vwemirror/TeslaRel410
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BT410 5.3.74: the faulting instruction decoded -- a handler-chain walk with a bad node

Browse Source 
The SegPhys-corrected dump read real code at last (the earlier zeros were the
probe reading EIP as a bare linear address; CS=00FF has a base):

    66D4  push 0 / push edi / push ebx / push esi
    66D9  call dword near [ebx+4]     <- faults
    66DC  cmp eax,0 / jz done
    66E5  mov ebx,[ebx] / jmp loop

A linked-list walk with a per-node callback -- node = {next@+0, handler@+4},
four args, "handled" on nonzero.  A DPMI exception/interrupt handler chain.

The arithmetic closes exactly: the read is DS_base + ebx + 4, and
7000FA64 - F000CA64 = 80003000, so DS base is 0x80003000 and the famous cr2
is that wrap.  My earlier '[EBX+0x3004]' reading was fabricated from the cr2
alone -- there is no 0x3004 displacement, which is why the constant appeared
in no binary.

So: a chain node's NEXT pointer holds F000CA60, the value parked in unhooked
IVT slots -- the walk expected a terminator and got an interrupt vector, then
read its +4 as a function pointer.  Identical registers on every catch, so
one deterministic path, entered often enough that our 60s load window catches
it 25-40% of the time while shipped's 15s window mostly does not.

Open: which routine owns the chain, and where the bogus next came from.  The
probe now walks the EBP frame chain to name the caller.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Cyd
2026-07-29 18:34:22 -05:00
co-authored by Claude Fable 5
parent 2ce3528f1c
commit e97862507c
5 changed files with 651 additions and 644 deletions
Download Patch File Download Diff File Expand all files Collapse all files
emulator/render-bridge/dosboxlog.txt
-188
View File
@@ -54,191 +54,3 @@ LOG: ISA Plug & Play BIOS enabled
LOG: VGA ROM BIOS init callback
LOG: pixratio 1.000, dw false, dh false
LOG: Aspect ratio: 640 x 480 xToY=1.333 yToX=0.750
LOG: WARNING: No translation support (to host) for code page 0
LOG: DOS keyboard layout loaded with main language code US for layout us
LOG: XMS: 50 handles allocated for use by the DOS environment
LOG: EMS page frame at 0xe000-0xefff
LOG: COMMAND.COM env size: 720 bytes
LOG: COMMAND.COM environment block: 0x0701 sz=0x002d
LOG: COMMAND.COM main body (PSP): 0x072f sz=0x009a
LOG: COMMAND.COM stack: 0x0749
LOG: pixratio 1.350, dw false, dh false
LOG: Aspect ratio: 720 x 540 xToY=1.333 yToX=0.750
LOG: SHELL:Redirect output to COM3
LOG: VPXLOG: fifosock client connected
VPX lights@f1: type6=0 typeE=0 decoded=0 dir=0 amb(0.00,0.00,0.00)
LOG: 185121370 ERROR MOUSE:Unhandled videomode 79 on reset
LOG: pixratio 1.000, dw false, dh false
LOG: Aspect ratio: 640 x 480 xToY=1.333 yToX=0.750
VPX lightnode t=6 nb=52: [8]00000000/0 [12]00000000/0 [16]00000001/1.4013e-45 [20]3f800000/1 [24]3f800000/1 [28]3f800000/1 [32]64078678/1e+22 [36]64078678/1e+22 [40]00000000/0 [44]bf6ae9ee/-0.917632 [48]ffffffff/nan
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:2 (IF0:2), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:4 (IF0:4), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:2 (IF0:2), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:2 (IF0:2), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:2 (IF0:2), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:3 (IF0:3), TX:0, Break 0
VPX lights@f121: type6=2 typeE=6 decoded=2 dir=1 amb(0.55,0.50,0.65)
L0 dir(0.11,0.77,0.63) col(1.10,0.90,1.00)
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:2 (IF0:2), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
VPX lights@f241: type6=2 typeE=7 decoded=2 dir=1 amb(0.55,0.50,0.65)
L0 dir(0.11,0.77,0.63) col(1.10,0.90,1.00)
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:1 (IF0:1), TX:0, Break 0
VPX lights@f361: type6=2 typeE=7 decoded=2 dir=1 amb(0.55,0.50,0.65)
L0 dir(0.11,0.77,0.63) col(1.10,0.90,1.00)
VPX_PF_WATCH hit: lin=7000FA64 code=4 CS:EIP=00FF:000066D4 SS:ESP=0107:00017560
EAX=00000001 EBX=F000CA60 ECX=00000000 EDX=FFFFFFFF ESI=00017640 EDI=00017574 EBP=00017570
now=288700.555ms last serial RX 0.548ms ago deliveries=31081
code @EIP: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
stack: 66225E8E 5D02768B F30090B9 5E89A467 F05E89F2 F71523E8 10214906 55097400 21472E8B 5D1E4689
IVT match for EBX=F000CA60: INT00 INT06 INT07 INT2B INT2C INT2D INT32 INT34 INT35 INT36 INT37 INT38 INT39 INT3A INT3B INT3C INT3D INT3E INT3F INT40 INT42 INT44 INT45 INT47 INT48 INT49 INT4A INT4C INT4D INT4E INT4F INT50 INT51 INT52 INT53 INT54 INT55 INT56 INT57 INT58 INT59 INT5A INT5B INT5C INT5D INT5E INT5F INT66 INT68 INT69 INT6A INT6B INT6C INT6D INT6E INT6F
IVT[08-0F]: 0D1F0777 0D1F077B 0D1F077F 0D1F0783 0D1F0787 0D1F078B 0D1F078F 0D1F0793
rx[ 0] t=288575.005 (125.550 ago) cs:eip=00FF:00489793 byte=00
rx[ 1] t=288577.005 (123.549 ago) cs:eip=0D1F:000006D5 byte=00
rx[ 2] t=288579.008 (121.547 ago) cs:eip=00FF:004922D2 byte=00
rx[ 3] t=288581.005 (119.549 ago) cs:eip=00FF:0045DDFC byte=07
rx[ 4] t=288583.006 (117.549 ago) cs:eip=0078:00000A83 byte=FC
rx[ 5] t=288585.009 (115.546 ago) cs:eip=00FF:0048AB1B byte=87
rx[ 6] t=288588.006 (112.549 ago) cs:eip=0020:000002CD byte=00
rx[ 7] t=288591.009 (109.545 ago) cs:eip=F000:0000CA40 byte=00
rx[ 8] t=288592.005 (108.549 ago) cs:eip=00B7:0000188D byte=00
rx[ 9] t=288594.005 (106.549 ago) cs:eip=00B7:0000188D byte=00
rx[ 10] t=288596.005 (104.549 ago) cs:eip=00B7:0000188D byte=00
rx[ 11] t=288598.005 (102.549 ago) cs:eip=00B7:0000188D byte=00
rx[ 12] t=288600.005 (100.549 ago) cs:eip=00B7:0000188D byte=00
rx[ 13] t=288602.005 (98.549 ago) cs:eip=00FF:0048E6F4 byte=00
rx[ 14] t=288603.607 (96.948 ago) cs:eip=00FF:004926CC byte=00
rx[ 15] t=288605.009 (95.546 ago) cs:eip=00FF:004C3E4F byte=00
rx[ 16] t=288606.605 (93.950 ago) cs:eip=00FF:00492A13 byte=07
rx[ 17] t=288607.805 (92.750 ago) cs:eip=00FF:00492A13 byte=FC
rx[ 18] t=288609.611 (90.944 ago) cs:eip=0D1F:00000640 byte=87
rx[ 19] t=288610.005 (90.550 ago) cs:eip=0020:00004BEE byte=00
rx[ 20] t=288613.007 (87.547 ago) cs:eip=00FF:00492A93 byte=00
rx[ 21] t=288614.105 (86.450 ago) cs:eip=00FF:00492A13 byte=00
rx[ 22] t=288616.005 (84.550 ago) cs:eip=F000:0000D10B byte=00
rx[ 23] t=288618.007 (82.547 ago) cs:eip=00FF:0049BD30 byte=00
rx[ 24] t=288620.009 (80.545 ago) cs:eip=00FF:00492856 byte=00
rx[ 25] t=288622.005 (78.550 ago) cs:eip=00B7:00000FD5 byte=00
rx[ 26] t=288624.007 (76.548 ago) cs:eip=00FF:004929D5 byte=00
rx[ 27] t=288626.009 (74.545 ago) cs:eip=00FF:004C3E4F byte=00
rx[ 28] t=288628.005 (72.550 ago) cs:eip=F000:0000D10B byte=00
rx[ 29] t=288630.009 (70.546 ago) cs:eip=00FF:00492AB7 byte=07
rx[ 30] t=288633.007 (67.547 ago) cs:eip=0020:00001755 byte=FC
rx[ 31] t=288635.005 (65.550 ago) cs:eip=00FF:00492972 byte=87
rx[ 32] t=288637.018 (63.537 ago) cs:eip=00FF:00006241 byte=00
rx[ 33] t=288639.005 (61.549 ago) cs:eip=00FF:0000B25D byte=00
rx[ 34] t=288641.007 (59.547 ago) cs:eip=00FF:0048AB1B byte=00
rx[ 35] t=288643.007 (57.548 ago) cs:eip=00FF:00492ADA byte=00
rx[ 36] t=288645.021 (55.533 ago) cs:eip=00FF:0000AF55 byte=00
rx[ 37] t=288646.005 (54.549 ago) cs:eip=00FF:0049292F byte=00
rx[ 38] t=288649.005 (51.549 ago) cs:eip=0020:00001A47 byte=00
rx[ 39] t=288651.005 (49.550 ago) cs:eip=00FF:004C3E4F byte=00
rx[ 40] t=288652.007 (48.548 ago) cs:eip=00FF:00492AC6 byte=00
rx[ 41] t=288654.205 (46.350 ago) cs:eip=00FF:00492A13 byte=00
rx[ 42] t=288655.607 (44.947 ago) cs:eip=00FF:00492700 byte=07
rx[ 43] t=288659.005 (41.549 ago) cs:eip=00FF:0000B248 byte=FC
rx[ 44] t=288660.008 (40.547 ago) cs:eip=00FF:00494C2C byte=87
rx[ 45] t=288663.005 (37.550 ago) cs:eip=F000:0000D10B byte=00
rx[ 46] t=288665.005 (35.550 ago) cs:eip=00FF:00492AC6 byte=00
rx[ 47] t=288668.007 (32.547 ago) cs:eip=0020:00001755 byte=00
rx[ 48] t=288669.005 (31.549 ago) cs:eip=00FF:000014FB byte=00
rx[ 49] t=288672.005 (28.549 ago) cs:eip=00FF:0049BFE9 byte=00
rx[ 50] t=288674.009 (26.546 ago) cs:eip=00B7:000020C3 byte=00
rx[ 51] t=288676.009 (24.545 ago) cs:eip=00FF:004929E3 byte=00
rx[ 52] t=288678.005 (22.549 ago) cs:eip=00FF:004C3EA3 byte=00
rx[ 53] t=288679.308 (21.247 ago) cs:eip=00FF:00492772 byte=00
rx[ 54] t=288682.005 (18.550 ago) cs:eip=00FF:0000B248 byte=00
rx[ 55] t=288684.006 (16.549 ago) cs:eip=00FF:00492A13 byte=07
rx[ 56] t=288686.012 (14.543 ago) cs:eip=00CF:00002A31 byte=FC
rx[ 57] t=288688.005 (12.549 ago) cs:eip=0020:000002B1 byte=87
rx[ 58] t=288690.011 (10.543 ago) cs:eip=00FF:00492A93 byte=00
rx[ 59] t=288692.010 (8.545 ago) cs:eip=00FF:00493D10 byte=00
rx[ 60] t=288694.007 (6.548 ago) cs:eip=00FF:0000B57E byte=00
rx[ 61] t=288696.007 (4.547 ago) cs:eip=00FF:00498A61 byte=00
rx[ 62] t=288698.005 (2.550 ago) cs:eip=0D1F:00000A11 byte=00
rx[ 63] t=288700.007 (0.548 ago) cs:eip=00FF:004929CF byte=00
VPX_PF_WATCH hit: lin=7000FA64 code=4 CS:EIP=00FF:000066D9 SS:ESP=0107:00017560
EAX=00000001 EBX=F000CA60 ECX=00000000 EDX=FFFFFFFF ESI=00017640 EDI=00017574 EBP=00017570
now=288701.383ms last serial RX 0.779ms ago deliveries=31082
code @EIP: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
stack: 66225E8E 5D02768B F30090B9 5E89A467 F05E89F2 F71523E8 10214906 55097400 21472E8B 5D1E4689
IVT match for EBX=F000CA60: INT00 INT06 INT07 INT2B INT2C INT2D INT32 INT34 INT35 INT36 INT37 INT38 INT39 INT3A INT3B INT3C INT3D INT3E INT3F INT40 INT42 INT44 INT45 INT47 INT48 INT49 INT4A INT4C INT4D INT4E INT4F INT50 INT51 INT52 INT53 INT54 INT55 INT56 INT57 INT58 INT59 INT5A INT5B INT5C INT5D INT5E INT5F INT66 INT68 INT69 INT6A INT6B INT6C INT6D INT6E INT6F
IVT[08-0F]: 0D1F0777 0D1F077B 0D1F077F 0D1F0783 0D1F0787 0D1F078B 0D1F078F 0D1F0793
rx[ 0] t=288577.005 (124.378 ago) cs:eip=0D1F:000006D5 byte=00
rx[ 1] t=288579.008 (122.375 ago) cs:eip=00FF:004922D2 byte=00
rx[ 2] t=288581.005 (120.378 ago) cs:eip=00FF:0045DDFC byte=07
rx[ 3] t=288583.006 (118.377 ago) cs:eip=0078:00000A83 byte=FC
rx[ 4] t=288585.009 (116.375 ago) cs:eip=00FF:0048AB1B byte=87
rx[ 5] t=288588.006 (113.377 ago) cs:eip=0020:000002CD byte=00
rx[ 6] t=288591.009 (110.374 ago) cs:eip=F000:0000CA40 byte=00
rx[ 7] t=288592.005 (109.378 ago) cs:eip=00B7:0000188D byte=00
rx[ 8] t=288594.005 (107.378 ago) cs:eip=00B7:0000188D byte=00
rx[ 9] t=288596.005 (105.378 ago) cs:eip=00B7:0000188D byte=00
rx[ 10] t=288598.005 (103.378 ago) cs:eip=00B7:0000188D byte=00
rx[ 11] t=288600.005 (101.378 ago) cs:eip=00B7:0000188D byte=00
rx[ 12] t=288602.005 (99.378 ago) cs:eip=00FF:0048E6F4 byte=00
rx[ 13] t=288603.607 (97.777 ago) cs:eip=00FF:004926CC byte=00
rx[ 14] t=288605.009 (96.375 ago) cs:eip=00FF:004C3E4F byte=00
rx[ 15] t=288606.605 (94.779 ago) cs:eip=00FF:00492A13 byte=07
rx[ 16] t=288607.805 (93.579 ago) cs:eip=00FF:00492A13 byte=FC
rx[ 17] t=288609.611 (91.773 ago) cs:eip=0D1F:00000640 byte=87
rx[ 18] t=288610.005 (91.379 ago) cs:eip=0020:00004BEE byte=00
rx[ 19] t=288613.007 (88.376 ago) cs:eip=00FF:00492A93 byte=00
rx[ 20] t=288614.105 (87.279 ago) cs:eip=00FF:00492A13 byte=00
rx[ 21] t=288616.005 (85.379 ago) cs:eip=F000:0000D10B byte=00
rx[ 22] t=288618.007 (83.376 ago) cs:eip=00FF:0049BD30 byte=00
rx[ 23] t=288620.009 (81.374 ago) cs:eip=00FF:00492856 byte=00
rx[ 24] t=288622.005 (79.379 ago) cs:eip=00B7:00000FD5 byte=00
rx[ 25] t=288624.007 (77.377 ago) cs:eip=00FF:004929D5 byte=00
rx[ 26] t=288626.009 (75.374 ago) cs:eip=00FF:004C3E4F byte=00
rx[ 27] t=288628.005 (73.379 ago) cs:eip=F000:0000D10B byte=00
rx[ 28] t=288630.009 (71.375 ago) cs:eip=00FF:00492AB7 byte=07
rx[ 29] t=288633.007 (68.376 ago) cs:eip=0020:00001755 byte=FC
rx[ 30] t=288635.005 (66.379 ago) cs:eip=00FF:00492972 byte=87
rx[ 31] t=288637.018 (64.365 ago) cs:eip=00FF:00006241 byte=00
rx[ 32] t=288639.005 (62.378 ago) cs:eip=00FF:0000B25D byte=00
rx[ 33] t=288641.007 (60.376 ago) cs:eip=00FF:0048AB1B byte=00
rx[ 34] t=288643.007 (58.377 ago) cs:eip=00FF:00492ADA byte=00
rx[ 35] t=288645.021 (56.362 ago) cs:eip=00FF:0000AF55 byte=00
rx[ 36] t=288646.005 (55.378 ago) cs:eip=00FF:0049292F byte=00
rx[ 37] t=288649.005 (52.378 ago) cs:eip=0020:00001A47 byte=00
rx[ 38] t=288651.005 (50.379 ago) cs:eip=00FF:004C3E4F byte=00
rx[ 39] t=288652.007 (49.377 ago) cs:eip=00FF:00492AC6 byte=00
rx[ 40] t=288654.205 (47.179 ago) cs:eip=00FF:00492A13 byte=00
rx[ 41] t=288655.607 (45.776 ago) cs:eip=00FF:00492700 byte=07
rx[ 42] t=288659.005 (42.378 ago) cs:eip=00FF:0000B248 byte=FC
rx[ 43] t=288660.008 (41.375 ago) cs:eip=00FF:00494C2C byte=87
rx[ 44] t=288663.005 (38.379 ago) cs:eip=F000:0000D10B byte=00
rx[ 45] t=288665.005 (36.379 ago) cs:eip=00FF:00492AC6 byte=00
rx[ 46] t=288668.007 (33.376 ago) cs:eip=0020:00001755 byte=00
rx[ 47] t=288669.005 (32.378 ago) cs:eip=00FF:000014FB byte=00
rx[ 48] t=288672.005 (29.378 ago) cs:eip=00FF:0049BFE9 byte=00
rx[ 49] t=288674.009 (27.375 ago) cs:eip=00B7:000020C3 byte=00
rx[ 50] t=288676.009 (25.374 ago) cs:eip=00FF:004929E3 byte=00
rx[ 51] t=288678.005 (23.378 ago) cs:eip=00FF:004C3EA3 byte=00
rx[ 52] t=288679.308 (22.075 ago) cs:eip=00FF:00492772 byte=00
rx[ 53] t=288682.005 (19.379 ago) cs:eip=00FF:0000B248 byte=00
rx[ 54] t=288684.006 (17.377 ago) cs:eip=00FF:00492A13 byte=07
rx[ 55] t=288686.012 (15.371 ago) cs:eip=00CF:00002A31 byte=FC
rx[ 56] t=288688.005 (13.378 ago) cs:eip=0020:000002B1 byte=87
rx[ 57] t=288690.011 (11.372 ago) cs:eip=00FF:00492A93 byte=00
rx[ 58] t=288692.010 (9.373 ago) cs:eip=00FF:00493D10 byte=00
rx[ 59] t=288694.007 (7.377 ago) cs:eip=00FF:0000B57E byte=00
rx[ 60] t=288696.007 (5.376 ago) cs:eip=00FF:00498A61 byte=00
rx[ 61] t=288698.005 (3.379 ago) cs:eip=0D1F:00000A11 byte=00
rx[ 62] t=288700.007 (1.377 ago) cs:eip=00FF:004929CF byte=00
rx[ 63] t=288700.605 (0.779 ago) cs:eip=0020:0000587C byte=00
LOG: 782399823 ERROR INT10:PutPixel unhandled mode type 7
LOG: SHELL:Redirect output to RC.TXT
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:504 (IF0:6), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:504 (IF0:0), TX:0, Break 0
LOG: Serial1: Errors: Framing 0, Parity 0, Overrun RX:500 (IF0:0), TX:0, Break 0