From c0ae3ecd27451c40d6cf709c542c40ed9b6f02ec Mon Sep 17 00:00:00 2001 From: Arti Zirk Date: Fri, 30 Oct 2026 15:57:30 +0200 Subject: [PATCH] fix crash: marker block overlapped .text after the text panel grew it .text went from 0x018C6140 to 0x018CACD0, so the marker cells at 0x018C8000 landed inside the payload's own code; cell() then overwrote instructions and the CPU faulted with an illegal opcode before drawing anything. MARK moved to 0x018D0000 (~2.6 KB past the end of .text). --- harness/mame/NETWORK_REPORT.md | 14 ++++++++++++++ harness/udpstream/build/lance.coff | Bin 6345 -> 6345 bytes harness/udpstream/build/lance_fixlen.coff | Bin 6347 -> 6347 bytes harness/udpstream/lance.c | 2 +- harness/udpstream/lance_fixlen.c | 2 +- 5 files changed, 16 insertions(+), 2 deletions(-) diff --git a/harness/mame/NETWORK_REPORT.md b/harness/mame/NETWORK_REPORT.md index 758a8a4..fca5f9a 100644 --- a/harness/mame/NETWORK_REPORT.md +++ b/harness/mame/NETWORK_REPORT.md @@ -4267,3 +4267,17 @@ Consequences, all now fixed: The restore path in `harness/udpstream/lance.c` now re-programs the chip with `0x7F41` (the firmware's own init value: `INIT | INEA | all status bits`), polls `IDON`, writes `0x0042`, and leaves the driver's cells untouched. + +## 63. Crash cause: the marker cells ran into `.text` + +Adding the text panel grew `.text` from `0x018C6140` to `0x018CACD0`, which +**swallows the marker block** at `0x018C8000`. The payload then wrote +`cell(0x160, …)` and friends straight into its own code, and the CPU executed +the overwritten bytes — an illegal opcode before any text was drawn (four +progress dots, blank panel). + +That is a general hazard of this payload layout: `.text` grows upward from +`0x018C0000` while the markers were hard-coded at `0x018C8000`. They are now at +**`0x018D0000`**, clear of the end of `.text` by ~2.6 KB. + +Any future growth should re-check `build/lance.map` against `MARK`. diff --git a/harness/udpstream/build/lance.coff b/harness/udpstream/build/lance.coff index 68c2be2331c48c3f442d99ae08b94b9f4a5bb895..5421f5c469859979774d10245486a7241be5e0f0 100644 GIT binary patch delta 20 ccmX?Uc+!w{0s{*}{6y9pObopn@4pfU07!`kdjJ3c delta 20 ccmX?Uc+!w{0s{*J*F@GEObtC7@4pfU07u;ir2qf` diff --git a/harness/udpstream/build/lance_fixlen.coff b/harness/udpstream/build/lance_fixlen.coff index 1daaa6df6124ab1fdeaf972838706c469795e959..e7bb6c20894ea92357cdaa5dc8eefaf063a27f10 100644 GIT binary patch delta 20 ccmX?Yc-oM40s{*}(nQu9Obopn@4pcT07&`=ga7~l delta 20 ccmX?Yc-oM40s{*J??l!cObtC7@4pcT07y;;t^fc4 diff --git a/harness/udpstream/lance.c b/harness/udpstream/lance.c index d8d97db..50b4d66 100644 --- a/harness/udpstream/lance.c +++ b/harness/udpstream/lance.c @@ -20,7 +20,7 @@ */ #define RAP 0x05900000 #define RDP 0x05800000 -#define MARK 0x018C8000 +#define MARK 0x018D0000 /* after .text (which now reaches 0x018CACD0) */ #define VRAM_BASE 0x04000000 #define MODE_LOOP 0x0004 diff --git a/harness/udpstream/lance_fixlen.c b/harness/udpstream/lance_fixlen.c index 678533c..00514b5 100644 --- a/harness/udpstream/lance_fixlen.c +++ b/harness/udpstream/lance_fixlen.c @@ -20,7 +20,7 @@ */ #define RAP 0x05900000 #define RDP 0x05800000 -#define MARK 0x018C8000 +#define MARK 0x018D0000 /* after .text (which now reaches 0x018CACD0) */ #define VRAM_BASE 0x04000000 #define MODE_LOOP 0x0004