dwt: gate B is real; challenge args must follow the answer

dwt/notes/CROSS.md

@@ -164,3 +164,36 @@ in the field that matters.
 to use `tap-mess-1000-0` / bridge `vt1200` for a short live TCP test.  If you
 start a MAME instance, please leave the tap alone for a few minutes or note it
 here.
+
+## 2026-10-18 02:40 EEST — exploit agent: gate B is real; args must follow the challenge
+
+Live result against the emulated terminal (`VT1200_SKIP_LEVEL1=1`, LANCE on the
+tap, BOOTP address 192.168.99.2):
+
+* **Gate A is not a gate.**  A TCP connection to 771 reached
+  `accept_debug_conn`, the dispatcher and `dwt_prf` (breakpoints fired).  The
+  `0xAECD2` compare is a 2-bit field read by `SETF 2`; it is 0.  Do not patch
+  the 16-bit word at `0xAECD0`.
+* **Gate B is real.**  `dwt_prf` sends 16 bytes (flag 0x7F) and requires exactly
+  16 back.  Echo gives `memcmp = 0xFFFFFFFF` and the session is killed.  The
+  expected value is the wire challenge with each **32-bit word byte-swapped**
+  (the code ntohl's the host words into the send buffer and memcmp's the
+  host-order copy), but even that ("computed") gives `memcmp = 0x00000001`:
+  the received buffer is first rewritten in place by a fixed-key font/cipher
+  pipeline (`0x3F5A09C0` → two 8-byte records → `0x3F5ABA40`, tables at
+  `@0x1C0220`/`@0x1C0240`, cipher `0x3F5ACEC0`).  Not inverted here.
+* **Opcode ≥ 2 all require the challenge, including 7.**  Only 0 and 1 skip it,
+  and neither reaches poke/jump.
+* **Protocol ordering matters:** send the opcode alone, read and answer the
+  challenge, *then* send the handler's arguments.  If the args go with the
+  opcode, `dwt_prf` eats their first 16 bytes as the answer and the handler
+  reads shifted fields (a peek length of 8 was reported as "maximum peek size").
+* With the challenge comparison forced to 0 **by a debugger breakpoint** (not
+  remotely), the real `poke`/`jump` handlers delivered and ran
+  `harness/hello-world/payload.bin`: `MAGIC1=DEAD MAGIC2=BEEF COUNT=0400`,
+  VRAM 1024/1024.  That is the debugger-assisted loader proof, not a remote
+  bypass.  Poke/peek addresses are bit addresses; ROM writes are ignored.
+
+The tap (`tap-mess-1000-0` / bridge `vt1200`) is free again as of 02:40; the
+MAME instance and the BOOTP server are stopped.  Full write-up:
+`dwt/notes/EXPLOIT_ATTEMPT.md`; transcript and logs under `dwt/evidence/`.