b25: S12v3/S16v2 smart-return baked

tools/sbl_uni.py

@@ -382,17 +382,18 @@ def main():
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
     # S12-stub (b25): blx #0x8006964 (BLX-imm to even => ARM mode!) lands
     # in file-zero padding (PBL would place an ARM helper). ARM version:
-    # movw/movt ip (=S16 addr, for the pop-site chain); ldr r3,[pc,#12]
+    # ldr ip,[sp,#4] (=pushed lr, for the B66 bx-ip chain); ldr r3,[pc]
     # (literal [0x8006980] = 0x073A100); ACK peripheral bit1 (the real
     # helper's side effect that poll#2 waits for); bx lr.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "c1cc06e300c840e30c309fe5002093e5022082e3002083e5"
-        "1eff2fe100a17300"))
-    # S16-stublet (b25, 18B @0x08006CC0): helper-pop chain exit.
-    # restore r7 (=0x73A000 peripheral base, trashed by labyrinth pops);
-    # jump to poll-loop resumption 0x8007779 via ip.
+        "04c09de50c309fe5002093e5022082e3002083e51eff2fe1"
+        "00a17300"))
+    # S16-stublet (b25, 44B @0x08006CC0): smart return for B66 bx ip.
+    # ip odd + top 8 (DDRLOW/DDRHIGH code) => bx ip (legit pushed-lr
+    # return); else default (restore r7, jump poll resumption 0x8007779).
     mu.mem_write(0x08006CC0, bytes.fromhex(
-        "4af20007c0f2730747f2797cc0f6000c6047"))
+        "1cf0010f09d05fea1c63082b00d160475fea1c73082b00d"
+        "160474af20007c0f2730747f2797cc0f6000c6047"))
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
     # pop-site slots (sp values from traces)
@@ -429,7 +430,7 @@ def main():
     # --- end parity ---
     # stub range is readonly on HW/QEMU: ignore SBL heap-clobber writes,
     # keep maze/stublets intact (restore-on-write with reentrancy guard)
-    STUB_LO, STUB_HI = 0x080068C0, 0x08006CE0  # +S7/S9/S10/S16 + banner
+    STUB_LO, STUB_HI = 0x080068C0, 0x08006CF0  # +S7/S9/S10/S16 + banner
     stub_snap = bytes(mu.mem_read(STUB_LO, STUB_HI - STUB_LO))
     _inww = [False]
     _swn = [0]