diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md
index 50e2056..a7fe2f9 100644
--- a/harness/mame/NETWORK_REPORT.md
+++ b/harness/mame/NETWORK_REPORT.md
@@ -3819,3 +3819,89 @@ the `struct protosw` offsets (6/10) in section 53.1.
 
 This closes the loop on the socket layer: the ROM's offsets, the source's field
 order, and the lookup algorithm are all the same object.
+
+## 56. Completing the mapping: quoted identifiers, and what has no BSD counterpart
+
+Sections 53–55 mapped most addressed functions but three rows were asserted
+without a quoted line, and seven addressed functions were not in any row. Both
+gaps are closed here. **Section 54.4's claim that "every function the report
+gives an address for now has a BSD counterpart" was not true and is corrected in
+56.3.**
+
+### 56.1 Quoted identifiers for the rows that lacked one
+
+**`ip_output()` — `sys/netinet/ip_output.c:258-261`** matches the ROM's
+`0x3F62EA00` sequence operation for operation:
+
+```c
+ip->ip_len = htons((u_short)ip->ip_len);
+ip->ip_off = htons((u_short)ip->ip_off);
+ip->ip_sum = 0;
+ip->ip_sum = in_cksum(m, hlen);
+```
+
+(our block `0x3F62FEB0`..`0x3F630000` does exactly: htons of the word at byte 2,
+htons of the word at byte 6, zero the word at byte 10, checksum, store).
+
+**`udp_input()` — `sys/netinet/udp_usrreq.c`**: the preamble and the PCB lookup
+from the datagram's own header fields:
+
+```c
+:96    len = ntohs((u_short)uh->uh_ulen);
+:114   if (uh->uh_sum) {
+:119       if (uh->uh_sum = in_cksum(m, len + sizeof (struct ip))) {
+:223   inp = in_pcblookup(&udb, ip->ip_src, uh->uh_sport,
+                          ip->ip_dst, uh->uh_dport, INPLOOKUP_WILDCARD);
+```
+
+which is why the lookup arguments in `0x3F654980..0x3F654AA0` are
+(dport, dst, sport, src) read straight out of the packet (section 44.2).
+
+**`udp_output()` — same file**, the checksum the builder leaves for the end:
+
+```c
+:415   if ((ui->ui_sum = in_cksum(m, sizeof (struct udpiphdr) + len)) == 0)
+```
+
+**`tcp_dooptions()` — `sys/netinet/tcp_input.c:1309`**, called from two places in
+`tcp_input` (`:387` and `:567`), which is the options loop our TCP input runs
+over the header.
+
+### 56.2 The addressed functions with no BSD counterpart
+
+These are the VT1200's own glue. The structural reason is visible in the source:
+BSD's receive path hands the frame up **inside the interrupt**, and its transmit
+path is a direct `if_start` call —
+
+```c
+if_le.c:761   ether_input(&le->sc_if, &et, m);      /* inside lerint()  */
+if_le.c:230   ifp->if_start = lestart;
+if_le.c:443   (void) lestart(ifp);
+if_le.c:942   lestart(ifp);
+```
+
+— whereas the firmware **defers both** through queues and event posts.
+
+| ROM | role | status |
+|---|---|---|
+| `0x3F602E00` | RX entry: buffer state, re-arm, post | **VT1200 glue** (deferred RX; BSD calls `ether_input` inline at `if_le.c:761`) |
+| `0x3F9E0B80` | prepare the frame for the block | **VT1200 glue**, same deferral |
+| `0x3F600200` | frame -> packet block (lengths `0x5EE`/`0x226`/`0x44C`) | analogous to `leget()` (`if_le.c:797`, the mbuf side), but operates on the VT1200 packet block — **no line-level counterpart** |
+| `0x3F603250` | enqueue to `0x96AE0` + post "IP input ready" | **VT1200 glue** (BSD has no queue here) |
+| `0x3F9DC890` | submission wrapper before the driver entry | **VT1200 glue** around `if_start`/`lestart` (`if_le.c:230/443/942`) |
+| `0x3F9DCF50` | the call site of the driver entry `0x3F9D4BC0` | **VT1200 glue** (the wrapper's inner call) |
+| `0x3F7144C0` | OS interrupt dispatcher (handler table `0x3F7151F0`) | **VT1200 OS**, no BSD counterpart; BSD's equivalent is the platform vector that calls `leintr()` (`if_le.c:76` declares it) |
+
+### 56.3 Correction to 54.4
+
+Section 54.4 said every addressed function has a BSD counterpart. The accurate
+statement is:
+
+> **Every protocol-layer function the report addresses maps to a 4.4BSD
+> function with a quoted identifier. The driver's receive and submit paths are
+> split differently in the firmware (queue + task, and a submission wrapper), so
+> four of them are VT1200 glue with no source counterpart, and the interrupt
+> dispatcher belongs to the firmware's own OS.**
+
+That is the honest boundary of the mapping: the protocol stack is 4.4BSD
+lineage, the driver's *deferred* structure is not.