CydandClaude Fable 5
34383f3f2c
68HC11 recursive-descent disassembler (disasm_6811.py, follows the pointer-based RX/TX state dispatch) + full disassembly + analysis doc. Root cause of the stress wedge: an orphaned reply-in-progress latch ($2521). It gates every analog request ($D758); it is set when a reply is generated ($D84C) but the 4-retry give-up path ($D9DD -> $DA2F) tears down reply state without clearing it, and the success teardown ($DA00) clears it only conditionally on $2522. Once leaked, all analog requests are dropped -> board mute, while RX/event stays alive; only the game-start host-reset command ($C686) clears it -- matching the field button-resync ritual exactly. Proposed minimal in-place fix (clear $2521 on every teardown) documented with byte patches and a hardware validation plan; untested pending a spare EPROM. RIOv4_2-ANALYSIS.md has the details. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2 lines
50 B
Plaintext
2 lines
50 B
Plaintext
decoded 2728 insns, 328 labels, 112 call targets
|