S12v4 smart dispatcher baked

docs/sbl-bringup.md

@@ -129,3 +129,6 @@
   B66 — un-leak стека вниз).
 - S16v4: отбраковка `ip==STUBV` (fill/maze — никогда legit return) →
   default вместо возврата в maze (разрыв maze-B66 петли).
+- S12v4 (scaffold, без ELF): smart dispatcher в самом S12 (проверка
+  pushed-lr + ACK + возврат) — S16 больше не нужен в цепочке (остаётся
+  как fallback).

qemu/saimaa.c

@@ -732,13 +732,22 @@ static void saimaa_machine_init(MachineState *machine)
                 uint32_t v = 0x47702000;
                 cpu_physical_memory_write(0x00221EF8, &v, 4);
             }
-             /* S12-stub (b25, 28B @0x08006964, ARM): blx-to-padding
-             * becomes ldr ip,[sp,#4] (=pushed lr, for B66 bx-ip chain)
-             * + ACK peripheral bit1 ([0x073A100], literal pool after
-             * code) + bx lr. PBL would place the real ARM helper here. */
+             /* S12-stub (b27, 84B @0x08006964, ARM): blx-to-padding
+             * becomes smart dispatcher: ldr ip,[sp,#4] (=pushed lr);
+             * ip==STUBV/even/non-code => ip=poll resumption 0x8007779;
+             * else keep pushed-lr; then ACK peripheral bit1
+             * ([literal 0x073A100]); bx lr.
+             * PBL would place the real ARM helper here. */
             {
                 static const uint8_t s12[] = {
-                    0x04, 0xc0, 0x9d, 0xe5, 0x0c, 0x30, 0x9f, 0xe5,
+                    0x04, 0xc0, 0x9d, 0xe5, 0x8d, 0x3b, 0x06, 0xe3,
+                    0x00, 0x38, 0x40, 0xe3, 0x03, 0x00, 0x5c, 0xe1,
+                    0x07, 0x00, 0x00, 0x0a, 0x01, 0x00, 0x1c, 0xe3,
+                    0x05, 0x00, 0x00, 0x0a, 0x2c, 0x3c, 0xa0, 0xe1,
+                    0x08, 0x00, 0x53, 0xe3, 0x04, 0x00, 0x00, 0x0a,
+                    0x2c, 0x3e, 0xa0, 0xe1, 0x08, 0x00, 0x53, 0xe3,
+                    0x01, 0x00, 0x00, 0x0a, 0x79, 0xc7, 0x07, 0xe3,
+                    0x00, 0xc8, 0x40, 0xe3, 0x0c, 0x30, 0x9f, 0xe5,
                     0x00, 0x20, 0x93, 0xe5, 0x02, 0x20, 0x82, 0xe3,
                     0x00, 0x20, 0x83, 0xe5, 0x1e, 0xff, 0x2f, 0xe1,
                     0x00, 0xa1, 0x73, 0x00,

tools/sbl_uni.py

@@ -385,14 +385,16 @@ def main():
     # to the dispatcher via stale lr (TZ bringup deferred).
     # NOTE: overwrites 4B of real ARM trampoline (recoverable from ELF).
     mu.mem_write(0x00221EF8, bytes([0x00, 0x20, 0x70, 0x47]))
-    # S12-stub (b25): blx #0x8006964 (BLX-imm to even => ARM mode!) lands
-    # in file-zero padding (PBL would place an ARM helper). ARM version:
-    # ldr ip,[sp,#4] (=pushed lr, for the B66 bx-ip chain); ldr r3,[pc]
-    # (literal [0x8006980] = 0x073A100); ACK peripheral bit1 (the real
-    # helper's side effect that poll#2 waits for); bx lr.
+    # S12-stub (b27, 84B @0x08006964, ARM): blx-to-padding becomes
+    # smart dispatcher: ldr ip,[sp,#4] (=pushed lr); ip==STUBV/even/
+    # non-code => ip=poll resumption 0x8007779; else keep pushed-lr;
+    # then ACK peripheral bit1 ([literal 0x073A100]); bx lr.
+    # PBL would place the real ARM helper here.
     mu.mem_write(0x08006964, bytes.fromhex(
-        "04c09de50c309fe5002093e5022082e3002083e51eff2fe1"
-        "00a17300"))
+        "04c09de58d3b06e3003840e303005ce10700000a0100"
+        "1ce30500000a2c3ca0e1080053e30400000a2c3ea0e1"
+        "080053e30100000a79c707e300c840e30c309fe50020"
+        "93e5022082e3002083e51eff2fe100a17300"))
     # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
     # ip==STUBV (fill/maze, never a legit return) => default;
     # ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66