IMEM tripwire (poison broke stack)

docs/sbl-bringup.md

@@ -171,3 +171,6 @@
 - Assert-hang `0x8018458` (`b .`) достигается напрямую через
   maze-stale-lr (мимо патченного wrap-check). `b .` → `b success`
   (2B, в success-путь).
+- Урок: полный IMEM-poison ломает IMEM-стек (счётчики читают
+  0xFFFFFFFF вместо свежих нулей → underflow → wild-pop). Только
+  tripwire 16B на входе дрейфа `[0x8600000,0x8600010)`.

qemu/saimaa.c

@@ -822,12 +822,12 @@ static void saimaa_machine_init(MachineState *machine)
                     cpu_physical_memory_write(a, &fill, 4);
                 }
             }
-            /* IMEM poison [0x8600000,0x8600F00): drift-sink trap (UDF in
-             * both modes). IMEM stack [0x8600F00,0x8610000) intact. */
+            /* IMEM tripwire [0x8600000,0x8600010): drift-sink trap.
+             * Rest of IMEM stays zeros (SBL stack reads data there). */
             {
                 uint32_t p = 0xFFFFFFFF;
                 uint32_t a;
-                for (a = 0x08600000; a < 0x08600F00; a += 4) {
+                for (a = 0x08600000; a < 0x08600010; a += 4) {
                     cpu_physical_memory_write(a, &p, 4);
                 }
             }

tools/sbl_uni.py

@@ -474,11 +474,12 @@ def main():
         "60474af20007c0f2730747f2797cc0f6000c6047"))
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
-    # IMEM poison [0x8600000,0x8600F00): drift-sink trap. Fill/IMEM-zero
-    # sleds (fall-through ldr/movs/andeq) drift silently to IMEM-top
-    # fault; poison faults LOUDLY at drift-entry (UDF in both modes).
-    # IMEM stack [0x8600F00,0x8610000) left intact.
-    mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * (0xF00 // 4))
+    # IMEM tripwire [0x8600000,0x8600010): drift-sink trap (UDF).
+    # Fill-drift falls through here sequentially; faults LOUDLY at
+    # entry instead of sledding silently to IMEM-top. Rest of IMEM
+    # stays zeros (SBL IMEM-stack reads data there; full poison
+    # corrupts counters (0xFFFFFFFF vs fresh 0)!).
+    mu.mem_write(0x08600000, b"\xff\xff\xff\xff" * 4)
     # pop-site slots (sp values from traces)
     for a, v in [(0x085FFF14, 0x802f65d), (0x085FFF1C, 0x802f665),
                  (0x085FFF44, 0x8013ba5), (0x085FFF5C, 0x802f681),