vt1200/dwt/notes/LOADER.md

The COFF loader: GSPLNK images, position dependence, and create_process

Status: DONE for the loader half. A GSPLNK COFF image poked into RAM is parsed, its sections are placed at the addresses in their headers, .bss is zeroed, and the image runs as a first-class process from create_process(entry, "LOADER", 0x6000, 1, 0). Two apps prove it: a marker app (MAGIC/counter cells) and xhello (an X window in a frame dump).

The transport half is separate. The loader takes an already-received image and chooses no address of its own: the COFF section headers carry the addresses.

All work is emulator-only: no driver edits, no ROM change (md5 b46a3e442ccb86134d2356bd70d22fd2), private NVRAM/cfg, no network.

---

1. What GSPLNK emits

dwt/loader/coff.py is the reference reader. All addresses and sizes in the section headers and optional header are bit addresses/bits; file offsets (scnptr, relptr, symptr) are bytes. This is the same model as harness/hello-world/cofextract.py, confirmed again here.

1.1 The file header (20 bytes)

00000000: 90 00 03 00 de e0 d4 6a 02 01 00 00 0e 00 00 00
00000010: 1c 00 03 01 08 01 c7 00 90 02 00 00 40 00 00 00
00000020: 40 00 00 00 00 00 8c 01 00 00 8c 01 00 00 8d 01
00000030: 2e 74 65 78 74 00 00 00 00 00 8c 01 00 00 8c 01
00000040: 90 02 00 00 a8 00 00 00 00 00 00 00 00 00 00 00
00000050: 00 00 00 00 20 00 00 00 2e 64 61 74 61 00 00 00
00000060: 00 00 8d 01 00 00 8d 01 40 00 00 00 fa 00 00 00
00000070: 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00
00000080: 2e 62 73 73 00 00 00 00 00 80 8d 01 00 80 8d 01
00000090: 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000a0: 00 00 00 00 80 00 00 00 50 05 40 07 e2 09 00 00

This is dwt/loader/build/marker.coff (510 bytes). The header at 0x00:

offset	size	field	this file
0x00	2	magic	0x0090
0x02	2	section count	3
0x04	4	time stamp	0x6AD4E0DE
0x08	4	symbol table offset (bytes)	0x102
0x0C	4	symbol count	14
0x10	2	optional header size (bytes)	0x1c (28)
0x12	2	flags	0x0103

0x0100 is F_RELFLG (relocation info stripped); 0x0003 is the executable flag set. The same magic 0x0090 appears in .obj files, whose flags are 0x0100 and whose optional header size is 0.

1.2 The optional header (28 bytes, at 0x14)

offset	size	field	this file
0x14	2	magic	0x0108
0x16	2	version	0x00c7
0x18	4	text size (bits)	0x290 = 656 bits = 82 B
0x1C	4	data size (bits)	0x40 = 8 B
0x20	4	bss size (bits)	0x40 = 8 B
0x24	4	entry point (bits)	0x018C0000
0x28	4	text start (bits)	0x018C0000
0x2C	4	data start (bits)	0x018D0000

1.3 Section headers (40 bytes each, at 20 + opthdr)

offset	size	field
+0	8	name, NUL-padded
+8	4	paddr (bits)
+12	4	vaddr (bits)
+16	4	size (bits)
+20	4	scnptr (file offset, bytes)
+24	4	relptr (file offset, bytes)
+28	4	line-number pointer
+32	2	nreloc
+34	2	nlnno
+36	4	flags (0x20 text, 0x40 data, 0x80 bss)

For marker.coff:

sec 1 .text  paddr=018C0000 size=0x290 bits (82 B) scnptr=0xa8 nreloc=0 flags=0x20
sec 2 .data  paddr=018D0000 size=0x40 bits  (8 B) scnptr=0xfa nreloc=0 flags=0x40
sec 3 .bss   paddr=018D8000 size=0x40 bits  (8 B) scnptr=0     nreloc=0 flags=0x80

Note that GSPLNK reorders sections in the output: the input .obj order is .text, .data, .bss; the linked output puts .data, .bss, .text in xhello.coff. A loader must not assume .text is first.

1.4 Symbol table and relocations

Symbols are 18 bytes: 8-byte name, 4-byte value, 2-byte section number, 2-byte type, 1-byte storage class, 1-byte aux count. Section symbols have one 18-byte aux entry (the section size). Names longer than 8 characters live in the string table; the 8-byte field is then an offset.

Relocations are 10 bytes: 4-byte address (bit address in the section), 4-byte symbol index, 2-byte type. Documented types (Assembler Tools Guide, Table A-7):

type	mnemonic
0x10	R-RELWORD (16-bit direct)
0x11	R-RELLONG (32-bit direct)
0x18	R-OCRLONG (1's-complement 32-bit)
0x19	R-GSPPCR16 (16-bit relative, words)

The .obj has relocations; the linked -a output has none (see §2).

1.5 Entry point

GSPLNK writes the entry only when -e names a global symbol. With .def _start in the source and -e _start in the command file, the map says:

ENTRY POINT SYMBOL: "_start"  address: 018C0000

and the optional header entry is 0x018C0000. Without a global _start (dwt/gui/xhello.asm has a local _start), the map says ENTRY POINT SYMBOL: 0, the optional entry is 0, but textstart is still 0x01840000. The loader therefore uses:

entry = optional.entry if nonzero, else optional.textstart

For the SDK flow, the entry is the first instruction of .text (_start) when no -e is given. It is not the raw file offset and not the section index.

---

2. Position-dependent, not relocatable

The linked image is fully resolved and position-dependent. The loader must place each section at the bit address in its header; it cannot load anywhere and relocate.

Evidence, from dwt/loader/reldemo.sh (full output in dwt/loader/evidence/reldemo.txt):

1. Two objects with cross references (rel_a.asm calls ext_func and loads ext_data; rel_b.asm defines both) carry real relocations in the .obj:

   sec 1 .text ... size=0xa0 bits (20 B) scnptr=0x8c nreloc=2 flags=0x20 [text]
       reloc at 0x10 sym=8 type=0x11 R-RELLONG
       reloc at 0x70 sym=7 type=0x11 R-RELLONG
   

2. Linking those objects with -a produces an output whose sections all have nreloc=0:

   sec 1 .text paddr=00018c0000 ... nreloc=0
   sec 2 .data paddr=00018d0000 ... nreloc=0
   

3. Linking the same objects at two origin sets (018C0000/018D0000/018D8000 and 018E0000/018F0000/018F8000) produces different bytes — the absolute ext_data/ext_func operands:

   == .text: 22 vs 22 bytes
      differing bytes: 2
        0x0004: 8d -> 8f
        0x0010: 8c -> 8e
   

   The marker app behaves the same way: with .text linked at 018C0000 it contains the immediate 0x018C0000; at 018E0000 the same byte changes to 0x018E0000. movi _start and calla are absolute.

4. Linking without -a still yields nreloc=0 (and paddr values relative to 0, i.e. an unbound image). GSPLNK 2.00 does not emit a relocatable executable for this flow; the toolchain's "relocatable" form is the input .obj, not the linked image.

Consequence: the loader copies to the linked address and does not malloc the segments. It refuses any input COFF that still carries relocation records (status 7), rather than guessing at relocation semantics. That also catches the easy mistake of feeding the .obj instead of the linked .out.

What "fixed address" means for the loader

The loader checks that the target range lies inside one block of the firmware's global free list (head at bit 0x1E8AC0, block header {u32 size_bits; …; u32 next@+0x20}, user data at block+0x40; see dwt/notes/HEAP.md). This is a check, not a reservation: the loader cannot make malloc return a chosen address. The caller is responsible for choosing a link address that is free when the app starts and for not handing that range out later. The loader's own page and the COFF buffer are checked separately for overlap.

---

3. ELF: not produced, not supported

The 1987 toolchain has no ELF output. The Assembler Tools Guide describes COFF as the object format and GSPROM as the converter to EPROM formats:

"The object format converter converts a COFF object file into Intel hex, Tektronix hex, or TI-tagged object format."

The only "ELF" case-insensitive hits in the assembler/C guides are unrelated words (the CIF command text). There is no ELF writer, no ELF reader and no ELF linker option. The 1990 OS/2 r5.01 tools are also TI COFF, not ELF. So the loader targets COFF only; an ELF loader would have nothing in this SDK to load. (dwt/loader/evidence/elf_absent.txt records the check.)

---

4. The loader

Source dwt/loader/loader.asm, built by dwt/loader/build.sh and delivered as raw bytes at its linked bit address.

item	value
loader link/load address	bit 0x01880000 (byte 0x310000)
loader .text size	0x2620 bits = 1220 bytes
reserved loader page	bits 0x01880000..0x01883200
descriptor	bit 0x01882C00
result block	bit 0x01882D00
return stub (harness only)	bit 0x01883100
app stack	create_process allocates it; the loader passes 0x6000 bytes
create_process	bit 0x3F706A40 / Ghidra 0x07EE0D48

The loader is position-dependent itself: its labels are absolute, so the raw image must be placed at 0x01880000. That is acceptable for the current delivery (debugger now, transport later); relinking the loader is a build-time change, not a runtime one.

4.1 Interface

The loader takes a 16-byte descriptor either at the fixed address or through A8. Offsets below are byte offsets; the assembly uses the equivalent bit offsets (+0, +0x10, +0x20, +0x40, +0x60):

DESC + 0x00  u16  0x4C44   "LD"   ) both must match
DESC + 0x02  u16  0x5231   "R1"   )
DESC + 0x04  u32  buf            bit address of the COFF image
DESC + 0x08  u32  len            image length in bytes
DESC + 0x0C  u32  mode           1 = return to caller; 0 = debug resume

A8 may be 0 (fixed descriptor) or the descriptor's bit address. Any other value falls back to the fixed descriptor if it does not carry the magic. The loader reads buf, len and mode once and then parses the COFF.

The result block is at 0x01882D00, 32-bit cells at +0x20 intervals:

offset	meaning
+0x000	status: 0 = OK, else error 1..10
+0x020	entry passed to create_process (bits)
+0x040	.text paddr (bits)
+0x060	.text size (bits)
+0x080	.data paddr / +0x0A0 size
+0x0C0	.bss paddr / +0x0E0 size
+0x100	relocation records seen
+0x120	PCB returned by create_process
+0x140	section count
+0x160	descriptor length (bytes)
+0x180	loader base sanity value 0x01880000

Status codes: 1 bad descriptor; 2 truncated file/section headers; 3 bad COFF magic; 4 section size not a whole number of 16-bit words; 5 target outside RAM; 6 target overlaps the loader page or the COFF buffer; 7 relocation records present; 8 target not inside a global free-list block; 9 no entry point; 10 create_process returned 0.

4.2 Algorithm

1. Save A14 and SP, set 16/32-bit field sizes, read the descriptor.

2. Read the file header: magic 0x0090, nscns, opthdr; check 20 + opthdr + nscns*40 <= len.

3. Read the optional header: entry, else textstart.

4. For each 40-byte section header:

   • record the first .text/.data/.bss address and size from flags;
   • refuse if nreloc != 0;
   • require size % 16 == 0;
   • check scnptr + size/8 <= len when scnptr != 0;
   • check 0x100 <= paddr and paddr + size <= 0x2000000 (4 MiB of bits);
   • check the range does not overlap [0x01880000,0x01883200) or the COFF buffer;
   • check the range is inside one global free-list block;
   • if scnptr != 0, copy size/16 words from buf + scnptr*8 to paddr;
   • else store size/16 zero words at paddr (this is .bss and also any uninitialized named section).

5. Call create_process(entry, "LOADER", 0x6000, 1, 0) with the firmware's upward-argument convention (the same shape as dwt/gui/xlaunch.asm):

   move  a14, -*sp, 1
   movi  ARG_AREA, a14, L
   movi  0, a0, L       / move a0,*a14+,1   ; arg4 = 0
   movi  1, a0, L       / move a0,*a14+,1   ; arg3 = 1
   movi  6000h, a0, L   / move a0,*a14+,1   ; arg2 = stack bytes
   movi  appname, a0, L / move a0,*a14+,1   ; arg1 = name
   move  entry, a0, 1   / move a0,*a14+,1   ; arg0 = entry (bits)
   calla 3F706A40h
   

6. Store A8 (the PCB) and the status. If mode == 1, restore SP/A14, return the status in A8 and rets. If mode == 0, restore the interrupted state and jump to the PC the harness saved, so the OS idle loop runs and schedules the child.

4.3 Why mode 0 returns to the idle loop

A payload that spins forever in the current process starves the firmware's scheduler in this OS: the child is created but never runs. The first loader version did exactly that (PC=01882460, no markers). The fix is to restore the hijacked context and resume at the saved PC (the OS idle loop), which yields. Mode 1 returns to the caller instead; a transport that returns to its own event loop behaves the same way. The debugger harness also builds a return stub (jauc <orig_pc>) for mode 1, so both modes were exercised without a spin.

---

5. Evidence

5.1 Marker app: sections placed, .bss zeroed, child scheduled

dwt/loader/build/marker.coff, linked at .text 018C0000, .data 018D0000, .bss 018D8000. The harness pre-fills .bss with 0xA5A5 before the load. LOADER_MODE=0:

LOADER: result status=0 (OK) entry=018C0000 text=018C0000/656 bits data=018D0000/64 bits bss=018D8000/64 bits relocs=0 pcb=003FFBD0 nscns=3 len=510
LOADER: placed .text at 018C0000: 82 bytes, 0 differing
LOADER: placed .data at 018D0000: 8 bytes, 0 differing
LOADER: marker app: start=018C0000 data=DEADBEEF data2=12345678 bss=00000000 count=619

• start=018C0000 is the app reading its own _start label: it ran at the linked address.
• data=DEADBEEF, data2=12345678: .data was copied.
• bss=00000000 after an A5A5 pre-fill: .bss was zeroed by the loader.
• count grows every sample: the child is live, not a one-shot jump.
• pcb=003FFBD0: create_process returned a real PCB.

LOADER_MODE=1 (descriptor + A8 variants) gives the same status and markers; the loader returns to the caller (dwt/loader/evidence/marker_mode1_run.log, marker_a8desc_run.log).

5.2 xhello: an X window from a created process

Same loader, dwt/loader/build/xhello.coff (entry 0, textstart=01840000):

LOADER: result status=0 (OK) entry=01840000 text=01840000/3120 bits data=00000000/0 bits bss=00000000/0 bits relocs=0 pcb=003FFBD0 nscns=3 len=774
LOADER: placed .text at 01840000: 390 bytes, 0 differing
LOADER: xhello: stage=6 strlen=4 display=006BC910 root=0001006B window=00010001 sync=00060001

stage=6 is the last marker in xhello.asm (after XSync), and the frame dump dwt/loader/evidence/loader_frame2650.png shows the black 400x200 window with the WM title bar at (100,100), over the Terminal Manager. The root/window cells are unreliable here because xhello's marker cells are only 0x10 bits apart and a 32-bit write overlaps the next cell; stage and the frame are the evidence. (The same overlap exists in the committed xhello markers; it does not affect execution.)

5.3 Negative: an unlinked .obj is refused

LOADER_COFF=dwt/loader/build/rela.obj (the two-object demo input):

LOADER: result status=7 (relocation records present (unsupported)) entry=00000000 ... relocs=2 pcb=00000000
LOADER: placed .text at 00000000: 20 bytes, 5 differing

The loader saw the two R-RELLONG records, refused before copying, and left the target memory untouched. This is the correct failure for the transport sending a .obj rather than the linked .out.

---

6. What the TFTP transport must hand it

See dwt/notes/LOADER_CROSS.md for the append-only interface note. In short:

• a RAM buffer holding the complete GSPLNK COFF, with its bit address and byte length;
• the loader resident at 0x01880000 (raw dwt/loader/build/loader.bin);
• a descriptor at 0x01882C00 with buf, len, mode=1;
• a normal calla 0x01880000 (or A8 = descriptor address);
• the loader chooses the load address from the COFF and returns status in A8.

The transport does not pass a load address, and it must not use mode=0 (that mode resumes the debugger-hijacked PC).

---

7. Limits and failure modes

• Position-dependent. The image must be linked for the address it will run at; the loader never relocates. A moved image is a different link.
• No reservation. The free-list check proves the target is in a free block now; nothing stops a later malloc from splitting that block into the app's address. Link apps away from the allocator's low-address growth, as the current examples do (the big free block grows from byte 0x12191A upward; the apps are at byte 0x318000+).
• No relocation records. Status 7. The SDK cannot emit them in a linked image anyway.
• Word-granular. Section sizes must be multiples of 16 bits; the copy and zero loops move 16-bit words. GSPA/GSPLNK always emit such sizes.
• Fixed loader address. The loader's own code is absolute. A transport that wants the loader elsewhere must relink it, not move it.
• One process per call, no unload. create_process gets a name string "LOADER", a 0x6000-byte stack and arg = 0; the loader has no argv or environment channel. create_process returns 0 only on failure (status 10).
• The COFF buffer must not overlap the loader page or the target sections. The loader checks both; the transport must keep its own receive buffer and code out of the target range too (the loader cannot know about them).
• Heap-list read. Only the global free list is walked (the per-arena lists are unsafe to follow — HEAP.md). If the list is empty or the target is not in it, the loader fails with status 8 instead of corrupting memory.
• C runtime. .text/.data/.cinit/named initialized sections are copied and .bss is zeroed, but the loader does not run the .cinit table; a C app must still enter through _c_int00 and do its own autoinit as the SDK runtime expects. The loader's entry is whatever the COFF says.

8. Reproduce

# loader (raw image, fixed address)
./dwt/loader/build.sh dwt/loader/loader.asm 01880000

# marker app: three sections at three addresses
./dwt/loader/build.sh dwt/loader/marker.asm 018C0000 018D0000 018D8000

# xhello COFF (entry stays 0; the loader uses textstart)
./dwt/loader/build.sh dwt/gui/xhello.asm 01840000

# relocation / position-dependence demo
./dwt/loader/reldemo.sh

# debugger-assisted run (no network, private NVRAM/cfg)
VT1200_SKIP_LEVEL1=1 LOADER_AT=2500 LOADER_END=2620 \
LOADER_COFF=dwt/loader/build/marker.coff LOADER_OUT=$PWD/dwt/loader/evidence \
/home/arti/code/k-space/mame0289/vt1200 vt1200 \
  -rompath harness/mame/roms -video none -sound none -nothrottle -skip_gameinfo \
  -nvram_directory $PWD/dwt/loader/run/nvram \
  -cfg_directory $PWD/dwt/loader/run/cfg \
  -debug -debugger none \
  -autoboot_script dwt/loader/loader.lua -autoboot_delay 0

LOADER_MODE=1 exercises the callable/return path; LOADER_A8_DESC=1 passes the descriptor in A8; LOADER_SNAP=1 writes a PNG at LOADER_END.

9. Evidence files

path	contents
dwt/loader/loader.asm	the loader
dwt/loader/marker.asm	marker app with .data/.bss at separate addresses
dwt/loader/coff.py	COFF reader / dumper (summary, raw, manifest)
dwt/loader/build.sh	SDK build wrapper, keeps the COFF
dwt/loader/reldemo.sh, rel_a.asm, rel_b.asm	relocation / origin demo
dwt/loader/loader.lua	debugger-assisted harness (no network)
dwt/loader/probe_os.lua	heap-list + register-write probe used to design the harness
dwt/loader/evidence/coff_layout.txt	hexdump + parsed headers of marker/xhello/obj
dwt/loader/evidence/reldemo.txt	the full relocation/origin output
dwt/loader/evidence/elf_absent.txt	the ELF check
dwt/loader/evidence/marker_run.log	mode-0 marker run
dwt/loader/evidence/marker_mode1_run.log	callable/return run
dwt/loader/evidence/marker_a8desc_run.log	descriptor in A8
dwt/loader/evidence/xhello_run.log	xhello run
dwt/loader/evidence/loader_frame2650.png	the xhello window
dwt/loader/evidence/reloc_refused.log	.obj refused with status 7

---

10. End-to-end host-side loader (rdebug): malloc -> poke -> load -> run

Date: 2026-10-18. Driver: dwt/loader/hostload.py. Evidence: dwt/loader/evidence/hostload/ (its README.md indexes the logs and PNGs). This is the integration of the two existing halves; the loader and the apps are unchanged.

Exact sequence (one TCP connection to 192.168.99.2:771)

1. opcode 7 liveness; the computed challenge is answered by dwt/challenge.py (the RDebug default).
2. jump 0x3F701230 (malloc) with one argument, the COFF byte length. jump returns the callee's A8, i.e. a bit pointer.
3. Poke the COFF to that bit pointer in 1024-byte chunks (bit + off*8, never bit + off) and peek it back: 510/510 or 774/774 bytes equal, sha256 matches the local file.
4. Poke the raw loader (build/loader.bin, 1220 B) at bit 0x01880000, then peek it back (610 words, 0 differing). --no-poke-loader skips the write and requires that readback to match.
5. Build the 16-byte descriptor at bit 0x01882C00 from bit offsets +0/+0x10/+0x20/+0x40/+0x60 (bytes 0/2/4/8/12): 44 4c 31 52 <buf LE32> <len LE32> 01 00 00 00.
6. jump 0x01880000 with zero arguments. The rdebug jump handler's zero-arg path is a bare CALL after MOVE A9,A8 with A9 = 0, so the loader enters with A8 = 0 and uses the fixed descriptor. (With N args the stubs do not set A8 to the descriptor either; A8 = 0 is the reliable calling convention from rdebug.)
7. Read the result block at bit 0x01882D00, then app evidence: marker cells by peek, or xhello stage/strlen plus a VRAM screenshot.

What worked (two or three fresh boots each)

• jump(malloc) returns a usable, byte-aligned bit pointer in the firmware heap: 0x007c7290 (byte 0x0F8E52), 0x007c8030 (byte 0x0F9006), 0x007df450 (byte 0x0FBE8A), 0x00adcd90, 0x009fccd0. These are far below the loader page (0x01880000, byte 0x310000) and below the current apps (.text byte 0x318000), and hostload.py rejects a pointer that overlaps either, the loader page or the marker cells.
• The loader accepts a malloc'd buffer: status 0 and A8 = 0 on every run. Its free-list check (status 8) passed for .text 0x018C0000 and for xhello .text 0x01840000; the result block reports entry/text/data/bss, pcb != 0, nscns=3, and loader_base=0x01880000.
• create_process really runs the app: marker.coff leaves start=0x018C0000, data=0xDEADBEEF, data2=0x12345678, bss=0, and a live counter; xhello.coff reaches stage=6 (XSync) and its black 400x200 window is visible at (100,100) in hostload_xhello_boot{3,4}_xhello.png.
• --tftp also works: the existing dwt/tcpip/tftpc.bin (bit 0x01870000) fetches into its own malloc buffer (stage=4, total=510, done=0x05A5A5A5); peek matches the COFF byte-for-byte, and that buffer is fed to the same descriptor/loader. Server RRQ, boot 3 and 4: ... requested 'dwt/tcpip/probe.bin' (510 bytes).

Two traps found

1. Result-block offsets are bits. loader.asm's RESULT_BASE+020h is +4 bytes, so the block is 13 adjacent 32-bit cells (52 B), not cells at byte intervals of 0x20. Reading at byte offsets 0x20, 0x40, ... returns 0x55555555 from the free heap beyond the real block; that was a host parsing bug, not a loader failure.
2. The descriptor is clobbered after a load. A successful create_process leaves a call frame at 0x01882C00 (0d 00 00 00 <pcb> <ptr> 00 60 00 00); ARG_AREA is 0x01882B00 and the frame is 0x100 bits wide. The loader has already consumed the descriptor, and the result block (0x01882D00) is untouched, but a second call must rewrite the descriptor. hostload.py does so immediately before every jump.

Limits

• No reservation. malloc only finds a buffer; the loader's free-list check is still a check. The apps stay linked at byte 0x318000/0x308000 while allocations grow from the low free blocks; enough allocations on one boot would eventually split the big block up to them. Fresh-boot runs are safe; on a long-lived unit the caller must still choose a free link address.
• --tftp needs a server that serves the COFF under tftpc's fixed name (dwt/tcpip/probe.bin); tftpc.asm has no filename argument. The server used here was serve_probe.py 192.168.99.1 --bootp --file dwt/loader/build/marker.coff.
• --frame N cannot trigger a MAME dump. It only waits for vt1200-frame-N.ppm from an externally configured VT1200_DUMP_FRAME(S); frame numbers are boot-relative, so the load-relative visual evidence is the rdebug VRAM screenshot.
• The loader is still position-dependent and fixed at 0x01880000, and the loaded images are position-dependent; none of this adds relocation.
• rdebug process only: create_process is used for the app, not for the loader or the TFTP client. A create_process child previously returned -1 from socket() (TCPIP.md), so the fetch stays in the rdebug process.
• The real unit would need TCP 771 reachable and the same debug-gate state; the emulator run uses the documented VT1200_SKIP_LEVEL1=1 divergence to reach the OS.