Firmware 9.60 probe transfer and one-time execution package

Status: BLOCKED — do not transfer and do not execute.

This is the separate review package requested after the offline build. It is not an authorization request because the current artifact cannot satisfy the project's no-kernel-change boundary.

Bound artifact

Filename: chimera-gfx-capability-probe-0.1.0-fw-9.60-offline-audit-only.elf
SHA-256: 4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63
Size: 110424 bytes
Source commit: ba8f6a40cf37dff628254caa9b11d83a73957cf8
Firmware build gate: exact 9.60
Manifest: manifests/artifacts/chimera-gfx-capability-probe-0.1.0-fw-9.60.json
Offline evidence: docs/evidence/probe-9.60-offline-2026-07-17.md
Transfer / execution recorded: false / false
Execution eligible: false
Permanent denylist: manifests/artifact-denylist.json

Intended one-time project action

If a future replacement artifact closes every blocker, the first action would be a single manual, foreground capability probe with application arguments:

--firmware 9.60 --acknowledge-read-only-probe

Project code would open the candidate GNM module, perform exactly 21 dlsym lookups, log names plus booleans, call none of the returned addresses, and attempt dlclose. It would request no VideoOut, framebuffer, GNM command, draw, dispatch, submit, flip, GPU-memory mutation, MMIO, or register operation. There would be no retry or automatic boot path.

APIs and side effects under review

Project path: strcmp, chimera_gfx_firmware_gate_allows, chimera_gfx_ps5_make_loader_ops, chimera_gfx_ps5_probe_symbols, dlopen, open_module, dlerror, resolve_symbol, dlsym, log_line, snprintf, write_log, fprintf/fwrite, close_module, dlclose, and chimera_gfx_status_string.

Pinned SDK transitive path includes __patch_init, kernel credential and syscall-permission writes, rtld initialization, possible sceKernelLoadStartModule calls, SDK kernel reads while inspecting module metadata, and possible sceKernelStopUnloadModule during cleanup. The complete audited path is in the evidence document.

Blocking findings

SDK v0.41 performs kernel process-state writes before main. The firmware gate cannot prevent them.
No bounded/cancellable loader API or safe external supervisor has been proven. A hang can prevent cleanup.
Module start/stop internals on firmware 9.60 are unknown.
The gate trusts a supplied string and does not attest firmware.
Runtime delivery of the required four arguments has not been observed.

Likely failure outcomes range from a clean refusal or loader error to a payload crash, persistent loaded-module/process state, or a console restart. GPU/display effects are not requested, but driver-internal effects cannot be ruled out.

Timeout, cleanup, and recovery status

No safe timeout or forced-cancellation procedure exists for this artifact. Normal cleanup attempts dlclose; crash/hang cleanup and CRT kernel-state restoration are not guaranteed. Therefore no transfer, launch, kill, retry, or recovery procedure is approved.

Approval checklist

Offline artifact hash and source commit recorded
Full imports and call chain audited
VideoOut/Phase-1 excluded from the build
Public, kernelwrite-free startup/loader path proven
Replacement artifact built and newly hashed
Firmware attestation and argument delivery proven
Bounded timeout and cleanup/recovery proven
New artifact-specific transfer approval
New artifact-specific one-time execution approval

Permission text

There is deliberately no valid permission text for this hash. Generic or future approval must not be interpreted as authorization for it. After the blockers are closed, a newly named and newly hashed replacement needs a new package and an exact permission sentence that names that replacement hash.

ADR-0009 makes this hash permanently ineligible; closing future startup blockers cannot rehabilitate these bytes.

4.0 KiB Raw Blame History