proc (0x2EC11A==0) AND MM state [0x110454] in {5,6,7,10} = camped idle-mode available [DIS][XREF] [21:41]
0x002EC11A GU3_MM_SPECIFIC_PROC_ACTIVE  # MM specific-procedure/limited-service active helper: reads via 0x28FC5C, r0==1 && [sp+1]==1 -> 1 [DIS] [21:41]
0x0023D37C GU3_MM_IDLE_STATE_GUARD  # MM idle-state guard: struct 0x110424 [+11]==0 && [+12]==1 && state [+48] in {5,6,7,10}; entered from MM task main pre-dispatch [DIS] [21:41]
0x0028F244 GU3_SIM_FPLMN_FORBIDDEN_CHECK  # PLMN-selection forbidden-list gate: 4x3-byte FPLMN memcmp @[0x10A5DC+72+n*4] vs candidate PLMN(r0) via 0x2EFEBC; r6=3 forbidden / 4-5 allowed; writes code to [0x2000C]. CORRECTS CANONICAL LOCI-stage mislabel at same addr [DIS][DATA] [21:41]
0x0028F7D2 GU3_SIM_HOME_PLMN_PACK  # packs home-PLMN MCC/MNC BCD from SIM content struct [0x10A5DC+37] into 3-byte packed PLMN (r4); gated on cache flag bit [0x10A5DC+2] [DIS][DATA] [21:41]
0x002BA304 GU3_RR_NETWORK_AVAILABLE_GATE  # RR network-available/can-register gate: 1 iff [0x110C20]!=0 && 0x28F1F6()!=0 && [0x10B20E]!=0 [DIS] [21:41]
0x0028F1F6 GU3_RR_REG_ALLOWED_HELPER  # net-select-mode/reg flag pair: (([0x10A67C]==0 && [0x10B20C]==1) || ([0x10A67C]!=0 && [0x10B20C]!=0)) -> 1 [DIS] [21:41]
0x002A45C8 GU3_MM_LU_ATTEMPT_COUNTER  # LU attempt-counter SM: reads reg flag [0x11FF1F], clamps [0x1151C+16] to 5 (GSM 04.08 LU attempt max 4), compares [0x11FF20] attempt idx [DIS] [21:41]
0x0029C632 GU3_MM_REG_STATE_BRIDGE  # reg-status reset/bridge: gated [0x110C2A]==0; clears [0x10B204+2/+3], sets [0x1118A8]=0xFF, mirrors [0x10B204+9]->[0x11FF80]; on ==1 clears reg sub-state cluster (0x110C13/0x110C36/0x110C06, sets 0x110BF6=1) [DIS] [21:41]
0x002A70AC GU3_CARRIER_SEARCH_56_BUILD  # MDI 0x56 CARRIER_SEARCH_LIST builder: alloc 164B (0x299AF8), memset0, [+2]=160 ring-len, [+0]=2 RTOS-subtype, [+3]=0x56 MDI-type, 160B payload; paired send fn 0x2A70DA (bl 0x2EB2CC/0x2C2D3A finalize, TASK_SEND(3=MDISND)). jmacato (github.com/jmacato) 9.2 step1 [DIS][OMEGA47 9.2] [21:41]
0x00289434 GU3_RR_CARRIER_SEARCH_EMIT  # RR cell-search subroutine: builds 0x56 via 0x2A70AC(->r7), gates on [0x110ACC] deref, sends via 0x2A70DA(3=MDISND). Callers 0x2327DA/0x232ED6 (RR search driver). Handoff: local-sec/SIM-accept -> first network search [DIS][XREF] [21:41]
0x002327DA GU3_RR_SEARCH_DRIVER_SITE  # RR search-driver emit site: reads pending-cfg [r1+3]==1, calls carrier-search 0x289434, then bumps netmon counter [0x11FDB8+0]. jmacato (github.com/jmacato) 9.2/12.1 step10 net-search kick [DIS] [21:41]
0x002A70DA GU3_CARRIER_SEARCH_SEND  # m2d finalize (0x2EB2CC/0x2C2D3A) + TASK_SEND(3=MDISND) for 0x56. Sole caller 0x289462 (BL scan). [DIS byte-verified][XREF 1] [21:51]
0x002A2128 GU3_NET_STRENGTH_TO_BARS  # RxLev->signal-bar converter: walks NET_TRIGCONV_TABLE 0x32D6D8 (8 signed-halfword thresholds 100,75,50,25...) to level 0-7, reads display byte 0x32D6D9[lvl*2]; input r0=measured RxLev, struct r4=0x10E718 [DIS][DATA][OMEGA47 9.3] [21:46]
0x002A223C GU3_NET_STRENGTH_UPDATE  # network signal-strength update handler: reads raw RxLev [0x10E718+32/+40] /10, calls 0x2A2128 converter, on [0x10E718+0] change stores+flags publish of signal-bar event 0x610D [DIS][DATA] [21:46]
0x0010E718 GU3_NET_SIGNAL_STRUCT  # MMI network-status/signal struct: [+0]=displayed strength byte, [+4]=flags, [+7]=bar-level idx, [+32/+40]=raw RxLev(DSigL/USigL) inputs, [+64]=refresh timestamp [DIS][DATA] [21:46]
0x0032D6D9 GU3_NET_TRIGCONV_DISPBYTE  # display-value byte array = low bytes of NET_TRIGCONV_TABLE BE halfwords (100,75,50,25,25,25,25,25), indexed by bar level*2, read 0x2A21B2 [DATA] [21:46]
0x002EDCB2 GU3_SIGNAL_BAR_EVENT_POST  # posts display event id (0x610D signal-bar) via 0x2EDC70 to window/display task; r0=event id r1=data [DIS] [21:46]
0x0000610D GU3_SIGNAL_BAR_EVENT_ID  # window/display event id 'signal-strength changed' posted by 0x2A223C via GU3_SIGNAL_BAR_EVENT_POST 0x2EDCB2 to task 7; literal at pool 0x2A2444; only producer [DIS] [21:53]

# ---- archived on 2026-07-25 19:56 ----
# overlay). Still keep-open: Phase-I/II un-adjudicated findings + two flagged conflicts:
#   0x243CE8  GU_LOC_DSPOPS_DISPATCH vs GU2_SIMLOCK_CMD_HANDLER  (one addr, two roles)
#   0x2C1948  GU2_D2M_LOCAL_RESP_CONSUMER vs overlay PHONEBOOK_MSG_TO_TASK2 (name reconcile)

[addresses]
0x0021C5F6 SIMREG_TESTPLMN_GATE  # returns 1 iff IMSI-derived PLMN=={00,F1,10} (MCC001/MNC01 test net); gates SIM-accept advance 0x0E14->0x0FFC [01:01]
0x0028F7D4 IMSI_TBCD_TO_PLMN_PACK  # repacks IMSI TBCD [0x10A601..03] into 3-byte packed PLMN buffer; gated by status[0x10A5DE] bit9 [01:01]
0x002E4F38 IRQ_VECTOR_PROLOGUE  # ARM IRQ entry: tst ICR bit3 (IRQD) early-bail; re-writes ICR=0x0A while servicing [15:15]
0x002E6F00 IRQ8_DETECT_ACK_STUB  # post-primary IRQ8 check: ICR bit5 read -> bit6(0x40) ack, NO handler bl; NOP on 3310 (8850 activates as 9th CTSI IRQ 0x302E9E) [15:15]
0x002BB430 DSP_MSG_PUMP  # codeblock pump: reads req [0x100E2] as block index into table 0x1103B0, streams 40B chunks, writes reply [0x100E4]=2(more)/4(complete), rings DSPIF [15:44]
0x002BB0B4 COBBA_DISPATCH  # Cobba cmd builder: polls [0x100E0]==0 (bail 0x2BB1C0 if busy), writes param block 0x100A8.., <=53 cmd jumptable 0x2BB0E2 [15:44]
0x002BB000 DSP_CODEBLOCK_INITIATOR  # synchronous first-block kick: writes header 0x100F6, [0x100E4]=2 @0x2BB04E, clears [dsp_uploaded]=0 [15:44]
0x00228928 GU_TASK_LABEL_BLOB  # field-test task-status name list, canonical task-id order IDLE..IRQ (0..29) [DATA] [01:43]
0x0032E318 GU_EEPROM_RECORD_DESC_TABLE  # EEPROM record-id<<2 -> descriptor lookup base (used by EEPROM_READ path) [DIS] [01:43]
0x00111860 GU_MDIRCV_MAILBOX_STRUCT  # RAM struct drained by MDIRCV(task4) via 0x2ED802 - DSP->MCU (d2m) mailbox [DIS] [01:43]
0x002474DC GU_SIMUPL_DISPATCH  # SIMUPL msg dispatch on byte [msg+3]; copies msg bytes to struct 0x00111870 [DIS][XREF] [01:54]
0x002475C4 GU_SIMUPL_INIT  # SIMUPL init: struct 0x00111870 (+0=0x0C,+1=1,+2=1,+3=0); reads EEPROM rec 0x0E [DIS] [01:54]
0x002EBFB2 GU_LCD_GENSIO_SERIAL  # MMI/HW boundary marker: LCD serial (base+0x6D status bit0, +0x6E data) NOT SIM; nokix GENSIO [DIS] [01:54]
0x0002000C GU_SIM_PERIPH_CTRL_REG  # peripheral reg base+0x0C written 5 and 10 from SIMUPL region (0x2F0C8A/0x2F0C92); likely SIM clock/rate select [DIS][XREF x2] [01:54]
0x0010FAAC GU_SIML2_REQ_RING  # SIM_L2 request ring: 8 slots x24B, head/tail/count @+0xC0/0xC1/0xC2, managed by 0x2EADC0 [DIS] [01:56]
0x0010FAA8 GU_SIML2_MODE_SEL  # SIML2 pump mode selector byte: 1=drain RTOS msg, 5=process ring buffer [DIS] [01:56]
0x002F0C64 GU_SIM_INFO_PUBLISH  # publishes SIM_INFO msg tag 0x4CC8 (4CXX PIN/PIN2 status) via send-msg 0x2E87C8 [DIS]+[3330v SIM_INFO] [01:56]
0x001114BC GU_SIO_READ_CB  # RAM fnptr: registered read-byte HW callback invoked by 0x2D6184 (bx) - true UART touch, boot-installed [DIS] [01:56]
0x0020F1C8 GU_PHCTRL_TASK  # task-12 phone/power-ctrl MMI state machine entry; subscribes event codes 12..64, drives line-state table 0x10E204; NO HW/mailbox access [DIS]+[DATA tasktable 0x31C39C=0x20F1C9] [02:14]
0x002103E6 GU_PHCTRL_EVENT_SUBSCRIBE  # PHCTRL init subscribe/register helper: strh id->[0x10E176], special-id sub-dispatch (0xA11/0x9FF/...) [DIS]+[XREF 48 PHCTRL-local callers] [02:14]
0x0010E204 GU_PHCTRL_LINE_STATE_TABLE  # PHCTRL 15-entry x4B line/call-state table; key byte[+2] line-state {1,2,4,5}, byte[+1]/[+3] line-type {31,42}; scanned by 0x20D18A/0x20D1AC/0x20D1DC/0x20CD5E/0x20D910 [DIS]+[XREF] [02:14]
0x00290500 GU_DEVIO_MSG_NORMALIZE  # DEV_IO msg-id normalizer: GET_TASK_MESSAGE(0x2992D4) then map raw RTOS id->internal dispatch code [DIS][XREF sole caller loop-core 0x291292] [02:14]
0x00243EAC GU_LOC_DSPOPS_OPCODE_TABLE2  # LOC DSP-ops opcode jump table (opcode=141+idx); idx5 -> boot-done stub 0x244082 => boot-done opcode [msg+8]==146 (0x92) [DIS jump-table] [09:54]
0x0011FF15 GU_LOC_DSPOPS_READY_FLAGS  # LOC DSP-ops readiness/flags byte (=0x11FEAC+105); bit0=readiness gate read at 0x243D14; bit2 cleared 0x241288, bit3 set/clr 0x241906/0x24190E in-LOC; bit0 writer unlocated (DSP-init) [DIS][XREF] [09:54]
0x002C35CA GU2_D2M_RUNSTATE_GATE  # MDIRCV d2m opcode 0x8F/0x99 DSP run-state gate (enum 16..24/26/80/81/82) [DIS] [10:16]
0x0026A770 GU2_CELLDB_RECORD_UPDATE  # cell-DB record updater: r0=idx(254=nbr-loop over 0x10B708 x4 | 1..4=nbr rec),r1=chan-code,r2=substate; writes rec[+3]=chan(save old to[+4]),[+5]=sub,[+47]=0; tail sort 0x26A508 [DIS] [10:27]
0x0026A876 GU2_CELLDB_PERCELL_FMT  # per-cell processor rec=0x10B6D4+idx*52: gate [+0]==1,[+3]==7&&[+5]==5 skip; serving-idx match [0x10B56E]; publishes UI events 0x9C9/0x9CD/0x151C/0x951A; sets [+5]=2,[+49]=0 [DIS] [10:27]
0x0026A914 GU2_CELLDB_LISTCTRL_CHECK  # cell-list-ctrl check: [0x10B56C+16]==0x1B and [0x10F683]==[ctrl+17] -> set [ctrl+18]=1; sibling 0x26A936 per-idx invalidate, 0x26A95E neighbour(1..4) sweep [DIS] [10:27]
0x002C7C84 GU2_NETMON_CELL_CMD_PARSE  # NETMON text-command parser: strcmp field tokens ->code r5(1/2/3/5), atoi digit, matches neighbour recs 0x10B708[+1]==digit over idx1..4; dispatch 0x26C4CC [DIS] [10:27]
0x002A2444 GU2_NET_STRENGTH_CONV  # network signal-strength conversion (uses NET_TRIGCONV_TABLE 0x32D6D8): reads [0x10E718+32/+40], divides by 10 (0x2EF544), ARFCN band-gate 0xA28..0x1450 -> display strength [DIS][DATA] [10:27]
0x0011115C GU2_UL_BLOCK_QUEUE  # uplink LAPDm block queue struct: +4/+8 hold pending pre-built m2d block msgs consumed+TASK_SEND(3) by GU2_UL_BLOCK_MDISND_1B classes 0/2/4/7; enqueue side 0x2A7CF4; +1 flag [DIS] [10:33]
0x0021DD6E GU2_SIM_LOCI_POST  # LOCI/LAI post-proc: reads LOCI record [r4+1..6]; on [r4+4]==-[r4+6] (cmn) fires phone-state event 17,4 via 0x2E5EFE (0x21DD7E); then LAI byte arithmetic. [DIS][XREF] [10:35]
0x00217DE2 GU2_SIM_FILE_SELECT_POST  # EF/DF-select self-post to task 19: mov r0,#19; ldr r1,=0x32CB74 (DF-path table); bl 0x299134 (r0*28 mailbox slot). Same pattern also @0x21D7E6. [DIS][XREF] [10:35]
0x002EDBBC GU2_D2M_86_BOOT_STUB  # MDIRCV boot idx3 stub: ldrb r0,[msg+4]=logchan; bl GU2_D2M_BLOCK_REQUEST_86 0x2C3F88 [DIS] [10:40]
0x002996B8 GU2_TASK_SEND_MSG  # SEND_TASK_MESSAGE(r0=dest task id, r1=msg ptr); internal RTOS mailbox send, not MDISND. [DIS][XREF 0x20D6C0,0x24EB26] [11:13]
0x0024EDA0 GU2_TASK14_TLV_MSG_BUILDER  # input struct r0: [+2]=disc in {0x2A,0x3A,0x3B}, [+8]=node list ([+28]=next); builds INTERNAL task-14 msg body type 0x08 (disc 0x2A) or 0x1C (disc!=0x3A) as BER/ASN.1 TLV (tags 0x30 SEQ / 0x80,0x81 ctx / 0x02 0x01 INT) then TASK_SEND(14) via GU2_TASK_SEND_MSG @0x24ED78/86. NOT an MDI m2d packet (0x1C absent from m2d catalog). 0x1C body != jmacato (github.com/jmacato) 9.1 0x0F flat ARFCN+RSSI -> DIVERGENCE, ARM wins. [DIS][OMEGA47-div] [11:13]
0x0020D748 GU2_L1_MEAS_REQ_INTERNAL  # GU2_L1_MEAS_REQ_FORMATTER tail: emits INTERNAL task-14 msg ids 0xA29/0xA3C/0xA49/0xA2C/0xA4D via TASK_SEND(14) @0x20D730 (r0=14). Confirms L1 request fabric is internal-message only; no MDI type byte here. [DIS][XREF] [11:13]
0x002A7706 GU2_RACH_IDLE_RA_BUILDER_0C  # m2d 0x0C IDLE_RA/RACH builder: alloc12/memset, [+0]h=2 [+2]=8 len [+3]=0x0C type [+4]=0 [+5]=mode(src2) [+6]=RA0(src0) [+7]=RA1(src1) [+8/9]=frame hi/lo when mode==1; TASK_SEND(3=MDISND) 0x299134. Doc scan missed it (mov r0,#12;strb[+3] not strb-imm) [DIS][OMEGA47 9.1 0x0C/9.2 step6] [11:17]
0x002DBA32 GU2_RACH_ACCESS_TRIGGER_A  # RACH access-control (module CB [0x111858]): builds RA/frame param struct from tables 0x32E904/0x32E90C, sets mode=1, calls RACH builder 0x2A7706 at 0x2DBACC [DIS][XREF] [11:17]
0x002DBAD4 GU2_RACH_ACCESS_TRIGGER_B  # RACH access trigger, called from RR/L3 0x230146; 2nd RACH-builder call site 0x2DBB98 [DIS][XREF] [11:17]
0x0032E904 GU2_RACH_PARAM_TABLE  # v5.79 RACH slot/frame param tables (0x32E904 + 0x32E90C), indexed by 4-bit field from [0x10E894+16]>>2; feeds RACH builder [+8/9]. REPLACES jmacato (github.com/jmacato) v4.18 0x119F80 (NOT reusable) [DATA][OMEGA47-divergence: addr differs] [11:17]
0x002C2D3A GU2_MDISND_TRACE_PUBLISH  # pre-send broker/trace publish hook (event 0x1B00/0x1D00 via 0x2EABC0) called by every MDI builder before TASK_SEND(3); NOT a radio gate [DIS][XREF] [11:17]
0x0022E618 GU2_RADIO_MEAS_GATE_WRITER  # strb #1 -> [r1=0x110FDC(pool 0x22E648)+4] = [0x110FE0]=1; sole producer of GU2_RADIO_DEDICATED_GATE/GU2_DSP_MEAS_OPER_GATE. set-once boot latch (only reset is memset 0x2C3FE4 called earlier in same init 0x22E5C4). [DIS][XREF] [11:18]
0x0022E988 GU2_TASK10_MSG_DISPATCH  # task-10 msgid dispatch: idx=ldrsh[0x111740+2]; if >0x1C default-arm 0x233530 else jumptable@0x22E990 mov pc; 29 arms 0x00..0x1C. Consumes forwarded d2m RSSI frames (SEND_TASK_MESSAGE(10)) [DIS][DATA] [11:18]
0x0022E990 GU2_TASK10_MSG_JUMPTABLE  # 29-word Thumb handler table for task-10 msgids 0x00..0x1C: 00=22F1A4 01=23175A 02=2334E2 03=23163E 04=2304D8 05=230C38 06=230636 07=230B78 08=233064 09=2325FC 0A=2326EE 0B=2321DA 0C=232A4C 0D=232368 0E=232D3E 0F=232D0E 10=232CB0 11=232B2C 12=232BF8 13=232FE0 14=232F06 15=233088 16=232798 17=231D6C 18=231B5A 19=231F1E 1A=2316AE 1B=22FDDA 1C=22FFFA [DATA][DIS] [11:18]
0x00233530 GU2_TASK10_DEFAULT_ARM  # task-10 out-of-range default arm (msgid>0x1C) via bl from dispatch 0x22E964 [DIS] [11:18]
0x0010B6D4 GU2_NETMON_CELLREC_FIELDS  # CORRECTS SUSPECT flat ARFCN/RxLev/C1/C2/BSIC claim. 52B cell-selection/NETMON descriptor (idx0 serving + nbr). Writer-proven fields: +0 valid(==1); +1 nbr-id digit(0x2C7C84); +3 chan-code(prev->+4)(0x26A770); +4 prev-chan; +5 substate(0x26A770/0x26A876=2); +6 param(->0x11FCFE+1, 0x26A508); +8 flag; +9 chantype code(NETMON_CELL_CHANTYPE 0x10B6DD, rdr 0x26ADBC); +0x0A..0x19 16B identity block (seeded empty by 0x26A7E8, no located non-zero writer); +0x2A hw=0; +0x2E valid2=1; +0x2F dirty; +0x31 field(0x26A876=0); +0x32 disp-flag([0x11FD32]). NO distinct RxLev/C1/C2 word. [DIS][DATA][XREF] [11:18]
0x0028F244 GU2_SIM_FPLMN_FORBIDDEN_CHECK  # below-line FPLMN forbidden-PLMN check: loops up to 4 entries at [0x10A5DC+72+4*i], memcmp 3-byte PLMN (bl 0x2EFEBC r2=3) vs candidate in r9; SIM FPLMN(6F7B) mirrored into settings struct 0x10A5DC by SIM decode module [DIS][DATA][3330i sim_info_check_forbidden_plmn 0x541DEE] [11:18]
0x0028F7D2 GU2_SIM_IMSI_HOME_PLMN_PACK  # below-line IMSI->home-PLMN packer: reads [0x10A5DC+37..+39], nibble-swaps into GSM 3-byte PLMN (MCC/MNC BCD) at out buf, gated by flag [0x10A5DC+2] bit; home PLMN derived from SIM IMSI(6F07) via decode module [DIS][3330i sim_info_read_imsi 0x54221C] [11:18]
0x0028F1F6 GU2_SIM_PRESENT_VALID_PRED  # SIM-present/valid predicate: reads [0x10A67C]/[0x10B20C]; gate called from RR net-reg-allowed gate 0x2BA310, plus 0x22711A/0x26E19C [DIS][XREF 3] [11:18]
0x002BA304 GU2_NET_REG_ALLOWED_GATE  # RR/0x2B region net-registration-allowed gate: reads SIM cache flag [0x110C20]=+48, ANDs SIM-valid pred 0x28F1F6 and net-struct [0x10B20E]; called in predicate chain at 0x2E0E7A [DIS][XREF] [11:18]
0x002BA494 GU2_NET_SIM_EVENT_FLAG_CONSUMER  # RR/0x2B region consumes SIM cache flag [0x110C13]=+35: if set, toggles net-struct [0x10B20D]->[0x10B207], calls 0x29B256, clears cache flag +35 [DIS] [11:18]
0x0029C632 GU2_SIM_CACHE_NET_TEARDOWN  # SIM-registration bridge (task19 module) SIM-removal teardown: reads cache flags [0x110C2A]=+58/[0x110C24]=+52, frees decoded-EF buffer ptrs [0x110C44/48/4C]=+84/88/92 (bl 0x299A36), resets net SIM struct 0x10B204 [DIS][DATA] [11:18]
0x0010A5DC GU2_SIM_DECODED_EF_SETTINGS  # decoded-EF CONTENT landing struct (companion to flag/ptr cache 0x110BF0): home PLMN +37, FPLMN forbidden list +72 (4x, 4B stride), MCC/MNC; written by SIM decode module 0x215-0x21D (19 pool refs), read below-line by 0x28F244/0x28F7D2 accessors [DIS][DATA] [11:18]
0x0021BD5C GU2_SIM_LOCI_WRITEBACK  # MCU->SIM EF_LOCI 6F7E flush: SELECTs 6F7E (0x215766) then A0 D6 UPDATE-BINARY x3 via 0x2BE910 - TMSI off0 len4 (src [0x10A60C]), LAI off4 len5 (src [0x10A610]), LU-status off10 len1 (src [0x10A824]); each gated+cleared by a dirty bit in flags word [0x10A5E4]; err SW 0x63xx->log 0x2D784C. Called from SIM-cache cmd dispatcher 0x21DCA8 + session refresh 0x21CEC2 [DIS][XREF][OMEGA47] [11:19]
0x002BE910 GU2_SIM_UPDATE_BINARY_APDU  # SIM UPDATE-BINARY APDU builder: emits A0 D6 P1 P2 Lc <data> (buf+5=CLA A0, +6=INS D6, +7/8=P1P2=offset r0, +9=Lc=len r1, +10..=memcpy r2 data); enqueues to SIM (0x2BE6AA) and reads back SW halfword, SIM reply 0x9000 mapped to status 2 (0x63xx->99) [DIS][OMEGA47] [11:19]
0x0028F244 GU2_SIM_LOCI_STAGE_DIRTY  # MM LU-accept side: stages LOCI fields into SIM-write control block 0x0010A5DC (TMSI +0x30=[0x10A60C], LAI +0x34=[0x10A610], LU-status +0x248=[0x10A824]) and sets EF_LOCI dirty bits in flags [0x10A5E4]; consumed by GU2_SIM_LOCI_WRITEBACK 0x21BD5C [DIS][XREF] [11:19]
0x002BEC5C GU2_SIM_APDU_RUN_GSM_ALGO  # builds A0 88 RUN GSM ALGORITHM APDU: buf[5]=0xA0 cls,[6]=0x88 ins,[7]P1=0,[8]P2=0,[9]Lc=0x10, data[10..25]=16B RAND (memcpy from r0), sets pending GET-RESPONSE len [0x1117B7]=0x0C; sends via 0x2BE6AA. 1 caller 0x21BCFE [DIS][XREF][OMEGA47 s8 A0 88] [11:20]
0x002BEDDC GU2_SIM_APDU_GET_RESPONSE  # builds A0 C0 GET RESPONSE APDU: buf[5]=0xA0,[6]=0xC0,[7]P1=0,[8]P2=0,[9]P3=[0x1117B7] (=0x0C after RUN GSM ALGO) -> fetches 12B SRES+Kc. [DIS][OMEGA47 s8 A0 C0] [11:20]
0x0021BCD8 GU2_SIM_RUN_GSM_ALGO_HANDLER  # AUTH driver: r0=ptr to 16B RAND (=msg+2). copies RAND, gates on SIM state [0x110C32]==1 (via 0x21571A), calls A0 88 builder 0x2BEC5C (expect ret==2), then GET RESPONSE 0x2BEDDC; resp[0]h==0x66 OK -> SRES=resp[2..5] to 0x29B12A, Kc=resp[6..13] memcpy to RAM 0x10A618. Dispatched from SIM-server jumptable idx8 (opcode 0x119D) at 0x21DC9E. [DIS][XREF] [11:20]
0x0029B12A GU2_AUTH_SRES_RESPONSE  # SRES consumer: r0=&SRES(4B). allocs 8B msg type 0x0A65, copies 4 SRES bytes to msg[2..5], sends (0x2CB3F0 + 0x299134) -> AUTH RESPONSE path back to MM/RR. [DIS][XREF] [11:20]
0x0010A618 GU2_KC_CIPHER_KEY  # 8-byte GSM ciphering key Kc RAM store; written by RUN GSM ALGO handler 0x21BCD8 from GET RESPONSE resp[6..13]. Only one literal ref (the writer); DSP/EF6F20 handoff not via literal. corr EF Kc 6F20 (9B) [DIS][OMEGA47 s8 EF Kc] [11:20]
0x0025FD38 GU2_L2_LAPDM_FRAME_BUILD  # L2(13) outgoing LAPDm frame builder: alloc 28B, switch entity[+1] logchan; dedicated 0x80 path lays hdr at buf[+4]=addr=(SAPI<<2)|1, buf[+5]=ctrl=0x03 placeholder, buf[+6]=length=(L3len<<2)|1 (EL=1 M=0), memcpy(buf+7, L3_src r8, len) then 0x2B-pad; 0x70 path adds 2 lead zero bytes. Queues built frame onto entity send-list [entity+0x158] linked list. THIS lays the real L3 octets. [DIS][XREF 0x25FECE][OMEGA47 9.2 23B SAPI0] [11:21]
0x0025F88E GU2_L2_IFRAME_BUILD  # L2(13) I-frame builder (msgid tag 0x0425): alloc 32B block, memcpy(block+6, entity+0x140, 23) = working L3 info; then overwrites LAPDm addr [block+6]=(SAPI<<2)|1 and control [block+7]=(N(R)<<5)|(P<<4)|(N(S)<<1)|0 from entity V(S)=[+13]/V(R); logchan 0x70 shifts +2; submits via GU2_UL_BLOCK_SUBMIT 0x2A7034. [DIS][XREF 0x25FBD6/0x25FC64][OMEGA47 9.2 I-frame] [11:21]
0x0025F984 GU2_L2_SUPERVISORY_BUILD  # L2(13) supervisory/empty-control frame builder (msgid tag 0x0612): alloc 32B, memset(block+6,0x2B,23), addr=(SAPI<<2)|3, control low-nibble|1 (RR/RNR N(R)<<5|PF<<4|01), length octet=1 (zero info); submits 0x2A7034. [DIS][XREF][OMEGA47 9.2 RR supervisory] [11:21]
0x0025FB68 GU2_L2_TX_FRAME_DISPATCH  # L2(13) uplink frame-type selector on dedicated SDCCH entity 0x10BCF8: reads entity state flags [+18/+19/+20/+21/+24] + V(S)/V(A) [+12/+14] to choose I-frame (0x25F88E) vs supervisory (0x25F984/0x25FA0A) vs 0x25F92C; gate msgid 0x60F/0x611. [DIS][XREF] [11:21]
0x002A6F88 GU2_UL_BLOCK_ENQUEUE  # uplink m2d block enqueue: alloc 32B block, [+0]=0x0002, [+2]=0x1C(28) len, [+3]=0x1B MDI SEND_BLOCK, [+4]=0, memcpy(block+6, srcmsg+6, 23) = assembled LAPDm(addr/ctrl/len/L3); if srcmsg[+2]==0x70 -> [+5]=0x70,store to QUEUE[0x11115C+8],[queue+1]=srcmsg[+3]; else [+5]=0x80 dedicated,store QUEUE[+4],[queue+0]=srcmsg[+3]; frees srcmsg. This is where real L3 lands in the 0x1B [+6..] region. [DIS][XREF 0x2A704E/0x2A708E][OMEGA47 9.1 0x1B] [11:21]
0x002A7034 GU2_UL_BLOCK_SUBMIT  # L2->uplink submit: takes assembled src LAPDm msg, routes by src[+2] logchan (0x70->queue+8 SAPI3 / else queue+4 dedicated 0x80 SAPI0); if slot empty enqueue via 0x2A6F88 else free (already pending); then triggers 0x86 path via 0x2C3F88. 4 callers in L2(13) frame builders 0x25F9xx. [DIS][XREF 0x25F926/0x25F97E/0x25FA00/0x25FB34] [11:21]
0x002A6F0C GU2_L2_IFRAME_SEQ_PATCH  # patches N(S)/N(R) into a QUEUED uplink I-frame control octet in place: logchan 0x70->queue[+8] block, 0x80->queue[+4]; tests I-frame bit0 of ctrl[block+7], matches SAPI (block[+6]>>2)&7 vs arg, rewrites low-5-bit seq of ctrl[block+7]. L2 retransmit/ack seq bookkeeping. [DIS][XREF 0x260974/0x26099C][OMEGA47 9.2 N(S)/N(R)] [11:21]
0x0010BCF8 GU2_L2_SDCCH_ENTITY  # dedicated SDCCH SAPI-0 L2(13) link entity struct: [+0]=SAPI, [+1]=logchan(0x80), [+12]=V(A)?/ack, [+13]=V(R), [+14]=V(S) send seq (mod8), [+18..21/+24]=establishment/busy state flags, [+0x140]=working I-frame L3 buffer (src for I-frame builder memcpy), [+0x158]=pending outgoing-frame linked list head. Sibling entity 0x10BB90. [DIS][DATA][XREF] [11:21]
0x0025FE30 GU2_L2_PRIM_DISPATCH  # L2(13) primitive dispatcher on msg-type ldrsh[prim+0] (0x5DD..0x5E4 band): DL_DATA case reads L3 descriptor prim[+8] (len@[ptr+0], data@[ptr+4]) and calls GU2_L2_LAPDM_FRAME_BUILD 0x25FD38 to lay L3 into a LAPDm frame; other cases set V(S)/V(R), SAPI [entity+1/+2]. Entry point for MM/RR-supplied L3. [DIS][XREF 0x260502/0x260514] [11:21]
0x0011FD09 GU2_LOGGED_INTO_NETWORK  # CALL_STATUS(0x11FCFE)+0x0B registered-idle bool; 17 READ-guards (cmp#0/#1: 0x269488 0x26AB74 0x26DD26 0x26DE56 0x26EBE6 0x270468 0x27047E 0x283A48 0x2C05AA 0x2C0812 0x2CDA5E 0x2CDE9E 0x2E1052 0x2E11F8 0x2EEB52 0x2EFDDC +0x23AFA8). WRITER STATICALLY ABSENT in v5.79 [DIS]: disfw --struct 0x11FCFE +0x0B=W:0; 4 exhaustive scans (imm-off, reg-indexed, word/hw-cover, ARM) = 0 stores from any literal base; NO reg-offset store uses status-region base. Prior 'reg-indexed +9 store' DISPROVEN. Sibling 0x23B246 writes CALL_STATUS+0x03(0x11FD01) NOT flag. Flag never set => guards permanently in not-registered branch; fires on NO received signal (no LU-ACCEPT/attach-cnf consumer). WEAK/OPEN: no writer site exists [11:23]
0x00241276 GU2_D2M_0x74_0D_ALIVE  # d2m 0x74 subtype 0x0D (DSP aliveness) handler: gates readiness flags [0x11FF15] bit3, clears bit2, clears [0x11FC98+15], calls 0x2C1D4A [DIS][OMEGA47 §7 0x0D aliveness] [11:25]
0x00110454 GU2_MM_STATE_ENUM  # MM main state enum (struct 0x110424 +0x30, word); W3 0x23CA76/0x23D080/0x23D4FC R5 (dispatch 0x23D684/9A). Reset/power-on value=10 (both init writers). Idle-family={5,6,7,10} (predicate 0x23D34C); active-family={1,2,3,9}. Dispatch: {1,3}->0x23D6C8(arm guard-timer 162,re-poll=waiting), {2,9}->0x23D6AC(post sig 0x9CF,exit 0x9D0), {7,10}->0x23D6BE(idle no-op,post 0x9CF), else re-poll 0x23D666. Fine GSM sub-labels WEAK (stub zone, terse module.line sig codes). [DIS][DATA][XREF] [11:26]
0x0023D34C GU2_MM_IDLE_PREDICATE  # MM idle/available predicate: returns 1 iff 0x2EC11A()==0 AND state[0x110454] in {5,6,7,10}; partitions the MM enum into idle-family {5,6,7,10} vs active-family {1,2,3,9} [DIS][XREF] [11:26]
0x0023D07C GU2_MM_STATE_SET_FROM_MSG  # MM dynamic state transition: state[0x110454] <- incoming message field [msg+4] (r6=msg); then copies 4-word context 0x1104B8->0x110498 and arms guard timer 241 (0x298738(241)+0x2CAFD8(241,1)); peer/RR-command-driven advance [DIS] [11:26]
0x0023D4E0 GU2_MM_STATE_RESET  # MM full state reset: clears struct 0x110424 fields (+3/+7/+17/+1B/+1E), sets +0x0B=100/+0x1F=2, state[0x110454]=10 (=idle-family), [0x11049C]=10, [0x110445]=0; the power-on/reset init of the MM enum [DIS][DATA] [11:26]
0x002EA022 GU2_MDISND_SHORTCMD_DOORBELL  # MDISND S_PACK_WORD subtype-3 raw-word stager: W=([msg+4]<<8)|[msg+3] -> 10-slot ring -> S_FLUSH to DSP mailbox doorbell 0x100DC (busy-gate word==0, DSP clears after accept, 0x2BAB36). This is the SOLE m2d single-word channel: jmacato (github.com/jmacato) Short cmds 0x45(RSSI+RA-info)/0x4B(all-RSSI+RA-info) ride HERE, NOT the subtype-2 payload ring (which frames [len][type][payload]). Ring path REFUTED for short cmds. Builder(L3 producer that stages the 0x45/0x4B word) OPEN - no literal, computed like RACH 0x0C. [DIS][OMEGA47 6 L466/9.1] [11:26]
0x002BAE20 GU3_DSP_HPI_UPLOAD_PINGPONG  # DSP HPI bootstrap: copies flash 0x200040 stride32 to HPI upload 0x10200; 115(0x73) ping-pong exchanges via words 0x100FE/0x10100; then reads status/ver 0x10000/0x10002 vs 0xFFFF into [0x11038C+10/+12] [DIS][OMEGA47 §6.2] [21:31]
0x002E6F00 GU3_DSP_HPI_IRQ_DISPATCH  # DSP->MCU interrupt dispatcher (overlay IRQ8_DETECT_ACK_STUB): per-source-bit on [r4+12]/[r4+9]; codeblock-request bit calls DSP_MSG_PUMP 0x2BB430 (jmacato (github.com/jmacato) IRQ4 linkage; HW IRQ# unresolved vs overlay IRQ8) [DIS][XREF] [21:44]
0x0010E778 GU3_NET_STRENGTH_LEVEL_TABLE  # per-level RxLev reference array (RAM): converter 0x2A2128 sets r7=0x10E778, loops ldrh [r6,#12]/[r7,#14] stride 2 over levels 0-7 to scale 75*x/100 vs measured input before NET_TRIGCONV compare [DIS] [21:53]
0x0022E61C GU3_RADIO_MASTER_GATE_ARM  # strb r0,[r1,#4] sets [0x110FE0]=1 (+[0x110FDF]=1 @0x22E61E); ldr r1,=0x110FDC @0x22E618 in GU3_TASK10_INIT 0x22E5C4; P5 radio/RSSI master gate arm; closes O4 [DIS][XREF][OMEGA47 §6.3/§9.1 C1] [22:22]
0x002A7274 GU3_M2D_SERVING_CELL_57_BUILDER  # m2d MDI 0x57 serving-cell/SCH follow-up builder: alloc8/memset0, [+0]=2 subtype [+2]=4 len [+3]=0x57 type (mov r0,#0x57;strb[+3] @0x2A7292), payload [+4]/[+5] via shared lib helper 0x2A6E1E from (r0=cell/chan byte,r1=mode), finalize 0x2EB2CC->0x2C2D3A->TASK_SEND(3=MDISND); own builder in 0x2A6Cxx MDISND(3) lib beside 0x56 0x2A70C2; callers 0x22FDFC(L1 r0=[0x110FC4] r1=1)/0x231F98(RR struct [0x111680] r1=0/2) [DIS byte-verified][XREF 2][OMEGA47 9.1 0x57] [22:26]
0x00111858 GU3_RACH_REQREF_BLOCK_PTR  # ptr to RACH request-reference control block (v5.79 replaces v4.18 history table 0x119F80); block: [+0]=RA value,[+1]=RA random-bit width,[+2]/[+3]=band/T-offset flags,[+8]=frame base. inited=0 @GU3_TASK10 0x22E5FA; alloc on RACH send; freed+cleared @0x2DBBA0. read by send builders 0x2DBA32/0x2DBAD4 [DIS][XREF 11 sites][OMEGA47 §9.2] [22:27]
0x002DBBA0 GU3_RACH_REQREF_BLOCK_FREE  # RACH done/abort: free [0x111858] block (bl 0x299A36) then str 0 -> clears pending-RACH state [DIS] [22:27]
0x002E1D16 GU3_RACH_EXPECTED_FRAMEREF  # build expected req-ref frame tuple (T1p/T3/T2) from live TDMA counter [0x10E894+60/61] for IA echo compare [DIS][XREF<-0x2DBBB0] [22:27]
0x002EF940 GU3_SIO_CB_INSTALL  # resolves OPEN-2: boot installer of SIM SIO byte-I/O callback vtable [0x1114B8..0x1114C8]; stores [0x1114BC]=0x2F06D5 (accessor), [0x1114C0]=0x11F54D + [0x1114B8]=0x11F4DD (RAM byte-pump banks), [0x1114C4]=0x2F06F9,[0x1114C8]=0x2F06D9 (ROM->RAM cfg loaders); single caller 0x2F0552 [DIS][XREF][DATA] [22:30]
0x002F06D4 GU3_SIO_BYTE_ACCESSOR  # [0x1114BC] target = SIML2 byte-I/O callback (HW-3); ldrh r0,[r0];mov pc,lr halfword read accessor; called by SIO read 0x2D619A + write 0x2D609E under res-8 lock [DIS][XREF] [22:30]
0x002F0514 GU3_SIM_DRV_INIT  # out-of-task SIM driver boot-init sequencer; calls cb-install 0x2EF940 then SIO-reset 0x2D656C; callers 0x2E0B48/0x2E0DD6 [DIS][XREF] [22:30]
0x00232798 GU3_RR_SEARCH_STATE22_HANDLER  # task-10 cell-sel FSM state 0x16 handler (jumptable 0x22E990 arm 22, dispatcher 0x22E95C idx=[0x111742]); reads RR-CB *(0x111670)[+6], when ==0 flows to carrier-search emit 0x2327DA with args CB[+0]/CB[+1]; the FSM-state route that lands on 0x2327DA/0x289434. O2 consumer edge = FSM dispatch, not broker table [DIS][DATA jumptable] [22:30]
0x002326EE GU3_RR_SEARCH_STATE10_HANDLER  # task-10 cell-sel FSM state 0x0A handler; switches on RTOS primitive [msg+4]; 0x3EA/0x3EB/0x3EC -> shared search tail 0x232758->0x2327DA (gate [0x111680]!=0); 0x3E9 -> abort 0x23304A; the primitive route into the shared emit tail. SIM-accept->here still RAM-mediated (writes [0x111742]=0x16 / posts task-10 primitive) = [INF] residual [DIS][DATA] [22:30]
0x002BE910 GU3_SIM_UPDATE_BINARY_APDU  # A0 D6 UPDATE-BINARY APDU builder: buf[+5]=0xA0 CLA (0x2BE930-32), buf[+6]=0xD6 INS (0x2BE934-36) byte-verified; P1/P2/P3=off_hi/off_lo/len; SIM reply 0x9000->status2 [DIS byte-verified][XREF][OMEGA47 §8.2] [22:38]
0x0021BD5C GU3_SIM_LOCI_WRITEBACK  # EF_LOCI 6F7E flush caller: SELECT then 3x A0 D6 UPDATE-BINARY (TMSI/LAI/status) via 0x2BE910 [DIS][XREF][OMEGA47 §8.2] [22:38]
0x002BAE36 GU3_DSP_HPI_UPLOAD_STAGE_LITERAL  # D4 CLOSED: uploader stages HPI 0x10200 (ldr r7,=0x10200); jmacato (github.com/jmacato) $6.1 0xE00 entry adjudicated to 0x10200. Secondary 0x10E00 high-stage ABSENT — image-wide scan finds ZERO word-aligned pool words ==0x00010E00 (LE/BE); 9 byte-seq coincidences all unaligned mid-data (file 0x110CA1/0x11C9FB etc), ARM literal pools word-aligned => none loadable, zero code xref [DIS][DATA] [22:39]
0x002C3C9C GU3_D2M_RA_INFO_84  # d2m 0x84 RA_INFO handler (boot tbl 0x2EDB48[1]=0x2EDBC4 stub); gate [0x110FE0]==1 -> TASK_SEND(10,msg) else HEAP_FREE; NO ARM field decode (RA_INFO fields decoded in task-10 RR) [DIS][DATA][OMEGA47 9.1] [22:41]
0x002C3A1C GU3_D2M_RXBLK_CCCH  # d2m 0x80 RECEIVED_BLOCK logchan 0x60 CCCH branch (from 0x2C3C6E); state-gate [0x110F8C] in {0,3} drop; 24-bit framenum -> paging/AGCH block idx from paging-cfg [0x10E8D8] bitfields; build stack descriptor+forward [DIS][OMEGA47 9.1] [22:41]
0x002C36C2 GU3_D2M_RXBLK_SDCCH  # d2m 0x80 RECEIVED_BLOCK logchan 0x80 dedicated SDCCH branch (from 0x2C3C58; also 0xB0/0xB1 status!=1); retag[msg]=0x0623 stash logch@+11/status@+12/flag@+13 -> TASK_SEND(11) [DIS][OMEGA47 9.1] [22:41]
0x002C3884 GU3_D2M_RXBLK_070  # d2m 0x80 RECEIVED_BLOCK logchan 0x70 assoc branch (from 0x2C3C64); gate [0x110FB0]/[0x110FD2]bit7, serving-BSIC latch [0x110FD0+1], status-dependent forward [DIS] [22:41]
0x002BE9EC GU3_SIM_STATUS_APDU  # A0 F2 STATUS APDU builder (no args, fixed cmd): buf[+4]=3 frame-subtype, buf[+5]=0xA0 CLA (0x2BEA02-04), buf[+6]=0xF2 INS (0x2BEA06-08) byte-verified, buf[+7]=P1=0, buf[+8]=P2=0, buf[+9]=P3 len from RAM [0x1117B6]; len field [+2..3]=5; submit via GU3_SIM_APDU_SUBMIT 0x2BE6AA. Family-mate of GU3_SIM_UPDATE_BINARY_APDU 0x2BE910 [DIS byte-verified][OMEGA47 §8.2][EMU mad2_sim.c models STATUS in T=0 server: agree] [22:41]
0x002BE8B2 GU3_SIM_UPDATE_RECORD_APDU  # A0 DC UPDATE-RECORD APDU builder (args r0=P2 mode,r1=P1 rec#,r2=len,r3=data ptr): buf[+4]=3, buf[+5]=0xA0 CLA (0x2BE8D8-DA), buf[+6]=0xDC INS (0x2BE8DC-DE) byte-verified, buf[+7]=r6=P1 rec#, buf[+8]=r7=P2 mode, buf[+9]=r5=P3 len, buf[+10..]=memcpy(r8,len) record data via 0x2F0244; len field [+2..3]=len+5; submit via GU3_SIM_APDU_SUBMIT 0x2BE6AA [DIS byte-verified][OMEGA47 §8.2][EMU mad2_sim.c: agree] [22:41]
0x002BE6AA GU3_SIM_APDU_SUBMIT  # Shared SIM-APDU submit for the class-A0 builder family (D6/DC/F2/2C...): gated by SIM-blocked flags [0x10B20D]/[0x10B207] (if set, posts SW-0x1E error msg to task 18 instead); else enqueues built frame to SIM server. Called tail of every A0 builder at 0x2BE8B2/0x2BE910/0x2BE966/0x2BE9EC [DIS][XREF][OMEGA47 §8.2] [22:41]
0x00287574 GU3_LOCALSEC_IMEI15_BUILD  # m2d 0x70/0x15 IMEI/security builder (send-seq 0x2874EC arm 3): alloc26,[+0]=0x0002,[+2]=0x16 flen,[+3]=0x70,[+4]=0x15 subid,[+5]=0x14 plen; 20B payload=PMM/EEPROM security-area off 0x00 len12->[+6]+off 0x0C len8->[+18] via 0x2EF2C4; TASK_SEND(3=MDISND). SEND-ONLY: no d2m 0x74 subtype 0x15 in dispatch 0x2411F8, matches jmacato (github.com/jmacato) s7 no-response [DIS byte-verified][XREF 0x2874EC][OMEGA47 s7 0x15] [22:42]
0x00100044 GU3_PMM_EEPROM_MIRROR_BASE  # RAM/PMM security-EEPROM mirror base (backing store of GU2_PMM_EEPROM_BLOCK_READ 0x2EF2C4 via 0x2AD4F4, bound +0x4800). Contiguous local-security layout: IMEI off 0x00-0x13 (20B, m2d sub 0x15) | FAID off 0x14-0x1F (12B, sub 0x14, SETFAID 0x287ABA write via 0x2EF294) | SIML off 0x20-0x37 (24B, sub 0x16) [DIS][DATA][XREF SETFAID/send-seq] [22:43]
0x002EF294 GU3_PMM_EEPROM_BLOCK_WRITE  # PMM/EEPROM security-area block WRITE (r0=byte offset,r1=src,r2=len); mutex-paired sibling of GU2_PMM_EEPROM_BLOCK_READ 0x2EF2C4. Used by SETFAID 0x287ABA (off 0x14=FAID,12B) + record svc-cmds 0x28766C. Overlaps nokix-locate EEPROM_WRITE_BYTES [DIS][XREF SETFAID] [22:43]
0x0029C6C0 GU3_SIM_ATR_PARSE  # MCU-side ATR parser+PPS builder: TS==0x3B/0x3F @0x29C706, decode T0/TD Yi interface-byte bitmap, gather TA/TB/TC/TD, build PPS req FF PPS0 PPS1 PCK -> 0x10B22C [DIS][XREF 0x29D1DC][OMEGA47 8.2][EMU] [22:45]
0x0029D0F4 GU3_SIM_ISO7816_SM  # ISO7816/T=0 protocol state machine: reset(0x2D4990)->ATR recv->ATR parse(0x29C6C0)->PPS->APDU; struct 0x10B204 [DIS][XREF][EMU] [22:45]
0x002D490E GU3_SIM_FIQ6_ISR  # SIMI-UART FIQ6 ISR: dispatch MAD2 0x38 int bits -> bit6=RX(0x2D487C) bit4=TXempty(0x2D46E4) [DIS][XREF 0x2E702E][OMEGA47 8.1 int bits][EMU] [22:45]
0x002D487C GU3_SIM_RX_BYTE  # SIM RX-byte handler: reads MAD2 0x36 data port into ATR/APDU buffer (ATR reception) [DIS][XREF 0x2D494E][EMU sim_receive] [22:45]
0x002D46E4 GU3_SIM_ADVANCE  # SIM SM advance: poll MAD2 0x39 status + 0x3F queue count, TX-empty -> status 7 [DIS][XREF 0x2D4942][EMU sim_advance] [22:45]
0x002D4990 GU3_SIM_HW_RESET  # SIM cold-reset/init over MAD2 ctrl regs 0x08/0x0A/0x0D+0x38/0x3A, state=5 [DIS][XREF 0x29D1C0][EMU] [22:45]
0x002D460E GU3_SIM_APDU_TX  # T=0 APDU byte TX engine over MAD2 0x36 data + 0x3F queue [DIS][XREF][EMU] [22:45]
0x0010B344 GU3_SIM_ATR_BUF  # ATR reception buffer: len ldrsh@+0, TS@+2, T0@+3 [DIS][DATA] [22:45]
0x0010B204 GU3_SIM_PROTO_STRUCT  # ISO7816 SM struct: verdict+7, protocol-type+16, +21 [DIS][DATA] [22:45]
0x0010B22C GU3_SIM_PPS_BUF  # PPS request buffer FF PPS0 PPS1 PCK [DIS][DATA] [22:45]
0x002D4408 GU3_SIM_UART_LEGACY_DRIVER  # classic MAD2 0x0200xx SIM-UART driver base (0x2D4408-0x2D4B40); ~30 callers 0x29C456-0x29D826, FIQ entry 0x2E702E [DIS][XREF][OMEGA47] [22:45]
0x002D4468 GU3_SIM_UART_RESET_CLOCK_SEQ  # SIM reset/clock-enable seq: control 0x020039, clock [0x02003A]|=0x30 @0x2D4496, MAD2 0x02000D bits [DIS][OMEGA47] [22:45]
0x00243BFA GU3_SIM_PRESENT_STATUS_READ  # reads SIM control 0x020039 bit 0x80 (reset/present) -> flag @0x243BFC; 2nd live 0x20039 consumer outside main driver [DIS][OMEGA47] [22:45]
0x002C3B8E GU3_D2M_BCCH_SI_FORWARD  # MDIRCV 0x80 BCCH(0x50) arm off 0x2C3BEC logchan switch: dedups block vs serving ctx [msg+5]BSIC==[0x110F8C+9] && [msg+10,11]ARFCN==[0x110F8C+4]; on new BCCH stamps [msg+0]=0x0809 + TASK_SEND(13) (mov r0,13;bl 0x299134 @2C3BD0) -> L2/RR task13 SI L3 decode [DIS][OMEGA47 9.2.5] [22:47]
0x002162B6 GU3_SIM_LOCI_PARSE  # EF_LOCI 6F7E READ decoder: rec[r4+4] -> TMSI[+0..3]->0x10A5DC+48, LAI[+4..8](5B)->0x10A610, upd-status[+10]->0x10A824; BCD-validates MCC/MNC nibbles (2162DC-308), default LAI from 0x32CB08 on fail. SIM-sourced LAI, NOT broadcast-SI [DIS][XREF][OMEGA47 s8/s10] [22:47]
0x002A723E GU3_M2D_POLL_0x4B_BUILDER  # short 0x4B all/more RSSI+RA poll: subtype-3 single-word m2d builder, mov#0x4B->[buf+3]@0x2A7254, W=(((r1<<4)|r0)<<8)|0x4B, TASK_SEND(3=MDISND) -> packer 0x2EA022 -> doorbell 0x100DC; args r0=[0x110ACC]->+10, r1=[0x110FC4]/[0x111680]; 3 callers 0x22FE42/0x231F76/0x232E50 [DIS][XREF][XARM 8850 0x2B325A byte-id, 5.57 0x2A29F4][OMEGA47 9.1] [22:47]
0x002A76BC GU3_M2D_CMD_0x46_BUILDER  # 0x46 MSI measurement req: subtype-2 RING/full-message builder, mov#0x46->[buf+3]@0x2A76D8 + 4 caller bytes [r5+0..3]->[buf+4..7],[r5+4]->[buf+9]; rides m2d payload ring 0x100A4/A6 NOT single-word doorbell. Corrects prior '0x46 ABSENT' verdict [DIS][OMEGA47 9.1] [22:47]
0x002A75EC GU3_M2D_POLL_0x4A_BUILDER  # short 0x4A RSSI+RA poll sibling: subtype-2 ring builder, mov#0x4A->[buf+3]@0x2A760A, two u16 args r6/r5 hi/lo -> [buf+4..7], TASK_SEND(3) [DIS] [22:47]
0x00242E10 GU3_M2D_GENERIC_BUILDER  # generic m2d command builder: dispatch on [req+9] (2=ring / 3=single-word); word path sets [buf+3]=[req+11] (caller-supplied type byte),[buf+4]=[req+10]@0x242E36-4C; the true caller-supplied buf[+3] path, 1 caller 0x244126 [DIS][XREF] [22:47]
0x002DBE08 GU3_RACH_CTRL_ALLOC  # lazy-alloc/reset RACH control block: if *[0x111858]==0 malloc(16)@0x299AF8, store ptr, memset0@0x2F0D34; called before each request-ref latch [DIS][XREF] [22:48]
0x0022EB90 GU3_RACH_REQREF_LATCH_A  # latches L3 EST primitive (msg-id 0x03FE) body [msg+8][4..7] into RACHC*[0x111858][0..3] = request reference; NOT a compare [DIS][XREF] [22:48]
0x0023002A GU3_RACH_REQREF_LATCH_B  # twin latch site (msg-id 0x03FE) copying primitive body [4..7] into RACHC[0..3], then RACH build via 0x230078 [DIS][XREF] [22:48]
0x002DBC74 GU3_RACH_ACCESS_PERMIT  # RACH access-class permit gate: reads RACHC[0], forms 16-bit AC mask, per-class bit test 0x2E2028, ret 1 if permitted; gates every RACH-continue site [DIS][XREF] [22:48]
0x002EF488 GU3_RACH_SLOT_BACKOFF  # SEND-side RACH slot/backoff timing: idx=SI RACH-ctrl [0x10E894+16]>>2&0xF -> param table 0x32E904/0x32E90C byte + PRNG 0x2E1CD8 -> Tx-integer/slot; the 2nd 0x32E904 consumer (Tx, not receive-history) [DIS][DATA][OMEGA47-div] [22:48]
0x002946F0 GU3_NET_SEARCH_START  # cell-search START: allocs search ctx [0x11166C+4]=8B/+20=12B, clears substate +2/+4/+5, kicks search SM 0x2937B4 with event r0=1; invoked from NET-dispatcher signal-0x3E9 case at 0x23254E [DIS][XREF] [22:51]
0x002937B4 GU3_NET_CELLSEARCH_SM  # 9-state cell-search state machine; state var ldrsh[0x11166C+2] (0..8) -> jumptable 0x2937D0; entered per search signal; return byte -> [0x111670+6] [DIS] [22:51]
0x0011166C GU3_NET_SEARCH_CTX  # cell-search context: +2 SM state(0..8), +4 ptr(8B arfcn/param block), +6 mode-derived byte(from 0x2937B4), +20 ptr(12B); carrier-search param ptr mirrored at 0x111674 [DIS][DATA] [22:51]
0x002324D8 GU3_NET_SIMSTATUS_BROKER_ATTACH  # NET/cell-search task attaches broker channel 0x502 at dispatcher setup (ldr r0,=0x1117C0 handle; ldr r1,=0x502; mov r2,#0; bl 0x2E4034); SIM-accept broadcast 0x2D7752 publishes SIM status to tag 0x502E on this channel = the SIM-accept->search broker edge [DIS][XREF] [22:51]
0x00110ACC GU3_NET_MODE_GATE_PTR  # ptr to NET operating-mode block; [0x110ACC]!=0 required to actually transmit the built 0x56 (else frame discarded 0x2891A0); also gates dispatcher paths (0x22FCD8 [ptr]==3||4); SIM-accept binding of this mode byte [INF] [DIS] [22:51]
0x002DBBB0 GU3_RACH_SLOT_FRAME_MATCH  # send-side RACH slot matcher: builds live TDMA frame via 0x2E1D16, compares (r0/r3) vs pending-RACH descriptor tuple (r1/r2 from 0x28F74A) per slot-type r4=11..15, ret 1 if this is the scheduled Tx frame; called inside access-permit 0x2DBC74. NOT a received-IA echo [DIS][XREF] [22:51]
0x00110AD8 GU4_CELLSEL_CONFIRMED_CELL  # confirmed serving-cell descriptor ptr; cell-sel completion arms require !=0 && ==[0x110AE0]; LIVE=NULL => sub-FSM 0x2937B4 never returns 0 => 0x56 emit gate never opens. THE decisive missing input [DIS][live-RAM] [11:13]
0x00110AE0 GU4_CELLSEL_TARGET_CELL  # companion cell descriptor ptr (live 0x117844) compared to 0x110AD8 for the acquisition match [DIS][live-RAM] [11:13]
0x002937B4 GU4_RR_CELLSEL_ACTION_FSM  # cell-selection action-code sub-FSM (called r0=0); 9-arm jumptable idx=[0x11166E]; returns 0=>fire 0x56 else keep walking; result cached to [[0x111670]+6] (the emit gate) [DIS][live-RAM] [11:13]
0x002938A0 GU4_RR_CELLSEL_ACTION_ARM4  # action sub-FSM state-4 arm (current live state); completion gates on [0x110AD8]!=0 && ==[0x110AE0]; folds DSP-status [0x110ABE] [DIS][live-RAM] [11:13]
0x00111670 GU4_CELLSEL_WORK_PTR  # ptr to cell-sel work struct (live 0x116854): +1 chan-walk idx, +3 sub-state, +4 list-ready gate, +6 action-code cache (=0x2937B4 return = the 0x56 emit gate; live 4) [DIS][live-RAM] [11:13]
0x0011166C GU4_CELLSEL_SUBFSM_BLOCK  # 0x2937B4 control block: +2 signed-halfword sub-state index (=0x11166E), +4/+8 candidate-record ptrs [DIS] [11:13]
0x0011166E GU4_CELLSEL_SUBFSM_STATE  # cell-sel action sub-FSM state var (=block 0x11166C+2); live 4 = mid-walk not-complete [DIS][live-RAM] [11:13]
0x0022E990 GU4_TASK10_CELLSEL_JUMPTABLE  # task-10 cell-sel state->handler table (idx=[0x111742]): 20->0x232F06, 22->0x232798, 14->0x232D3E, 11->0x2321DA; 29 arms, >0x1C->0x233530 [DATA] [11:13]
0x00232F06 GU4_TASK10_CELLSEL_STATE20  # task-10 cell-sel state-20 handler (live state); gate TCB+4[0x111744]==0x1802, d2m dispatch 0x80/0x87/0x89/0x8A/0x8B; drives caller-B 0x56 emit via 0x2937B4==0 [DIS][live-RAM] [11:13]
0x00232798 GU4_TASK10_CELLSEL_STATE22  # task-10 cell-sel state-22 handler; owns carrier-search emit site 0x2327DA; gate [[0x111670]+6]==0 [DIS] [11:13]
0x00232D3E GU4_TASK10_CELLSEL_STATE14  # task-10 cell-sel state-14 handler; 2nd carrier-search emit path (contains site 0x232ED6->0x289434) [DIS] [11:13]
0x00232ED6 GU4_RR_CARRIER_SEARCH_EMIT_SITE2  # 2nd caller of 0x289434 carrier-search emit (state-14 handler); gate [[0x111670]+6]==0 [DIS][XREF] [11:13]
0x00111744 GU4_TASK10_TCB_MSG_QUALIFIER  # task-10 TCB+4 msg-qualifier half; state-20 body gate ==0x1802 for d2m radio msgs (live 0x3EC) [DIS][live-RAM] [11:13]
0x00110ABC GU4_CARRIER_WALK_INDEX  # carrier/channel walk counter byte (live 1); state-20 arms list-ready [[0x111670]+4]=1 only when ==0 [DIS][INF-semantics] [11:13]
0x00289478 GU4_CARRIER_WALK_ADVANCE  # 0x8A-opcode handler; manages walk index 0x110ABC; clean progress witness via counter 0x11FDC0 (live 6650 = thousands of d2m replies processed => live-locked not deadlocked) [DIS] [11:13]
0x0028958C GU4_CELLSEL_CHAN_CONFIGURE  # per-candidate channel-configure builder/send in the walk (r0=[work+0],r1=[work+1]); sibling 0x2884AA [DIS] [11:13]
0x002932E8 GU4_CELLSEL_CHAN_INDEX_NEXT  # returns next chan-walk index -> [[0x111670]+1]; terminal value 8; sibling 0x293700 [DIS] [11:13]
0x00294728 GU4_RSSI_0x8B_INGEST  # processes d2m 0x8B ALL_RSSI_RESULTS inside state-20 before the action-FSM call [DIS][INF] [11:13]
0x002887C8 GU4_RR_NETSEARCH_EVENT_DISPATCH  # net-search event dispatcher: decodes msg[r4+12] event bitfield, routes to carrier-search entry; search-driver 0x2327DA returns here (LR 0x2887DE). Edge is [DIS]-structure + [INF] on exact binding (no static xref) [DIS][INF] [11:13]
0x0028881A GU4_RR_NETSEARCH_ENTRY_HANDLER  # carrier-search entry arm: decrements retry ctr [0x110ABE], gates on readiness ptrs [0x111674]/[0x111670], bl 0x28874C into search FSM [DIS] [11:13]
0x00111674 GU4_RR_SEARCH_CTRL_PTR  # RR carrier-search control-block ptr (->0x1167C4); search driver reads [+3]==1 before emit. NB sits in the readiness_flag_table region — may fold as an offset [DIS][DATA] [11:13]
0x00289A62 GU4_CELLSEL_SET_CONFIRMED  # THE [0x110AD8] writer: r1==0 => str r0->[0x110AD8] (confirmed:=candidate); r1!=0 => teardown 0x2D4E6C [DIS byte-verified] [11:42]
0x00232088 GU4_CELLSEL_CONFIRM_SITE  # task-10 confirm call (r1=0): [0x110AD8]:=candidate[0x110AC8]; the ONLY store-path caller of 0x289A62 [DIS] [11:42]
0x00289A40 GU4_CELLSEL_TEARDOWN  # zeroes cellsel struct incl [0x110AD8](+0x1C), sets state byte=5 [DIS] [11:42]
0x00288FE4 GU4_CELLSEL_CANDIDATE_SCAN  # scans record-list [0x110AD4] stride16 for [rec+12] bits[19:16]nibble==3 -> sets candidate [0x110AC8], ret 1; else ret 3 [DIS] [11:42]
0x00288EFC GU4_CELLSEL_CAND_FROM_TARGET  # candidate[0x110AC8]:=target[0x110AE0]; stamps [rec+13] [DIS] [11:42]
0x002320AC GU4_SCH_SYNC_PROCESSOR  # state-20 SCH(logch 0x40) consumer; reads [rec+12] nibble, branches on 1/4; bl 0x288856 processes block [DIS] [11:42]
0x00288B70 GU4_CELL_ACQSTATE_WRITER  # writes [rec+12] bits[19:16] acquisition-nibble (5/6/9 by branch); ladder 1->3->4->5->6->9; the SI content driving it is L3-EXTERNAL [DIS][L3-EXTERNAL] [11:42]
0x002C36AC GU4_D2M_SCH_PREPROC  # 0x80 logch preproc: if [+4]==0x60 && ([+16]&0x38)==0x18 rewrite [+4]=0x50 (CCCH->BCCH-on-sync) [DIS] [11:42]
0x002C3B5C GU4_D2M_BCCH_SI_DECODE  # BCCH SI2/3/4 decoder; drives cell-acq nibble; content L3-EXTERNAL [DIS][L3-EXTERNAL] [11:42]
0x00110AC8 GU4_CELLSEL_CANDIDATE_CELL  # cellsel struct+0x0C: candidate cell descriptor ptr; confirm copies this to [0x110AD8] [DIS] [11:42]
0x00289D40 GU4_CELLSEL_STATE2_STAMPER  # list-build loop: strh[rec+6]=id, strb[rec+13] nibble=2 (HARDCODED) on classifier 0x288C5C==1; every measured record => state 2 [DIS 0x289D7C] [12:21]
0x00289BA4 GU4_CELLSEL_REC_INIT_MARKER  # stamps [rec+12]=0xFF,[rec+13]=0xA0 (marker+nibble0) at record create [DIS] [12:21]
0x00288C5C GU4_CELLSEL_CLASSIFIER  # record category switch on 0x2BF214(); reads [0x110ACC] [DIS] [12:21]
0x00110FDE GU4_SI_DECODE_ENABLE  # SI-decode-enable gate: BCCH_SI_FORWARD 0x2C3B8E gates decode call on [0x110FDE]!=0 (0x2C3B94); NEVER WRITTEN in a 40M run -> BCCH SI path never runs. TRUE next-target upstream gate [DIS][never-written] [12:21]
0x00110AC4 GU4_CONFIRM_RECORD_PTR  # confirm-record ptr; input to nibble-3 builder 0x289644 (gate [in+4]==0); sourced from [[0x110AD8]+6] (circular, confirmed cell); NEVER WRITTEN -> nibble-3 never produced [DIS][never-written] [12:21]
0x002D4E10 GU3_NET_STATUS_COMMIT  # commits staged serving-cell rec [0x111484] -> camp-status [0x110F96]=staged[1], cell-id [0x110F90]=staged[8]; frees+clears [00:50]
0x00111484 GU3_NET_STATUS_STAGED  # ptr to 12B staged serving-cell record (staged[1]=camp-status 0x50, staged[8,9]=cell-id ARFCN); flushed by COMMIT 0x2D4E10 [00:50]
0x002C3DCE GU3_D2M_89_COMMIT_CALL  # 0x89 handler [0x11161C]==0 path: calls NET_STATUS_COMMIT 0x2D4E10 -> camp without a pending 0x02 config [00:50]
0x0023CDA6 GU3_MM_MSG_1589_DECODE  # MM msg-id 0x1589 decode -> 0x23D07C state advance; 0x1589 = RR->MM service-available indication (NEVER sent live) [01:09]
0x0023D07C GU3_MM_STATE_ADVANCE  # MM [0x110454]<-[msg+4] + arm timer 241; sole state-word writer; reached only via msg 0x1589 [01:09]
0x00232B2C GU3_TASK10_CAMPED_STATE17  # task-10 camped state-17 handler; consumes d2m 0x83 RSSI_RESULTS (branch 0x232AF8, serving RxLev at [msg+6]->0x2EE70C) [01:09]
0x00292BC8 GU4_L2_SI_DECODER_POST  # task-13 SI decoder: mallocs 44B result, writes 0x3F9, TASK_SEND(10) at 0x292FEC — posts SI-decode-complete to RR (works, live ~14.97M) [07:05]
0x002320AC GU4_RR_STATE20_SCH_WINDOW  # state-20 SCH handler: nibble==4 opens SI-decode window [0x110FDE]=1 + sends msg-13 + arms slot-134(376t) + park-recv 0x2321C2 -> SET_STATE(11). window-open & park inseparable [07:05]
0x00230CC2 GU4_RR_STATE5_3F9_CONSUMER  # state-5 handler: consumes SI-decode-complete 0x3F9 (also state-0 0x22FCD2). task-10 must be HERE not state-11 when 0x3F9 arrives — the camp blocker [07:05]
0x002DBE48 NET_STATUS_STATE_DECODE  # reads [0x111780] result word -> returns net-status STATE 1/2/3/4 (never 0); S=4 iff bit23==0; word=0->S=4 (passes CCCH gate); S=1 needs word=0x89C00000 +[0x11177C]!=0 [10:00]
0x00230568 NET_STATUS_STATE_WRITE_DECODE  # task-10 state-4 pump, msg 0x3F8 path: str decode(0x2DBE48) -> [0x110F8C+0]; gated by [0x111780]!=0 OR camp-status band {0x20-2F,40-43,80-87} (0x50 excluded) [10:00]
0x002305B4 NET_STATUS_STATE_WRITE_CONST4  # task-10 state-4 pump, msg 0x411/0x412/0x41A path: stores CONST 4 to [0x110F8C+0] (opens CCCH). Reached only via state-28 (0x22FFFA) dedicated-chan entry [10:00]
0x002DC2D8 GU3_CELLSEL_MEASWORD_RECOMPUTE  # FSM-facing writer of the 4-byte net-status STATE word [0x111780]; sets bit0 (valid) then calls setter-dispatch 0x2DBF34 + pack 0x2DBFD6; sole FSM caller 0x23052E (msg 0x3F8 state4/5) [10:01]
0x002DBFD6 GU3_CELLSEL_MEASWORD_PACK  # packs the 4-byte STATE word: str 0x2DC006 (bit28), setters set bit31@0x2DC044 (PLMN-match), 2bit@0x2DC068, bit23@0x2DC16C from cell-record + PLMN compares [10:01]
0x002DBF34 GU3_CELLSEL_MEASWORD_SETFIELD  # bit-field setter dispatch into 4-byte STATE word [0x111780]; strb byte0/byte1 bits per measurement getters [10:01]
0x002D9612 GU3_CELLSEL_PLMN_MATCH  # returns 1 iff cell broadcast PLMN == SIM home PLMN; packs SIM IMSI via IMSI_TBCD_TO_PLMN_PACK 0x28F7D4 then 3-byte cmp 0x2D95CC; feeds word bit31 @0x2DC034 [10:01]
0x002D95CC GU3_PLMN_CMP3  # 3-byte MCC+MNC BCD PLMN compare, returns 1 on full match [10:01]
0x00293F1C GU3_CELLSEL_REC16_POPULATE  # alloc(0x2DC318)+fill the 16-byte cell record [0x11177C]; writes byte9 nibble state; FSM callers 0x23205C/0x232156/0x232A80 (states 20/17); fires once live @13.17M [10:01]
0x0020D964 GU2_L1_CHAN_SLOT_ALLOC  # scans 15x4B active-chan table 0x10E204 for free slot byte0==0, memcpy 4B descriptor from 0x10E198; 17 callers all in PHCTRL [11:10]
0x0020D910 GU2_L1_CAMP_ANNOUNCE_ITER  # iterates 0x10E204; per populated record (byte0!=0,byte2!=4,byte1!=arg) bl 0x20D250 publishes 0xA55->0x1589->MM; empty table=no publish [11:10]
0x0020E6EC GU2_L1_STATE_TO_REASON  # maps L1 chan FSM state [0x10E140]+ subbytes -> camp(0xAxx)/release(0x9Cx) reason consumed by PHCTRL install/publish handlers [11:10]
0x0022E650 GU3_TASK10_RR_MAIN  # task-10 (RR) main: struct base [0x111740]; FSM state=signed halfword [0x111742]; dispatch jump-table 0x22E990 (29 states 0..28); [struct+0]=[msg+3]opcode, [struct+4]=[msg+0]msgid [DIS] [dsp-camp]
0x00111742 GU3_TASK10_FSM_STATE  # task-10 RR FSM state (halfword); live trajectory 8->11->17->12->2 then PARKS at state 2 (RACH-sent/await-grant). states: 4=0x2304D8 5=0x230C38 11=0x2321DA 17=0x232B2C 20=0x232F06 28=0x22FFFA [DIS] [dsp-camp]
0x002334E2 GU3_TASK10_STATE2_ACCESS  # task-10 state-2 handler = RACH access wait: handles msgid 0x1802(+opcode 0x84->0x22FB5A), msg 0x400; manages RACHC[13]/[14]; loops 0x2334BE. does NOT consume IA/0x623 directly [DIS] [dsp-camp]
0x002C3A1C GU3_D2M_RXBLK_CCCH  # CCCH(logch 0x60) d2m handler: state-gate reads WORD [0x110F8C] (BE32!) drop iff in{0,3}; [0x110F8F]=+3=word-LSB opens it; computes FN24 [msg+7..9], AGCH-match r6 (FN%51 vs table 0x32E8D8) + outer gate [sp+22]; calls 0x2C36C2(msg,status,agch_flag) [DIS] [dsp-camp]
0x002C36C2 GU3_D2M_RXBLK_SDCCH_CCCH_L3  # re-tags [msg]=0x0623, [msg+11]=logchan [msg+12]=status [msg+13]=agch_flag; finalize 0x2C2D3A; TASK_SEND(11,msg). Funnels BOTH CCCH-L3(from 0x2C3A1C) and SDCCH into task-11 [DIS] [dsp-camp]
0x0032E8D8 GU3_CCCH_SCHED_TABLE  # control-channel schedule: CCCH block end-frames {09 0f 13 19 1d 23 27 2d 31}={9,15,19,25,29,35,39,45,49}; indexed by block+BS_AG_BLKS_RES for AGCH-match in 0x2C3ACC [DIS][DATA] [dsp-camp]
0x0022FB5A GU3_TASK10_STATE2_RACH_RETX  # state-2 RACH retransmit handler (msgid 0x1802+opcode 0x84): access-permit gate 0x2DBC74; if [0x110F8C]word==3 skip; process RA_INFO via 0x2DB904; cmp RACHC[12](retrycnt) vs max(0x2E1D0A) -> retransmit 0x2DBA32 (RACHC[12]++) or arm backoff timer 142. Live: retransmits @22M/108M/173M (T3126 backoff), never advances [DIS] [dsp-camp]
0x002DB904 GU3_RACH_RAINFO_TO_REQREF  # processes RA_INFO frame: reads TX-frame [msg+5..7]->RACHC[8] (24-bit), then builds msgid-0x803 with expected Request-Reference: [+5]=T1'=(frame/1326)&0x1F, [+6]=T3=frame%51, [+7]=T2=frame%26. THE expected IA request-ref source. Live RACHC[8]=0 (frame 0) [DIS] [dsp-camp]
0x002EFA84 GU_UDIV32  # unsigned divmod: returns REMAINDER in r0, QUOTIENT in r1 (verified via 0x2DB904/0x2C3A98 usage) [DIS] [dsp-camp]
0x002301A2 GU3_TASK10_STATE2_BODY  # state-2 non-0x400 body: advances to 0x22FF4E (RACH-ABORT/reselect: cancels timer142, frees RACHC 0x2DBF1C) when msg 0x3F8 AND ([0x111780]!=0 OR camp-status [0x110F96] in {[0x20,30),[0x40,44),[0x80,88)}); also handles 0x1802/0x89->RACHC[13], 0x3FF, 0x402, 0x411. NOT the progress-to-dedicated path [DIS] [dsp-camp]
0x00110F8C GU3_NET_STATUS_STATE_WORD  # net-status STATE read as BE32 WORD by CCCH gate 0x2C3A24 (drop iff word in {0,3}); byte +3 (0x110F8F)=word LSB. Live=1 under WIP (CCCH gate OPEN) — supersedes 'dead at 0' ceiling note; WIP advanced it [DIS] [dsp-camp]
# BLOCKER (2026-07-22 session): task-10 reaches state-2 RACH-access loop (past state-11 ceiling), fires real RACH (0x0C RA=0x16). Our IA (0x80 CCCH AGCH, gate OPEN) reaches task-11 msg-0x623 but produces NO state-2-advance primitive back to task-10 -> parks/retransmits; install 0x20D964 + table 0x10E204 never written; MM 0x110454 stuck. AGCH-residue alignment (ROM6NEW_IARES sweep incl 200M) insufficient. OPEN: the task-11 0x623 IA-parse -> task-10 acceptance-primitive (0x400/0x1802-0x89) link.
0x00260A4C GU2_RR_TASK11_MAIN  # task-11 RR main, registers RTOS id 11 @0x260B64; FSM table 0x260B94 [20:16]
0x002604A4 GU2_RR_T11_MSG_DISPATCH  # task-11 per-msg dispatcher (TASK_RECV+parse+forward), from state-8 loop 0x262316 [20:16]
0x0026054E GU2_RR_IA_0623_HANDLER  # task-11 msg 0x623 handler (CCCH block incl IMMEDIATE ASSIGNMENT) [20:16]
0x00260178 GU2_RR_LOGCH_CLASSIFIER  # classifies by [msg+11] logch; CCCH 0x60 -> class 0 [20:16]
0x002601D4 GU2_RR_L2L3_PARSER  # task-11 L2/L3 parser; CCCH branch 0x26044C validates [msg+14] pseudo-len EL=1/M=0/len1..22 -> 0x61A [20:16]
0x00251228 GU2_L2_TASK13_MAIN  # task-13 L2 main; consumes fwd msg 0x5EB from task-11, produces NO task-10 primitive (dead-end seam) [20:16]
0x0025FFF2 GU2_RR_FWD_L3_TASK13  # task-11 forwards 22-byte L3 to task-13 as msg 0x5EB [20:16]
0x0025FFF2 GU2_RR_RELAY_TASK13  # msgid dispatcher; mallocs msg, copies L3, TASK_SEND_TYPED(task 13) @0x260172; 0x5EB arm=0x26009C [21:06]
0x0026009C GU2_RR_0X5EB_CCCH_ARM  # 0x5EB relay arm; discriminates [blk+0x164] logch {0x40/50/60/A0}, copies 22B L3 into task-13 msg (msgid 0x5EB preserved) [21:06]
0x0025FFF2 GU2_RR_T11_FWD_PRIM  # task-11 fwd helper: allocs node, id=r0, dispatches; 0x5EB/0x5EC cases -> TASK_SEND(13). 0x5EB DEAD (no task-13 handler); 0x5EC handler 0x2532D4 ingests L3->RR struct 0x10D948->arms 0x401 [21:26]
0x002532D4 GU2_L2_T13_PRIM_5EC_HANDLER  # task-13 0x5EC handler: copies L3 [msg+14..21]->RR ctx 0x10D948, arms prim 0x401 via 0x2A603C, awaits 0x7FE (connection setup). THE IA-accept path; 0x5EB has NO handler (dropped) [21:26]
0x0010D948 GU2_L2_T13_RR_CTX  # task-13 RR connection context struct; 0x5EC handler copies downlink L3 body here [21:26]
0x000100DC GU2_MDISND_SHORTMDI_CMD  # short-MDI/MDISND cmd word; firmware sends short DSP cmds gated [0x100DC]==0; real DSP clears on accept (ROM6NEW now clears; was wedging 0x08/0x10 post-RACH) [21:26]
0x002C39A0 GU3_D2M_AGCH_DSC_COUNTER  # AGCH downlink-signalling counter, called from 0x2C3ADE when camp-status[0x110F96]==0x1A AND agch_flag(r6)==1; inc on status==0, dec 4 else; on depletion TASK_SEND(10, template 0x32E8C4 msgid=0x412). Our blocks never satisfy the gate (0x2C39A0=0 hits over 200M, any IARES) [21:41]
0x0032E8C4 GU3_TASK10_ADVANCE_TEMPLATE  # flash template posted to task-10 by 0x2C39A0: [04 11 00 00 04 12 00 00 04 0F 00 00] msgid[+4]=0x412 (state-2/4 advance primitives 0x411/0x412/0x40F) [21:41]
0x002C3AD4 GU3_CCCH_AGCH_ACCEPT_GATE  # CCCH demux 0x2C3A1C gate: if camp-status[0x110F96]==0x1A && agch_flag(r6) -> 0x2C39A0 (posts 0x412 advance to task-10). agch_flag set at 0x2C3AD0 iff FN%51==schedule[idx] (0x32E8D8, idx=[sp+21]+((0x10E8D8[0]>>3)&7)). THE seam: our IA never trips this [21:41]
0x002C3A1C GU2_CCCH_DEMUX_0x60  # op80 logch0x60 CCCH demux: r5=arg1=[msg+6] status (NOT block class); r5==1->0x2C3B20 HEAP_FREE; else funnel 0x2C36C2. r6=FN%51 AGCH/PCH match (sched 0x32E8D8) [22:10]
0x002C36C2 GU2_CCCH_FUNNEL_TO_623  # tags msg id 0x623, [msg11]=logch [msg12]=arg1 [msg13]=agch-flag, TASK_SEND task11. Reached by BOTH CCCH(0x60 via demux) and SDCCH(0x80) [22:10]
0x0026054E GU2_TASK11_0x623_PAGING_HANDLER  # task11 CCCH-block handler: classifierA 0x260178 + classifierB 0x2601D4; only ever forwards 0x5EB (gated classifierB==0x61A). NO path to 0x5EC [22:10]
0x0025FFF2 GU2_RR_L3_FORWARD  # forward(id r0,src r1): 0x5EB->0x26009C(paging build)->task13; 0x5EC/0x5ED->0x260166->task13; 0x620/0x621->task16 [22:10]
0x002532D4 GU2_TASK13_0x5EC_IMMASSIGN_ACCEPT  # task13 IMM-ASSIGN accept: loads [msg+14..21] chan-desc into RR ctx 0x10D948, arms prim 0x401 (dedicated setup). Reached only via msg 0x5EC [22:10]
0x002610A4 GU2_TASK11_RR_FSM_EMIT_5EC  # ONLY emitter of 0x5EC: RR connection FSM; gated predicate 0x260726==0 (RR ctx state [0x13E+ctx]==0x611 AND [ctx+21]!=1 AND [0x13C+ctx]!=0). NOT fed by CCCH 0x623 path [22:10]
0x00260726 GU2_RR_5EC_GATE_PRED  # predicate for 0x5EC emit: returns 0 when RR ctx state==0x611 (imm-assign-pending) etc [22:10]
0x0025FE30 GU2_RR_CONNMSG_CLASSIFIER  # task11 DEFAULT-handler classifier (non-0x623 msgs): yields RR conn states incl 0x611; drives RR connection FSM 0x2610xx that emits 0x5EC. Refs 0x611 @0x25fe14/28 [22:12]
0x0025FA0A GU2_RR_EST_BUILDER_ARM_611  # RR conn-est builder: sends msg 0x425, arms conn-state 0x611 @0x25FB30 (strh 0x611,[0x13E+ctx], ctx=0x10BB90, state var 0x10BCCE). Switch on prior state 0x60F. NOT DSP-driven [22:24]
0x0025FB30 GU2_RR_STATE_611_WRITER  # the strh that arms RR imm-assign-wait state 0x611; runtime 0 hits (never armed) [22:24]
0x0025FB64 GU2_RR_CONN_FSM_TICK  # RR connection FSM tick (12 task-11 callers); dispatches on conn-state 0x10BCCE; calls est-builder 0x25FA0A at 0x25FC0A/8E only when state advances [22:24]
0x0023D37C GU3_MM_IDLE_STATE_GUARD  # MM idle guard (every MM loop): EARLY-RETURNS when MM state [0x110454] in {5,7,10}; only runs LU-init logic (0x2B6BA2/0x2B7246) when MM has left searching. Does NOT move MM out of 10 [22:26]
0x0023D6BE GU3_MM_STATE10_ARM  # MM state-10/7 dispatch arm: passive (trace + re-poll). MM leaves 10 only on an incoming camp/service indication via dispatch 0x23DE76 [22:26]
0x0023D080 MM_STATE_STORE  # MM state [0x110454] store PC (sites 0x23CA76/0x23D080/0x23D4FC; NOT single 0x23D07C) [00:21]
0x00278538 SVC_IND_1589_PRODUCER  # produces msg 0x1589 service/camp-available from L1 camp-ids 0xA55-0xA88; fires 0x if firmware never camps [00:21]
0x002785E2 EMIT_MPH_SERVICE_IND_1589  # unconditionally sends msg 0x1589 to task15 MM once entered; gate is at caller 0x20D59E [00:55]
0x0020D250 L1_CAMP_EVENT_HANDLER  # task handler r0=msgid r1=ptr; L1 event family 0xA55/0xA62/0xA63; A62/A63 reach 1589 emit [00:55]
0x0020D1DC ACTIVE_CHAN_DEDICATED_PROBE  # scans 0x10E204[15x4] for byte1==0x1F&&byte3==0x2A; ret1 SUPPRESSES 0x1589 (inverted dep) [00:55]
0x0020F876 L1SM_RAISE_A62  # L1 cell-sel SM raises camp event 0xA62 when [r4+7]==0 [00:55]
0x0020FECA L1SM_RAISE_A63  # L1 cell-sel SM raises camp event 0xA63 when [r4+7]==0; SM state [r4+0] cmp 0x3E @0x20FE48 [00:55]
0x0020ECE4 CELL_SELECT_COMPLETE  # sets [0x10E14C]=1, emits 0x158D; sole caller 0x2101CE gated by 5B memcmp [0x10E1B8]vs[0x10E2A0] [01:05]
0x0010E1B8 GU2_L1_SERVING_CELL_PARAMS  # 5-byte serving-cell param block; ALL-ZERO=no cell selected; writers 0x20EBB0/0x20CD1A/0x20CD1E; camp needs this populated [01:05]
0x00288CC4 CANDIDATE_ENROLL  # commits a measured cell into candidate list ONLY when [0x110F8C]==1 (gate 0x288CE2); live 0 -> list current-ptr [0x110AD8] stays NULL [01:29]
0x00110F8C GU3_NET_STATUS_ENROLL_GATE  # GU3_NET_STATUS_STRUCT[0]; ==1 gates candidate enrollment 0x288CC4; writer 0x2305B4; live 0 = camp wall [01:29]
0x00110AD8 GU3_CANDIDATE_CURRENT_PTR  # candidate-list valid/current pointer; NULL=list logically empty though buffer 0x116944 holds ARFCN586; reset by 0x232C16 [01:29]
0x0020ECE4 CELL_SELECT_FINALIZE  # sets [0x10E14C]=1 emits 0x158D; from dispatcher 0x2101CE; needs L1 handed a selected cell (never happens) [01:29]
0x00286AD2 GU2_NET_REG_COORDINATOR  # dispatches on disposition [0x10EB24]; no-op when 0; registers when bits[11:8] in {1,4,8} [08:57]
0x002872B0 GU2_NET_REG_DECISION_SET  # writes [0x10EB24] disposition (0x181/0x281); dormant post-camp; callers 0x2440E6/0x29E1FC [08:57]
0x002440E6 GU2_LOC_TASK2_REG_TRIGGER_ARM  # LOC task-2 jump-table arm -> 0x2872B0; needs PLMN-selection-result inbound msg (0x2440DE arm) — THE missing trigger [08:57]
0x0010EB24 GU2_NET_REG_DISPOSITION  # SIMLOCK_CTRL+0xC; ==0 -> reg coordinator no-ops; the dormant reg-decision word [08:57]
0x002A3A00 GU2_MM_REG_PROC_FSM  # registration-procedure dispatcher; jump table indexed by [0x11FF1F]-2 (states 2..32); [0x11FF1F]=GU2_MM_REGISTERED_FLAG is a multi-value reg-proc state, not a bool [10:03]
0x002A39C0 GU2_MM_REG_DEREGISTER  # reg failure/release path: on XBUS send ok, reg-phase[0x11FF1E]=2, reg-flag[0x11FF1F]=0 (clears registered) [10:03]
0x00243D0E GU_LOC_DSPOPS_BIT0_GATE  # FBUS_F40 gate: ldrb[0x11FEAC+105]=[0x11FF15], lsr#1, bit0 clear -> drop opcode at 0x2441B4; gates ALL LOC-task DSP-ops incl register opcode 0x81. Live verdict=0x48 bit0=0. NO runtime writer sets bit0 (boot/init provisioned) [10:03]
0x002A3A00 MM_LU_FSM  # MM location-updating procedure FSM; reads [0x11FF1F]-2 cmp #30 jumptable (states 2..32); default(0/1)=0x2A3AB2 clears+exits (never self-starts); callers 0x2A3F8E,0x2A480E [10:24]
0x002A3CF8 MM_PRIMITIVE_HANDLER  # MM primitive switch on [r5+8] event code; called from TASK_2_LOC 0x244594 when LOC ctrlblock [r6+0]!=0; drives MM_LU_FSM [10:24]
0x002872B0 REG_DISPOSITION_WRITER  # writes registration disposition [0x10EB24]=SIMLOCK_CTRL+0xC; r0==0->0x281 else computes from SIM-lock decoded rec 0x10EB48; callers 0x2440E6(LOC arm),0x29E1FC [10:24]
0x002440E6 LOC_ARM_REG_TRIGGER  # LOC submsg case: mov r0#1;r1=[r5+10];r2=&[r5+11]; bl REG_DISPOSITION_WRITER 0x2872B0 - the START of the reg-disposition chain [10:24]
0x0010EB24 GU2_REG_DISPOSITION  # registration disposition halfword = SIMLOCK_CTRL+0xC; coordinator 0x286AD2 gates on bits[8..11]; live=0=idle; writer 0x2872B0 [10:24]
0x00286A66 SIMLOCK_REC_AUX_EQ3_GATE  # cmp REC_AUX[0x10EB2C+r4]==3 selects SIM-lock record serialize path feeding reg-disposition; live REC_AUX=0x01 -> not-accepted branch [10:24]
0x002880C8 GU2_SIML_DECODE_FINALIZE_LOOP  # decoder r6==0 steady-state: 0x28810A rewrites CTRL+1=1 (deadlock pin); escape at 0x288112 needs CTRL+7==1 -> 0x28816E sets CTRL+1=2 + sends 0x70/0x16 next block [10:42]
0x00287FEC GU2_SIML_REC_AUX_WRITE1  # writes REC_AUX(0x10EB2C)=1 when record[+17]&0x30==0; sibling 0x287FFC sets CTRL+11(0x10EB23)=1 when status[+17]&0x30!=0 [10:42]
0x00287C82 GU2_SIML_REC_AUX_WRITE3  # writes REC_AUX=3 (coordinator-required); gated CTRL+11!=0 (0x287C60) AND r6!=0 (0x287C76); r6 forced 0 by CTRL+1==1 (0x287C18) [10:42]
0x00286AD2 GU2_SIMLOCK_DISPOSITION_COORD  # reads GONOGO[0x10EB24] nibble[8:11]; 0=no-op(live); 0x100/0x200/0x400/0x800 -> REC_SERIALIZE/dispatch. Event-driven status reporter, r0=reason [10:42]
0x00287B36 GU2_SIML_TABLE_RESET  # memset-clears decoded table 0x10EB48 (0xEE/0xFF/0x00) on overflow [10:42]
0x0020FFD2 CELLSEL_SERVING_IDENTITY_MEMCPY  # copies 8B 0x10E2A0-real-cell into 0x10E1B8 gated prim0x4E and 0x10E166==3 [11:24]
0x00210EC8 CELLSEL_SUBSTATE_SET3_A  # sets 0x10E166=3 on prim0xA04 needs chanstate 0x10E159==0 [11:24]
0x0021281C CELLSEL_SUBSTATE_SET1  # sets 0x10E166=1 on prim0xA0A step33M [11:24]
0x0020FD8C CELLSEL_CHANSTATE_PIN1  # state0x3E handler pins 0x10E159 chanstate=1 [11:24]
0x002100D6 CELLSEL_COMPLETE_GATE_E150  # gate 0x10E150==6 plus prim0x61 to reach 0x20ECE4 [11:24]
0x002130E6 CELLSEL_158D_EMIT_PLACEHOLDER  # emits 0x158D via 0x20CD12 placeholder-B8 path camp [11:24]
0x00210192 CELLSEL_MEMCMP_B8_A0_5B  # 5B memcmp both outcomes call 0x20ECE4 NOT the gate [11:24]
0x002131BE CELLSEL_CHANSTATE_SET3_COMMIT  # sets 0x10E159=3 then commits 0x10E2A0 select-arm never runs [11:24]
0x00215800 GU2_SIM_EF_READ_DISPATCH  # SIM EF read-response dispatcher keyed on EF file-id (r6=0x6F07/0x6F38/0x6F3E/0x6F7E...); calls per-EF parser; 0x6F7E(EF_LOCI) branch -> GU3_SIM_LOCI_PARSE 0x2162B6 [DIS] [18:33]
0x0020DB44 GU2_L1_CHANSTATE_LOCI_COMMIT  # chan-state[0x10E159] commit/refresh: if [0x10E159]==2 writes 3(0x20DB5C) then 2(0x20DB68) + EF_LOCI SIM-sync 0x28EE94; if !=2 just syncs, LEAVES chan-state unchanged. The ONLY value-2/3 writer of chan-state and it is self-gated on already==2 -> cannot bootstrap 1->2. Reached from L1 search LR=0x2149D1 (steps 23M,89M) but always no-op path [DIS][DYN] [18:33]
0x0028EE94 GU2_SIM_LOCI_STATUS_SYNC  # EF_LOCI LU-status writeback-sync helper: r0=&statusbyte; if [0x10A824]!=*r0 mark EF_LOCI dirty [0x10A5E4]|=0x20 + arm SIM update 0x2BA25A; toggles SIM ctrl [0x02000C]. Callers 0x20DB54/62 (chan-state commit) [DIS] [18:33]
0x0028F698 GU2_SIM_LOCI_STATUS_GET  # SIM-cache getter: reads EF_LOCI LU-status [0x10A824] into caller buf [r4+0], gated on SIM-cache-valid bit [0x10A5DE] bit9; part of 0x2E8138-dispatched SIM field accessor set (handle 0x4C13). The [0x10A824]->[0x10E159] init copy path [DIS] [18:33]
0x002162D8 GU3_LOCI_STATUS_STORE_VAR  # EF_LOCI parser: [0x10A824]=record[+10] (raw GSM LU-status). This is the ONLY variable-source writer; clamped downstream [18:34]
0x00216312 GU3_LOCI_STATUS_CLAMP1_VALIDLAI  # EF_LOCI parser: forces [0x10A824]=1 when stored LAI BCD-valid AND raw status!=0 (nonzero->not-updated); appends FFFE marker [18:34]
0x0021632A GU3_LOCI_STATUS_CLAMP1_BADLAI  # EF_LOCI parser: forces [0x10A824]=1 on BCD-invalid stored LAI (loads default LAI 0x32CB08). Together with 0x216312 proves [0x10A824] in {0,1} ONLY - can never be 2/3 [18:34]
0x0010E158 GU2_L1_CELLSEL_CTRL_BLOCK  # r4 base of L1 cell-sel SM; +0=SM state(cmp 0x3E @0x20FE48), +1=chan-state=[0x10E159], +7=on-chan flag, +14=sub-state=[0x10E166], +18=[0x10E16A]. Live camped: +0=0x3E +1=1 +7=0 +14=1 +18=0 [18:42]
0x00210EAA CELLSEL_A04_CHANSTATE_GATE  # ldrb [r4,#1];cmp #0;bne 0x210EE4 — chan-state([0x10E159])==0 gate GUARDING the 0xA04 sub-state-3 store 0x210EC8. Settles conflict: 0x210EC8 DOES gate on chan-state (NOT a red herring) [18:42]
0x0028F6B2 GU2_SIM_CHANSTATE_SET1  # the ONLY chan-state writer that fires live: strb [0x10A824]=1 -> [0x10E159] at step 22.95M, gated [0x10A5DE] bit9. chan-state pinned 1, never advances to 2/3 (success writers 0x2131BE/0x20DB5C never run) [18:42]
0x0010E138 GU2_L1_CELLSEL_CTRL_BLOCK_R5  # r5 base companion to L1 cell-sel SM (r4=0x10E158); +4,+10,+19,+23,+27 fields; +10=[0x10E142] dispatch key cmp 4 [18:42]
0x00253020 GU2_L1_EVT_0xA04_PRODUCER  # sole producer of L1 event 0xA04 (0xA03 if [0x10E16F]!=0); sends via router 0x2A6564 r2=payload; in task-13/RR dedicated-chan-establish SM; reached only after [r4+7]=3->4 seq + queue-scan 0x2A6710==0x5E6; NEVER runs at idle camp (RR never establishes); WATCH 0x253020 = 0x hits/150M; NO measurement dependency [19:32]
0x002A6564 GU2_L1_EVT_ROUTER  # L1 event router: r0=id r1=buf(0=malloc20) r2=payload r3=byte; stores id[+0],r3[+2]; dispatches by id range to task; used to post 0xA04/0xA05/0xA03 [19:32]
0x002D4314 GU2_L1_STORED_CELL_LAI_MATCH  # select-arm compare for sub-state=3 writer 0x21258E path: 5B memcmp decoded LAI 0x10E2A0 vs stored-cell block 0x10FA00[+4]; identity match NOT RxLev threshold [19:32]
0x0010F9DC CELLDB_STRUCT_BASE  # L1 known-cell/BA reselection-cache struct: header 0x10F9DC + twin 84B entry-tables A=0x10FA00 / B=0x10FA54 (10x8B entries, [+1]=validity,[+4..8]=5B LAI,[+9]=refcount); task-15 mutex [19:51]
0x0010FA00 CELLDB_TABLE_A  # stored-cell/known-cell table A (10x8B). LIVE ALL-ZERO at camp: never installed. Searched by CELLDB_SEARCH_BY_LAI 0x2D4314 selector r0=1 [19:51]
0x0010FA54 CELLDB_TABLE_B  # stored-cell table B twin (selector r0=0). Also all-zero at camp [19:51]
0x002D4118 CELLDB_TABLE_CLEAR  # zeroes a cell-table (r0=sel). Runtime: fires @6.4M boot both selectors -> tables start empty. Never re-filled [19:51]
0x002D4314 CELLDB_SEARCH_BY_LAI  # search cell-table for 5B LAI (r0=sel,r1=LAI ptr). early-ret0 if [table+1]==0 (empty). Runtime @22.95M called w/ decoded LAI 0x10E2A0 from 0x211DDE -> NOT FOUND (empty). THIS is the arming compare [19:51]
0x002D415C CELLDB_REMOVE_BY_LAI  # remove entry matching 5B LAI (memcmp 0x2EFEBC len5 @entry+4), decrement refcounts [19:51]
0x002D3D7C CELLDB_SET_PRESENT_FLAG  # write byte r0 to [tableA+0]&[tableB+0] then publish event 0x4B1F via 0x2CB24C. Runtime: called once @22.95M w/ r0=0 (clears flag), never w/ install [19:51]
0x00211DDE CELLSEL_KNOWNCELL_LOOKUP  # cell-sel FSM arming site: searches BOTH cell-tables (0x2D4314) for decoded serving LAI 0x10E2A0. FOUND->camp fast-path (timer148 @0x211E82/EAE); NOT-FOUND(empty)->chan-state[0x10E159] gate then first-acquire 0x212682 [19:51]
0x00212682 CELLSEL_FIRST_ACQUIRE  # first-acquisition configure (table-miss path). Gated: 0x2126EC chan-state[0x10E159]!=0 -> skips fresh-configure. Our fw: chan-state=1 -> blocked here too [19:51]
0x00213040 CELLSEL_CHANCFG_DISPATCH  # task-10 cell-sel sub-dispatch, keys on r0 (FSM event/sub-state): r0==12->chanstate=3 writer 0x21315E; r0==11->0x213120. Sibling gates 0x213090([r5+10]<4) 0x213096(chan-state[0x10E159]==0). r0 is internal FSM code, NOT a raw d2m field [19:53]
0x0021315E CHANSTATE3_WRITER_A  # sets chan-state[0x10E159]=3 (r0==12 dispatch case). Then searches cell-table (0x2D4314) w/ decoded LAI 0x10E2A0; if NOT found sets install-flag r11=1 -> THIS is the 0x10FA00 install-trigger point. Never reached at camp (chan-state stuck 1) [19:53]
0x002131BE CHANSTATE3_WRITER_B  # 2nd chan-state=3 writer (sibling dispatch case). Same pattern: chan-state=3 -> 0x2D4314 search -> install-flag if miss. Never fires at camp [19:53]
0x002321DB CELLSEL_STALL_VERDICT_MARKER  # DYNAMIC VERDICT (45M camp): dispatcher 0x213040 = 0 hits (chan-state=3 path never entered -> 0x10FA00 install never triggered). State-11 0x89 handler 0x2321DA DOES run 4x @~13M (msgid 0x1802, r0=4) during search burst but NOT post-camp. Stall = task-10 FSM never advances state-11->chan-cfg-confirm(event r0=12) despite consuming our 0x89. MCU-internal transition gate, NOT DSP-suppliable content [19:54]
0x002D4D28 GU3_CAMP_STATUS_MAPPER  # maps cell-sel phase E0[0x11147C] -> camp-status byte: E0=2->0x1A, E0=3->0x10, E0 in{0,1,4}->table[0x32EAD4+idx]=0x10..0x18; used by builder 0x2D4E6C [20:20]
0x0011147C GU3_CELLSEL_PHASE_E0  # cell-selection phase var driving GU3_CAMP_STATUS_MAPPER; transitioned by 0x2D4F90(kind,target); shadow-prev in [0x111478] [20:20]
0x002D4F90 GU3_CELLSEL_PHASE_TRANS  # E0-phase transition fn(r0=kind1/2/3, r1=target); kind1:E0:=target,DC:=oldE0; clamps target=4 if stored-cell predicate 0x28F74A==0 & target!=3; 16 RR/MM callers [20:20]
0x00289B1E GU3_NET_DECLARE_CAMPED_0x50  # network-sel: store serving-cell rec ptr to [0x110AD8] + stage camp-status=0x50 (via 0x2D50C2); called from RR-FSM 0x232196; the camped-stable declaration [20:20]
0x002D50C2 GU3_NET_STAGE_CAMP_0x50  # builds 24B status rec with byte[1]=0x50 hardcoded, COMMITs; the only 0x50 source [20:20]
0x002B40C8 GU3_NET_DECLARE_LIMITED_0x1A  # stages camp-status=0x1A (limited svc) via 0x2D5144; called only from RR 0x230C0A [20:20]
0x002D5144 GU3_NET_STAGE_CAMP_0x1A  # builds status rec byte[1]=0x1A hardcoded, COMMITs; a 0x1A source [20:20]
0x00289A62 GU3_NET_CELLSEL_INPROGRESS  # network-sel in-progress: stores serving rec [0x110AD8], stages mapper camp-status via builder 0x2D4E6C; RR churn callers 0x232088/a24/ce6 - OVERWRITES 0x50 [20:20]
0x0028F74A GU3_STORED_CELL_PREDICATE  # returns 1 iff stored-PLMN flag [0x10A5DE] bit10 set (copies 12B PLMN/LAI rec); gates E0 target clamp in 0x2D4F90 [20:20]
0x002DB904 GU3_D2M_RA_INFO_0x84_HANDLER  # d2m 0x84 RA_INFO -> broker msg 0x803: fn=(pl[1]<<16|pl[2]<<8|pl[3]) stored [0x111858]->[8]; msg[5]=(fn/1326)&0x1F T1' [6]=fn%51 T3 [7]=fn%26 T2 [8]=RA; TASK_SEND_TYPED(13) [DIS] [19:48]
0x0022FB7E GU3_TASK10_RA_INFO_CALL  # task-10 call site into GU3_D2M_RA_INFO_0x84_HANDLER (sole bl) [DIS] [19:48]
0x002A67DC GU3_RR_REQUEST_REF_RECORD  # RR (task 13) msg-0x803 arm: idx=(state[2]+1)%3; writes RACH_REQUEST_REF_TABLE entry {valid=1,RA,T1',T3,T2,matched=0} @0x2A67FE — the firmware's OWN request-reference writer [DIS] [19:48]
0x0027AF80 GU3_RR_REQUEST_REF_MATCH  # RR matcher: walks 3 RACH_REQUEST_REF_TABLE entries vs the Immediate Assignment Request Reference IE, sets entry[5]=matched @0x27AFAC [DIS] [19:48]
0x00111584 RACH_REQUEST_REF_TABLE  # 3x8B RACH request-reference table {valid,RA,T1',T3,T2,matched}; written by GU3_RR_REQUEST_REF_RECORD, matched by GU3_RR_REQUEST_REF_MATCH, cleared by RR memsets 0x251C20/0x2523EA/... [DATA][DIS] [19:48]
0x00111858 GU3_DSP_RADIO_STATE_PTR  # ptr to the DSP-interface radio state struct used by the d2m 0x84/0x802/0x803 builders; [8]=last RA_INFO absolute FN, [1]=RA mask shift, [2]=channel tag [DIS] [19:48]
