b23: S10 + table poke + S9 baked

tools/sbl_uni.py

@@ -325,6 +325,12 @@ def main():
         "059b0bb1bde8f081002040f20004c0f2220440f20005c0f2"
         "220540f2000ac0f6060a41f2000bc0f6060b4ff60073c0f6"
         "5f039d464ff29d6cc0f6020c6047"))
+    # S10 stublet (10B @0x08006C88, b23): rollback-exit router.
+    # movw/movt ip + bx ip to sbl_main 0x802f6a3.
+    mu.mem_write(0x08006C88, bytes.fromhex("4ff2a36cc0f6020c6047"))
+    # PBL version-table fabrication (b23): [0x080528D0] = STUBV so the
+    # rollback query's blx calls maze (returns 0 = versions OK).
+    W32(0x080528D0, STUBV)
     # stack zone fill (STUBV odd)
     mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
     # pop-site slots (sp values from traces)
@@ -361,7 +367,7 @@ def main():
     # --- end parity ---
     # stub range is readonly on HW/QEMU: ignore SBL heap-clobber writes,
     # keep maze/stublets intact (restore-on-write with reentrancy guard)
-    STUB_LO, STUB_HI = 0x080068C0, 0x08006C90  # +S7/S9 + banner tail
+    STUB_LO, STUB_HI = 0x080068C0, 0x08006CA0  # +S7/S9/S10 + banner
     stub_snap = bytes(mu.mem_read(STUB_LO, STUB_HI - STUB_LO))
     _inww = [False]
     _swn = [0]