b37: S20 clock-dispatcher router

tools/sbl_uni.py

@@ -426,6 +426,12 @@ def main():
     # S18 stublet (10B @0x08006D22, b29): poll-epilogue router.
     # movw/movt ip + bx ip to sbl_main 0x802f6a9 (post-dispatcher).
     mu.mem_write(0x08006D22, bytes.fromhex("4ff2a96cc0f6020c6047"))
+    # S20 stublet (34B @0x08006D38, b37): clock-dispatcher router.
+    # [sp+0x2C] valid-code? => original pop.w (legit return);
+    # else r0=sl (PBL tables) + b.w dispatcher re-run (idempotent math).
+    mu.mem_write(0x08006D38, bytes.fromhex(
+        "0b9b13f0010f09d01a0e082a01d1bde8fe8f1a0f082a"
+        "01d1bde8fe8f504607f013bf"))
     # S17 safe-logger (50B @0x08006CF0, b26): print r1-string via
     # UARTDM-TF only if r1 in rodata [0x804B800,0x8058000); pop-return.
     mu.mem_write(0x08006CF0, bytes.fromhex(
@@ -513,7 +519,7 @@ def main():
     # --- end parity ---
     # stub range is readonly on HW/QEMU: ignore SBL heap-clobber writes,
     # keep maze/stublets intact (restore-on-write with reentrancy guard)
-    STUB_LO, STUB_HI = 0x080068C0, 0x08006D30  # +S7/S9/S10/S16/S17
+    STUB_LO, STUB_HI = 0x080068C0, 0x08006D60  # +S7/S9/S10/S16/S17/S18/S20
     stub_snap = bytes(mu.mem_read(STUB_LO, STUB_HI - STUB_LO))
     _inww = [False]
     _swn = [0]