# Firmware 9.60 probe transfer and one-time execution package

Status: **BLOCKED — do not transfer and do not execute**.

This is the separate review package requested after the offline build. It is
not an authorization request because the current artifact cannot satisfy the
project's no-kernel-change boundary.

## Bound artifact

- Filename:
  `chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf`
- SHA-256:
  `4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63`
- Size: 110424 bytes
- Source commit: `ba8f6a40cf37dff628254caa9b11d83a73957cf8`
- Firmware build gate: exact `9.60`
- Manifest: `manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json`
- Offline evidence: `docs/evidence/probe-9.60-offline-2026-07-17.md`
- Transfer / execution recorded: false / false
- Execution eligible: false
- Permanent denylist: `manifests/artifact-denylist.json`

## Intended one-time project action

If a future replacement artifact closes every blocker, the first action would
be a single manual, foreground capability probe with application arguments:

```text
--firmware 9.60 --acknowledge-read-only-probe
```

Project code would open the candidate GNM module, perform exactly 21 `dlsym`
lookups, log names plus booleans, call none of the returned addresses, and
attempt `dlclose`. It would request no VideoOut, framebuffer, GNM command,
draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation.
There would be no retry or automatic boot path.

## APIs and side effects under review

Project path: `strcmp`, `chimera_gfx_firmware_gate_allows`,
`chimera_gfx_ps5_make_loader_ops`, `chimera_gfx_ps5_probe_symbols`, `dlopen`,
`open_module`, `dlerror`, `resolve_symbol`, `dlsym`, `log_line`, `snprintf`,
`write_log`, `fprintf`/`fwrite`, `close_module`, `dlclose`, and
`chimera_gfx_status_string`.

Pinned SDK transitive path includes `__patch_init`, kernel credential and
syscall-permission writes, rtld initialization, possible
`sceKernelLoadStartModule` calls, SDK kernel reads while inspecting module
metadata, and possible `sceKernelStopUnloadModule` during cleanup. The complete
audited path is in the evidence document.

## Blocking findings

1. SDK v0.41 performs kernel process-state writes before `main`. The firmware
   gate cannot prevent them.
2. No bounded/cancellable loader API or safe external supervisor has been
   proven. A hang can prevent cleanup.
3. Module start/stop internals on firmware 9.60 are unknown.
4. The gate trusts a supplied string and does not attest firmware.
5. Runtime delivery of the required four arguments has not been observed.

Likely failure outcomes range from a clean refusal or loader error to a payload
crash, persistent loaded-module/process state, or a console restart. GPU/display
effects are not requested, but driver-internal effects cannot be ruled out.

## Timeout, cleanup, and recovery status

No safe timeout or forced-cancellation procedure exists for this artifact.
Normal cleanup attempts `dlclose`; crash/hang cleanup and CRT kernel-state
restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or
recovery procedure is approved.

## Approval checklist

- [x] Offline artifact hash and source commit recorded
- [x] Full imports and call chain audited
- [x] VideoOut/Phase-1 excluded from the build
- [ ] Public, kernelwrite-free startup/loader path proven
- [ ] Replacement artifact built and newly hashed
- [ ] Firmware attestation and argument delivery proven
- [ ] Bounded timeout and cleanup/recovery proven
- [ ] New artifact-specific transfer approval
- [ ] New artifact-specific one-time execution approval

## Permission text

There is deliberately **no valid permission text for this hash**. Generic or
future approval must not be interpreted as authorization for it. After the
blockers are closed, a newly named and newly hashed replacement needs a new
package and an exact permission sentence that names that replacement hash.

ADR-0009 makes this hash permanently ineligible; closing future startup
blockers cannot rehabilitate these bytes.