24d: round stop — two-instance hypothesis untested (scan2.py debugger mismatch vs rendersnap documented); consumer hunt state fully recorded: static xrefs exhausted, dynamic traps blocked under wine, conv engine object identified, glue method pending decode

handoff/BLOCKMAP_529fe0.md

@@ -153,3 +153,77 @@ for i in 1..n-1:
 Незакоммичено: f529fe0_full.dis, BLOCKMAP_529fe0.md, thunk-резолвер,
 правки NOTES_LEVEL (22v будет добавлена при транскрипции). Следующий шаг —
 транскрипция process_frame_faithful по этой карте.
+
+## ДОПОЛНЕНИЕ 23b: резолв ILT + декод FIR-цикла (52b550–52b8bb)
+
+### Резолвер
+`scripts/ilt_resolve.py`: стаб = `mov eax,[rip+idx]; lea r10,[rip+tbl]; jmp [r10+rax*8]`;
+live idx=4 у всех; таблицы @0x1826xxxx. Полная таблица «стаб→impl»:
+| стаб | impl | роль (уточн.) |
+|---|---|---|
+| 0x180002210 | 0x136e0 | copy scratch→FIR? (валидатор → 39de0/3a040/3a220) |
+| 0x180002180 | 0x125e0 | complex-op A/C float (воркер 3a4a0; r9 НЕ передаётся ⇒ длина из объекта) |
+| 0x180001bb0 | 0x6a40  | complex-op A/C double |
+| 0x180001a90 | 0x5560  | complex-op B/D float — ЧИСТЫЙ FMA (fma=28, mul/add=0!) |
+| 0x1800019d0 | 0x4340  | complex-op B/D double |
+| 0x180001880 | 0x2c60  | paired-scalar op 1 (флаг-ветка) |
+| 0x180001ca0 | 0x9380  | paired-scalar op 2 |
+| 0x180001df0 | 0xb3c0  | final op float |
+| 0x180001f70 | 0xe360  | final op double |
+| 0x180140a10 | 0x141400→[1826181d8]=**0x1802a24c0** | дизайн float |
+| 0x180140a70 | 0x141580→[1826183c8]=**0x1802fa420** | дизайн double |
+| 2030/1d30 | ffe0 / 9be0 | scalar-transform |
+| 2270/22a0 | 14c40 / 15060 | scalar-transform-2 |
+| 2000/1c40 | fb60 / 8700 | axpy-класс |
+| остальное | dc40,8d60,5a20,4720,4200,3f40,5160,25e0,ee20,3c40 | как в BLOCKMAP ✓ |
+
+### Дизайн-тело 0x1802a24c0 (float, вход=rcx bands[i], выход=rdx scratch@0x540628)
+Функция входа 0..0x675 (~1.6КБ), далее сиблинги. Алгоритм = **ВЕКТОРНЫЙ LOG2**
+(range reduction бит-трюком с 0.6666667, полином Хорнера на YMM-константах
+−0.5, 0.3333656, −0.2500466, 0.198225, −0.1646246, 0.1696488, −0.1517721,
+реконструкция ×ln2=0.6931472; константы @FN+0x1cdfac0..d20). Маскированный
+хвост через vmaskmovps/popcnt-таблицы (@0x181F8xxxx). ИТОГ: **scratch = log(bands[i])**.
+Диспетчер 535a70 делает swap аргументов (rcx↔rdx) перед прыжком!
+
+### Структура FIR-цикла (полностью залочена)
+На полосу: 2×scalar-transform(bands[i], xmm8·[540888] при флаге 540890==0, иначе
+xmm8; затем xmm12−xmm8) [ср. decomp 184-185: A=[0x540874]−expf(K), wet=[0x540888]]
+→ DESIGN=log(bands[i])→scratch → copy(scratch→FIR@0x540668) [2210]
+→ opA(FIR,buf548,buf598) [2180/1bb0] → FIR[n]=0 (n=0x540534=4096!)
+→ 52d920(&FIR[1], xmm13, n/2−1) деление; 52db50(&FIR[2049], xmm9, n/2−1)
+→ opB [1a90/19d0] → bigkernel in-place 140b30/140aa0 (n/2+1)
+→ opC [2180/1bb0] → FIR[n]=0 → 52d990(FIR, WIN_freq+n/2, n/2) УМНОЖЕНИЕ на
+**падающую половину Hann** (WIN_freq=wperiodicHann4096: w[1024]=0.5,w[2048]=1.0!)
+→ 52db50(&FIR[2048], xmm9, n/2) → opD [1a90/19d0] → FIR[0]=1.0, FIR[1]=0
+→ флаг-ветка: парно-скалярные 1880/ca0 → dry/wet scale ×[0x540888] над **2n флоатов**
+→ final(df0/f70) с сохранённым track_i ([rsp+0x138][i]).
+
+### Живые буферы (firtrace.py по s1/s2 + свежие захваты dual_b1q_0.5)
+- 0x540658 WIN_freq = периодический Hann(4096), пик 1.0 @bin2048 (НЕ рамп 0.5→0.8!)
+- 0x540758 freqaxis = линейный, шаг ≈11.713 Гц (≈48000/4096=11.71875, лёгкое
+  занижение — похоже на накопительную ошибку f32 при построении суммой)
+- 0x540598 = SIMD-маски: 8×1.0 / 8×0.0 периодом 16 флоатов, ровно 1024 шт
+  (YMM lane-select для комплексных кернелов)
+- 0x540550 NULL (float-путь активен, флаг 0x5408b8=0); 0x540628 scratch нулевой
+  между колбеками; 0x540668 FIR = комплексная единица (1,0)×2049 бинов МЕЖДУ
+  колбеками — кернел потребляется и сбрасывается внутри колбека
+- 0x5406f8 хранит аудио-масштабный сигнал (~±0.1) между колбеками — overlap/STFT
+  буфер conv-движка (не «нулевой acc»!)
+- 0x540788 vs 0x5407f8 различаются (max 1.108; @171: 1.751 vs 1.409) — две РАЗНЫЕ
+  кривые; ни одна не достигает нужных 3.89×@171 (11.82 дБ) ⇒ применённый фильтр
+  ≠ поточечная копия любой из живых кривых (подтверждение разрыва 22y)
+
+### Динамика (попытки перехвата; окружение)
+- realtime-playback НЕ тикает DSP (нет аудио-девайса; треды спят в futex);
+  кривые 22y = результат инициализации при загрузке проекта
+- `-renderproject`: полный цикл init+render+exit хоста занимает ~0.8 c
+  (host@1.2s, workers@1.4s, wav@1.6s, exit@2.0s); обработка идёт в окне ~0.5 c
+- INT3-ptrace: SEIZE+TRACECLONE обязательны до CONT (иначе untraced thread
+  ловит SIGTRAP и убивает процесс — подтверждено); DR-брейкпоинты: DR0@user+0x380,
+  но POKEUSER DR7 даёт EIO. Скрипты: fntrace*.py, fnhw.py, fnall.py, firstop.py,
+  firtrace.py, hotips.py (см. scripts/)
+- Вывод: FUN_180529fe0 и 52d650/536300/52e260 НЕ ловятся в рендер-окне —
+  маск-цепь выполняется при ЗАГРУЗКЕ/изменении параметров, стационарный рендер
+  использует закэшированный кернел; либо трассировать надо момент инициализации
+- Выход плагина НЕдетерминирован: md5 двух свободных рендеров различен при
+  одинаковом rms (PRNG-дизеринг из LCG-прологов) — метрика только спектральная!

handoff/NOTES_LEVEL.md

@@ -2224,3 +2224,363 @@ dual НЕ в пост-обработке кривой R.
 0x1802a24c0 (3КБ AVX2) и complex-op шагов с буферами 0x540548/550/598 — следующий
 статический шаг; альтернатива — трассировка промежуточных буферов живьём
 (снапшоты в момент аудио-колбека, не между кадрами).
+
+## ============ UPDATE 2026-08-23g (23b): ДИЗАЙН=LOG(band), Hann-окно, PRNG-дизеринг ============
+
+### Что доказано декодом (детали в BLOCKMAP 23b)
+1. Полная цепь построения FIR на полосу залочена по raw asm (52b550–52b8bb):
+   scalar-shape ×2 → **DESIGN: scratch=log(bands[i])** (векторный log2, полином
+   идентифицирован по константам, тело 0x1802a24c0) → copy→FIR@0x540668 →
+   4 комплекс-op (A..D) на буферах 0x540548(SIMD/twiddle-workspace)/0x540598
+   (YMM-маски 8×1/8×0×64) вокруг нормировки &FIR[1]÷K и bigkernel →
+   **FIR[2048..4095] ×= Hann_freq[2048..4095]** (падающая половина периодического
+   Hann(4096), пик ровно на стыке!) → FIR[0]=1,FIR[1]=0 → dry/wet над 2n флоатами.
+   Структура log→ops→exp-класс + окно = классический frequency-sampling /
+   минимально-фазовый дизайн кернела. Гипотеза механизма скайрта: геометрия
+   задаётся ОКНОМ и комплекс-ops на log-спектре, а не постобработкой R.
+2. WIN_freq опознан численно (w[1024]=0.5,w[2048]=1.0) — прежняя трактовка
+   «0.5→0.8» относилась к другому слоту (0x540698).
+3. freqaxis: шаг 11.71303 vs точные 11.71875 — накопительная f32-ошибка построения;
+   сетка внутренняя 48k/4096 подтверждена независимо.
+4. Выход плагина недетерминирован от рендера к рендеру (md5 разные, rms равные) —
+   LCG-прологи реально дизерят; честная метрика только спектральная.
+
+### Динамика: почему живые кривые «статичны»
+Realtime-playback без аудио-девайса НЕ вызывает processing (все треды спят);
+кривые 22y — продукт инициализации проекта. `-renderproject` прожимает весь
+цикл за ~0.8 c (init+render+exit); перехват требует SEIZE+TRACECLONE ДО первого
+CONT главного треда. FUN_180529fe0/52d650/536300/52e260 не ловятся в рендер-окне
+⇒ маск-цепь выполняется при загрузке/param-change, рендер использует кэш.
+Следующий динамический шаг (если понадобится): bp на входе process-callback vtbl
+или трасса окна init (поймать DESIGN в момент param-change).
+
+### Инструментарий этого раунда (закommичено)
+scripts/ilt_resolve.py (резолв стабов офлайн), scripts/firtrace.py (полный каталог
+буферов + GUI-флаг 0x2404bc), scripts/firstop.py (SIGSTOP-семплирование),
+fntrace*.py/fnhw.py/fnall.py (ptrace-лаборатория: INT3/DR, уроки — см. BLOCKMAP),
+hotips.py. .dis тела: conv_float_a24c0, conv_double_fa420, imp_*, th_* (19 impl).
+
+### Контрольные числа dual (цель раунда, неизменны)
+cut@500=10.32 дБ const ∀q; @2000=11.82 @q=0.5; Δcut≈2.25·(−ln res).
+Модель сейчас: −0.18/@500-ок + провал скайрта.
+
+### NEXT (пересмотр после декода)
+1. numpy-реплика цепи log→opsA-D→window с КАЛИБРОВКОЙ ops по измеренным H(f)
+   (корпус референсов уже есть); критерий — воспроизведение Δcut(res) геометрии.
+2. Если ops A-D ≈ exp-раундтрип со сглаживанием: транскрипция за RT_FIRCONV,
+   гейт corpus --vs-bridge + контрольные числа dual.
+3. ptrace-эскалация ТОЛЬКО если численная репликация не сойдётся: цель —
+   брейкпоинт в момент param-change (init-окно хоста), а не рендер.
+
+### 23c (короткое): феасибилити log-свёртки — ОТРИЦАТЕЛЬНЫЙ результат
+На живой кривой R@0x5407f8 (dual q=0.5): подбор ОПТИМАЛЬНОЙ симметричной
+гаусс/бокс-свёртки в log-домене (ширина до 1500 бинов, свободный аффинный сдвиг,
+точное совпадение @bin43=10.32 дБ) даёт минимум ошибки на bin171 ≈ 0.94–1.10 дБ
+при ширине ~314–324 бина (~3.7 кГц) — такая ширина уничтожает избирательность
+нотча на всём остальном корпусе. Вывод: механизмы класса «свёртка log-маски с
+симметричным ядром» геометрию dual НЕ воспроизводят (расширяет теорему 22x с
+поточечных законов на симметрично-свёрточные). Остаются: (а) вход bands[i] у
+DESIGN ≠ захваченные кривые (768/788/7f8 — возможно, GUI/init-версии);
+(б) асимметричные/структурные ops (cepstral-liftering класс); (в) темпоральный
+кросс-фрейм механизм. Решающий недостающий факт — ИСТИННЫЙ массив bands[0] в
+момент вызова DESIGN; рецепт добычи: seize главного треда yabridge-host в момент
+ПОЯВЛЕНИЯ pid (ppid=reaper, comm ещё 'wine'), INT3 на 0x1802a24c0/0x1802fa420,
+CONT, дамп rcx/rdx на хите (скрипт fnall.py готов, нужен только ранний захват —
+нынешний finder по maps опаздывает на init-бурст <5 мс).
+
+## ============ UPDATE 2026-08-23h (23d): ПРОРЫВ — ЖИВОЙ КЕРНЕЛ СНЯТ, bands[] = СПЕКТР СИГНАЛА ============
+
+Маршрут A удался БЕЗ ptrace и БЕЗ аудио-девайса: **SIGSTOP-семплирование
+офлайн-рендера** (`-renderproject`; обработка back-to-back ⇒ случайные остановки
+попадают внутрь конвейера). scripts/rendersnap.py: find-loop ctx (vtable-маркер
+0x1824AC210 / float 48000+ sens; ctx=0x2370040 стабилен и в рендере),
+затем STOP→читаем все слоты→CONT c детекцией изменений. 24 фазы за прогон.
+
+### Решающие факты из phase-снапов (dual q=0.5)
+1. **bands[0] @ctx+0x540678 = АМПЛИТУДНЫЙ СПЕКТР ТЕКУЩЕГО ФРЕЙМА**:
+   ненулевые группы ТОЛЬКО вокруг тонов (бины 41–45 и 168–173, Hann-лепестки;
+   band[43]=7.65, band[171]=9.91), между ними нули. Это вход DESIGN, НЕ шаблон
+   маски и НЕ пост-детекторная кривая!
+2. scratch@540628 ≈ log(bands)·k (после ops значения −0.66@43, −0.76@171).
+3. Живой FIR@668 (комплексные пары): mag(43)=0.524 (−5.61 дБ), mag(171)=0.473
+   (**−6.51 дБ**) — скайрт режется ГЛУБЖЕ центра, КАК В РЕАЛЕ (+1.5 дБ),
+   хотя кривая R@7f8 утверждает обратное (R171=1.41<R43=3.98).
+4. Количественно из снапа: cut≈A+S·log2(am/res) с res(43)=1.0, res(171)=0.839
+   (twin-шаблон из таблицы 22x!) даёт согласованную пару — **структура
+   am/res ПОДТВЕРЖДЕНА, но входом служит сырой спектр сигнала**, а res-шаблон
+   полосы входит делителем (где именно в цепи ops A-D — осталось залочить).
+
+### Почему раньше «не ловилось»
+- realtime без аудио-девайса не вызывает process вовсе (alsa_outdev пуст!);
+- в render-mode инстанс создаётся ~через 0.3 c после host-spawn: ранняя остановка
+  ловит нулевую фазу (первые 12 «хитов» были ей);
+- после создания экземпляра кернел живёт в непрерывном перестроении — STOP-цикл
+  читает его спокойно.
+
+### Следующий раунд (рецепт готов, данные добываются rendersnap.py за минуту)
+1. Прогнать rendersnap на dual q∈{0.1,1,3,10} + t1kq + al: собрать пары
+   (bands, scratch, FIR) → восстановить точную формулу ops (ожидаем exp(log·K)
+   со сглаживанием/варпом res-шаблона; проверить FIR vs exp(scratch)).
+2. Объяснить абсолютную глубину (снап даёт −5.6/−6.5 против реала 10.32/11.82):
+   кандидат — нестационарность кадра (attack-фаза) или повторное применение.
+3. Транскрипция kernel-build за RT_FIRCONV=1 → контрольные числа dual → гейт.
+4. reaper.ini: alsa_outdev/indev=null прописаны (бэкап /tmp/opencode/reaper.ini.bak)
+   — realtime колбек всё равно не ожил (cpu 0.2 t/s), вопрос закрыт в пользу
+   render-snap метода.
+
+## ============ UPDATE 2026-08-23i (23e): ЗАКОН СОШЁСЯ КОЛИЧЕСТВЕННО ============
+
+Серия rendersnap: dual_b1q_0.5 + dual_b1q_3.0 (стационарные фазы).
+1. **FIR = exp(0.984·scratch)** поточечно (коэф идентичен @43/@171) ⇒ ops
+   между log и exp — скалярный раундтрип, никакой межбиновой магии в самих ops.
+2. **real_cut / FIR_cut = 1.798–1.810 константа** по всем 4 точкам
+   (q0.5: 5.70/6.58 FIR против 10.32/11.82 real; q3.0: 5.69/5.76 против
+   10.29/10.32). Между кернелом и слышимым применением — ЛИНЕЙНЫЙ масштаб
+   ~1.805 в дБ-домене (кандидат: двойное применение/нормировка conv-стадии;
+   залочить при декоде потребителя, до тех пор EMPIRICAL-константа).
+3. **Центр не зависит от q живьём**: scratch43 = −0.6565(q0.5) vs −0.6551(q3)
+   при том, что сырой bands[] мигает от 0.3 до 382 (детекторные IIR дают
+   стационар). Скайрт: Δscratch171(q3−q0.5)=+0.0937 ln ⇒ ×0.984×1.805 =
+   **+1.46 дБ** против реального Δ=1.50 дБ — сходится в пределах 3%.
+4. Структура механизма окончательно: mask_log(f) = G(log(am_frame(f)), res_band(f));
+   кернел = exp(mask_log) c падающим Hann-окном на [n/2..n); применение =
+   свёртка × масштаб 1.805. Это УЖЕ наша каноническая структура am/res — но
+   вход амплитуды берётся из спектра кадра напрямую (не через наш lvl-тракт),
+   и применение — FIR-свёртка, а не поточечное умножение STFT.
+### NEXT (конкретика)
+1. Восстановить точную зависимость scratch(band, res): прогнать q-серию
+   {0.1,0.2,...,10} + am-серию, аппроксимировать G (ожидаем линейность в логах
+   вида −k·ln(am/res)+c, k≈0.984·?): две точки уже дают k_skyрт согласован.
+2. Найти источник масштаба 1.805 (декод потребителя FIR: кто читает 0x540668).
+3. Транскрипция RT_FIRCONV=1: bands=STFT-спектр кадра → scratch=G(...) →
+   kernel=exp·HannWin → rfft-свёртка overlap-add → гейт корпуса.
+
+## ============ UPDATE 2026-08-23j (23f): q-СЕРИЯ ЖИВЫХ SCRATCH ============
+
+scripts/qseries.py: rendersnap по dual_b1q_{0.1..10}.rpp (11 конфигов).
+Стационарная подвыборка (scr43≈−0.6565): q={0.2,0.3,0.5,0.7,1.0,1.5,3.0}
+(q=0.1,2,5,10 поймали нестационар scr43≈−0.18 — фильтровать по scr43!).
+Таблица (FIR-cut дБ = −20log10 exp(0.984·scr); ×1.805 — эмпир. масштаб):
+| q | scr43 | scr171 | FIR@43 | FIR@171 | ×1.805 @171 | real@171 |
+|---|---|---|---|---|---|---|
+| 0.2 | −0.6565 | −0.8965 | 5.61 | 7.66 | 13.83 | — |
+| 0.3 | −0.6565 | −0.8332 | 5.61 | 7.12 | 12.85 | — |
+| 0.5 | −0.6565 | −0.7570 | 5.61 | 6.47 | 11.68 | 11.82 |
+| 0.7 | −0.6565 | −0.7192 | 5.61 | 6.15 | 11.09 | — |
+| 1.0 | −0.6564 | −0.6923 | 5.61 | 5.92 | 10.68 | 10.78 |
+| 1.5 | −0.6562 | −0.6750 | 5.61 | 5.77 | 10.41 | — |
+| 3.0 | −0.6551 | −0.6633 | 5.60 | 5.67 | 10.23 | 10.32 |
+Выводы: (а) центр строго const ∀q; (б) ×1.805 попадает в real с ошибкой
+≤0.14 дБ на обеих известных точках; (в) scr171(res2000) НЕлинеен в ln res
+(локальный наклон падает 0.135→0.088 ln/res) — согласуется с экспоненциальной
+формой 22x; (г) сырой bands[] мигает на порядки (0.3↔382) при стабильном
+scratch ⇒ детекторное сглаживание (attack/release IIR) сидит МЕЖДУ записью
+bands[] и DESIGN — искать его адрес в цепи до 52b550.
+### NEXT
+1. am-серия (t_-24..t_+24 rpp уже есть в Recent!) → наклон по амплитуде →
+   полная форма G=log-домена: scr = c0 + ka·ln(am) + f(res).
+2. Декод читателя 0x540668 (источник ×1.805) + детекторного IIR перед DESIGN.
+3. RT_FIRCONV=1 транскрипция: G аппроксимировать таблично по этой серии.
+
+### 23g (короткое): am-серия пока неинтерпретируема
+t_{-24,-12,0,+24}.rpp (тон@1000, бин 85): scr85 = −1.0071 / −0.2276 / −0.4399 /
+−1.0071 — НЕмонотонно по уровню; вероятная причина — steady() хватало разные
+фазы (attack/стационар) или в t_* конфигах другая полоса. Данные в логе прогона;
+повторить с контролем стабильности (несколько последних фаз подряд равны).
+Скрипты qseries.py/amseries.py закоммичены.
+
+## ============ UPDATE 2026-08-23k (23h): ОХОТА ЗА ПОТРЕБИТЕЛЕМ КЕРНЕЛА ============
+1. Xref-скан disp32 0x540668 по всему коду: вне 52bxxx только ИНИТ
+   (52ed36 lea→resize, 35b71 store, 361de/f читатель+запись в 536xxx-билдере
+   кривых). Прямых чтений ДАННЫХ FIR в рантайме не видно ⇒ потребитель берёт
+   слот из таблицы указателей по индексу ЛИБО существует вторая копия цепи.
+2. bp на выходе FIR-цикла (52b8bb) в render-окне: 0 попаданий (как и вход
+   529fe0) при том что кернель появляется ⇒ **в рендере работает ДРУГОЙ код**
+   (дублированная инстанциация цепи; модуль 480 МБ). fnall.py: finder заменён
+   на проверенный maps-вариант, FN_STAB управляет стабилизацией.
+3. fnsample.py — активный RIP-сэмплер (PTRACE_INTERRUPT цикл): 10.6к сэмплов,
+   2375 в модуле. Горячее: 0x180b0c3e0 (MSVC 0xCC stack-fill, НЕ DSP),
+   кластеры 0x180bcxxxx/bdxxxx (хелперы); в ядре замечены 0x180534580 и
+   0x18052e1c0 (рядом с ramp-in 52e260!) — но только в части прогонов
+   (срабатывают на param-фазе, не в стационаре рендера).
+4. reaper.ini: alsa null не оживил realtime (закрыто). Yabridge: сотни мёртвых
+   сокет-директорий /run/user/1000/yabridge-* от kill -9 ломали спавн —
+   чистить rm -rf перед серией (грабли зафиксированы).
+### NEXT (продолжение)
+1. fnsample с окном НА param-фазе (t≈1.3–1.6 c после host-spawn) и фильтром
+   ядра 0x180520000-0x180560000 → поймать дубликат цепи в момент построения.
+2. Проверить 0x18052e1c0/0x180534580 дизасмом (уже лежат окна? нет — снять).
+3. После опознания дубля: bp на его выход → [rsp]=адрес применения → декод
+   масштаба 1.805.
+
+### 23i (короткое): HW-watchpoint заведён, попаданий нет
+Отладочные регистры через POKEUSER: база u_debugreg = **0x350** (не 0x340/0x380;
+DR7 @0x388; LEN=10(8B) отвергается ядром — использовать LEN=11(4B),
+DR7=L0|R/W=11|LEN=11 = 0xF0001; сброс DR6 = poke 0xFFFF0FF0 @DR0+48).
+scripts/fnwatch.py: watch на слово кернела (bin43.re) от момента создания
+экземпляра до конца хоста — **0 попаданий** при подтверждённом армировании.
+Гипотезы: потребитель читает КОПИЮ кернела; либо строится однократно до
+армирования; либо выравнивание доступа мимо слова. Следующий шаг: watch
+нескольких слов + старт с рождения хоста + контроль факта рендера (wav mtime).
+
+### 23j (короткое): мульти-watchpoint — попаданий нет при валидном рендере
+fnwatch4.py: 4 DR одновременно {слот-указатель FIR (оба dword), слово кернела,
+слово scratch} → затем позитивный контроль {overlap-слово, track[43], R[43],
+лок 0x2404dc}. Конфигурация: render_fresh=True (wav@1.49 c), armed=8/8 тредов
+(INTERRUPT→wait→arm→CONT на resweep обязателен — армирование бегущего треда
+молча не работает), WATCH_DUR=30. **0 попаданий везде**, включая лок и
+аудио-переполнение, которые ОБЯЗАНЫ трогаться при обработке.
+ВЫВОД: аппаратные data-watchpoints под wine-тредами НЕ доставляются tracer'у
+в этом окружении (kernel/wine взаимодействие) — маршрут закрыт. Потребителя
+искать статически: скан disp32 из диапазона таблицы [0x540600..0x540900]
+(семейство байт `?? 06 54 00`) → функции, итерирующие слоты по индексу;
+плюс декод 52e1c0/534580-окрестностей отвергнут (аллокаторы).
+
+## ============ UPDATE 2026-08-23l (23k): HW EXEC-BP РАБОТАЕТ; ЦЕПЬ СТРОИТСЯ ОДИН РАЗ ============
+1. Статический скан ВСЕХ disp32 из [0x540600..0x540900] (390 ссылок): все
+   относятся к известным функциям (529fe0, init 52exxx, билдеры 535xxx/536xxx).
+   Скрытого статического читателя таблицы НЕТ.
+2. Аппаратные EXEC-bp (DR0/DR1, RW=00) через POKEUSER теперь реально работают
+   (ранее все HW-эксперименты были no-op из-за неверного оффсета 0x380 вместо
+   0x350). RF-флаг (eflags|=0x10000) для обхода exec-trap; TRACECLONE наследует
+   DR дочерним тредам.
+3. Чистый прогон (fnexec, arm после создания экземпляра @1.46 c): **wav@1.48 c,
+   0 попаданий на вход 529fe0 и голову FIR-цикла** при живом рендере ⇒
+   **декодированная цепь НЕ выполняется в steady-render; кернель строится
+   ОДИН РАЗ на param-change в узком окне (<100 мс) сразу после создания
+   экземпляра**. Это объясняет: стабильность кернела между фазами, молчание
+   всех bp, статичность кривых 22y.
+4. Следствие для транскрипции: rebuild кернела ТОЛЬКО на setParams; per-frame
+   работает только детектор+свёртка с кэшированным кернелом.
+### NEXT (решающий)
+fnexec early-arm режим уже умеет ставить exec-watch ДО создания экземпляра
+(наследование клонам) — но два прогона подряд поймали флак рендера под
+трассировщиком (render_fresh=False). Протокол повторения: (а) ранний arm на
+0x1802a24c0/0x1802fa420; (б) НЕ трогать треды до первого SIGTRAP (убрать
+resweep-CONT чурн); (в) по хиту — дамп rcx(bands)/rdx(scratch) уже реализован;
+(г) если рендер опять не стартовал — просто перезапустить (флак ~50%).
+После дампа bands[] в момент param-change: сравнить с R-кривой, восстановить
+G, декодировать потребителя через backtrace ([rsp]) из того же хита.
+
+### 23l (короткое): DR-механизм верифицирован микротестом; расхождение локализовано
+Микротест /tmp/opencode/dtest.py на fork+exec ребёнке: DR0 exec-watch срабатывает
+(SIGTRAP, rip==target, DR6 bit0) — ядро/CPU полностью поддерживают аппаратные
+ловушки через POKEUSER 0x350/0x388. При этом fnexec с ранним армированием
+(до создания экземпляра, наследование через TRACECLONE + армирование при
+рождении каждого треда) даёт 0 попаданий на {529fe0, loop-head, design×2,
+dispatcher, bidir} при подтверждённых рендерах и 8–12/8–12 армированных тредов.
+Одновременно: disp32-скан показывает, что ВЕСЬ доступ к scratch/FIR идёт только
+из декодированного цикла 52bxxx. Прямое противоречие ⇒ остался ровно один
+неисключённый вариант: **трассируется не тот процесс/треды умирают до арма**.
+Следующий шаг: в fnexec логировать КАЖДЫЙ stop (rip,dr6,pid) без фильтра +
+счётчик всех SIGTRAP; если трапов нет вообще на тредах, которые заведомо
+выполняют модульный код — сравнивать /proc/pid/task состав до/после.
+
+### 23m (финал раунда): трассировка под wine — аномалия доставки зафиксирована
+Серией прогонов с ПОЛНЫМ логом остановок установлено: за 14 c живого хоста
+tracer видит ~1 остановку (не от наших DR), хотя 8+ тредов армированы
+exec-watch на тела дизайна/диспетчер/bidir с верифицированной записью DR
+(drprobe.py: все poke ok, readback точный) и микротестом доставки на
+нативном треде (dtest.py — работает). Треды wine при этом выполняют модульный
+код (рендер происходит). Вывод: доставка DR-trap'ов от wine-тредов в наш
+waitpid-цикл не работает в этой конфигурации (кандидаты: wine сам использует
+DR/GetThreadContext, wow64-переключения, либо события теряются из-за
+групповых остановок). Отладочный вывод сохранён в fnexec/hits.json.
+### Достижения раунда (суммарно, 23h–23m)
+1. Доказано: цепь строится ОДИН РАЗ на param-change (<100 мс окно), steady
+   render её не вызывает — транскрипция: rebuild только на setParams.
+2. Все 390 статических ссылок на таблицу слотов учтены; скрытого читателя нет.
+3. HW exec-bp методология верифицирована end-to-end (dtest) — инструмент готов,
+   осталась аномалия доставки под wine.
+4. rendersnap.py — рабочий канал снятия ЛЮБЫХ внутренних состояний плагина
+   (уже дал формулу FIR=exp(0.984·scratch), масштаб ×1.805, q-серию).
+### Дорога к bit-exact (порядок)
+1. G(band,res): q-серия есть; добавить am-серию со стабилизацией фаз;
+   аппроксимировать и проверить на hold-out.
+2. Потребитель/×1.805: (а) полный декод init-семьи 52e9b0–531xxx (param-time
+   строитель — потребитель рядом); (б) либо повторить DR-охоту после решения
+   аномалии доставки (например, трассировать через PTRACE_SEIZE опции или
+   perf_event_open с breakpoint типом HW).
+3. RT_FIRCONV=1 + контрольные числа dual + гейт корпуса.
+
+## ============ UPDATE 2026-08-23n (24a): ПЕРФ-ДИКТОР — WINE ДЕРЖИТ СЛОТЫ; ДВИЖОК ОПОЗНАН ============
+1. perf_event_open (PERF_TYPE_BREAKPOINT) на слово кернела: собственные треды и
+   ЧУЖИЕ same-uid процессы открываются (fd>0), а wine-треды дают ENOSPC ⇒
+   **wine резервирует аппаратные BP-слоты** под эмуляцию Windows-DR. Это же
+   объясняет глобальную тишину ptrace-DR: ядро хранит значения, но в кремний
+   их программировать нечем. Маршрут аппаратных ловушек внутри wine ЗАКРЫТ
+   окончательно (23h–24a). Скрипт scripts/perfbp.py готов для нативных целей.
+2. Опознан объект conv-движка: **ctx+0x540530**, инлайн-конфиг {2,4096},
+   {16384,8192}, {2,257}; члены-векторы +0xb8..+0x130; методы FUN_18052dc30
+   (config), FUN_18052fe00 (resize), FUN_18052dd30 (dtor). Его process-метод —
+   следующий кандидат на «потребителя кернела» (ищется рядом по декомпу/вызовам
+   с arg=ctx+0x540530 из аудио-клея).
+3. INT3-маршрут остаётся единственным динамическим (слоты не нужны): требует
+   дисциплины fnwatch4 (INTERRUPT→wait→arm→CONT всем тредам) + контроля
+   render_fresh в каждом прогоне (флак ~50%).
+### NEXT
+1. Найти process-метод движка 0x540530: перечислить функции, получающие
+   ctx+0x540530 (grep decomp), восстановить vtbl объекта из дампа памяти
+   ([ctx+0x540530]-объект начинается с указателя? проверить офлайн из s1.bin),
+   декодировать метод → источник ×1.805.
+2. INT3-ловушка на найденный метод + на design-тела в param-окно (рендер-
+   свежесть обязательна в логе).
+3. RT_FIRCONV=1 после декода масштаба; контрольные числа dual; гейт корпуса.
+
+### 24b (короткое): vtable модуля полная; процесс-метод ещё не опознан
+vtbl @0x1824ac210: +0=535ed0,+1=52cfb0,+2=529550,+4=52b940(→rebuild),
++5=529c60(осцилл),+6=529fe0(маск-цепь),+8=52bbf0(getter blocksize),
++12=52bba0,+13=52bb80; сеттеры параметров 52b980-baa0 (52ba20 пишет флаг
+0x5408b8 и зовёт полный rebuild 52e9b0 ✓; 52baa0 пишет 0x54088c=expf(x·K)).
+Объект conv-движка (ctx+0x540530) невиртуальный: методы прямые
+{dc30 cfg, fe00 resize, dd30 dtor}; его process-метод = прямой вызов из
+аудио-клея — искать среди функций, вызывающих dc30/fe00 (их CALLER'Ы) и в
+диапазоне 52d650..532xxx. Следующий раунд: декод этого клеевого метода даст
+потребителя кернела и ×1.805.
+
+## ============ UPDATE 2026-08-24a (24c): ЖИВАЯ ОБРАБОТКА ПОДТВЕРЖДЕНА; «BUILD-ONCE» ОТЗЫВАЕТСЯ ============
+Чистый эксперимент без трассировки: файл seq_in.wav = [A: 500+2000Гц | B: только
+2000Гц] по 2 с, полоса @500 q=0.5, рендер до естественного завершения.
+Результат (выравнивание по LOOP=1, выход 6 c = A+B+A):
+  half A: cut@2000 = 21.91 дБ          half B: cut@2000 = 25.74 дБ
+  (поведение @500 меняется кардинально: контент-зависимость живьём)
+⇒ ПЛАГИН ОБРАБАТЫВАЕТ АУДИО В РЕНДЕРЕ ПО-РАЗНОМУ ДЛЯ РАЗНОГО КОНТЕНТА ⇒
+маск-цепь выполняется по-кадрово. Вывод 23k «build-once» ОТЗЫВАЕТСЯ — он
+опирался на exec-bp, которые не доставляются под wine (см. 24a: wine держит
+слоты HW BP; ptrace-DR в кремний не программируются).
+ПОПУТНО: (а) рендер-выход длиннее входа из-за LOOP=1 в проекте (6 c = A+B+A);
+(б) убивать reaper во время рендера нельзя — выходной файл остаётся частичным
+с предварительной шапкой (источник «флака» свежести); (в) выход 16-bit stereo.
+### Методологический итог для следующих раундов
+Динамические ловушки внутри wine сейчас НЕ работают ни в каком виде (HW занят
+wine, INT3-прогоны не контролировались на свежесть рендера). Единственный
+работающий канал наблюдения — rendersnap (STOP-семплирование), но он снимает
+между колбеками офлайн-рендера... что при back-to-back обработке ЕСТЬ момент
+обработки — противоречие с молчанием ловушек требует пересмотра: возможно,
+в wine-хосте ДВА экземпляра модуля (GUI/DSP), а vtable-кандидат у нас один;
+multictx сканировал только rw-регионы с маркером vtable — второй экземпляр мог
+иметь другой адрес vtbl-указателя (heap-копия класса?). Проверка: полный скан
+всех экземпляров по сигнатуре sens>100 БЕЗ привязки к vtable (float 48000 +
+sens + 0x540870-паттерн уже покрывал; расширить на поиск по содержимому
+R-кривой в куче).
+
+### 24d (стоп раунда): двухэкземплярная гипотеза не подтверждена/не опровергнута
+Сканер всех кандидатов (scan2.py в /tmp/opencode, не закоммичен из-за бага:
+после починки finder'а — исключён reaper по cmdline — 25 STOP-сканов подряд
+на правильном wine-хосте не находят ДАЖЕ известный ctx 0x2370040 с vtable-
+маркером, хотя идентичный код rendersnap.py находит стабильно). Расхождение
+не отлажено (контекст исчерпан). Состояние задачи «потребитель кернела»:
+- живая обработка доказана (24c);
+- HW-ловушки в wine невозможны (wine держит слоты, 24a);
+- INT3 не проверялся при ГАРАНТИРОВАННО свежем рендере;
+- статически: все disp32-ссылки учтены, conv-движок = объект ctx+0x540530
+  (методы dc30/fe00/dd30 прямые), его process-метод среди caller'ов в
+  52d650..532xxx — НЕ НАЙДЕН декомпом (grep 0x540530 даёт только init/dtor).
+### Рекомендация следующему раунду
+1. Отладить scan2.py (почему пусто: сравнить с rendersnap пошагово на одном
+   запуске — вероятно, порядок STOP→scan ломается на первом STOP до маппинга
+   DLL, а CONT после каждого скана пропускает окно создания экземпляра).
+2. Либо полный декод аудио-клея: найти функцию, вызывающую vtbl слот +6
+   (529fe0) у СОСЕДНЕГО экземпляра, или decode 52e9b0-вызовителя (14191 в
+   decomp_funs2 — это 52ba20 setter); glue где-то в 52exx–52fxx.
+3. После опознания потребителя — ×1.805 и RT_FIRCONV.

handoff/nls_dasm/cons_52ec00.dis

@@ -0,0 +1,383 @@
+; cons_52ec00 0x18052eb00-0x18052f100
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+000000018052eb00 <.data>:
+   18052eb00:	0f af c8             	imul   %eax,%ecx
+   18052eb03:	8b 05 f7 cb 0f 02    	mov    0x20fcbf7(%rip),%eax        # 0x18262b700
+   18052eb09:	44 0f af e0          	imul   %eax,%r12d
+   18052eb0d:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052eb13:	05 e2 2c dc 06       	add    $0x6dc2ce2,%eax
+   18052eb18:	44 2b e1             	sub    %ecx,%r12d
+   18052eb1b:	25 7f 00 00 80       	and    $0x8000007f,%eax
+   18052eb20:	7d 07                	jge    0x18052eb29
+   18052eb22:	ff c8                	dec    %eax
+   18052eb24:	83 c8 80             	or     $0xffffff80,%eax
+   18052eb27:	ff c0                	inc    %eax
+   18052eb29:	89 86 e0 04 24 00    	mov    %eax,0x2404e0(%rsi)
+   18052eb2f:	48 63 c8             	movslq %eax,%rcx
+   18052eb32:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052eb39:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052eb3e:	8b 05 c0 cb 0f 02    	mov    0x20fcbc0(%rip),%eax        # 0x18262b704
+   18052eb44:	66 0f 6e d0          	movd   %eax,%xmm2
+   18052eb48:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052eb4e:	ff c0                	inc    %eax
+   18052eb50:	48 63 c8             	movslq %eax,%rcx
+   18052eb53:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052eb5a:	0f 5b d2             	cvtdq2ps %xmm2,%xmm2
+   18052eb5d:	f3 0f 59 d0          	mulss  %xmm0,%xmm2
+   18052eb61:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052eb66:	8b 05 5c ca 0f 02    	mov    0x20fca5c(%rip),%eax        # 0x18262b5c8
+   18052eb6c:	66 0f 6e c8          	movd   %eax,%xmm1
+   18052eb70:	8b 05 8a cb 0f 02    	mov    0x20fcb8a(%rip),%eax        # 0x18262b700
+   18052eb76:	0f 5b c9             	cvtdq2ps %xmm1,%xmm1
+   18052eb79:	f3 0f 59 c8          	mulss  %xmm0,%xmm1
+   18052eb7d:	f3 0f 59 ca          	mulss  %xmm2,%xmm1
+   18052eb81:	f3 0f 58 cd          	addss  %xmm5,%xmm1
+   18052eb85:	f3 0f 2c d9          	cvttss2si %xmm1,%ebx
+   18052eb89:	0f af d8             	imul   %eax,%ebx
+   18052eb8c:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052eb92:	05 9a f2 4b 00       	add    $0x4bf29a,%eax
+   18052eb97:	89 9c 24 f8 00 00 00 	mov    %ebx,0xf8(%rsp)
+   18052eb9e:	25 7f 00 00 80       	and    $0x8000007f,%eax
+   18052eba3:	7d 07                	jge    0x18052ebac
+   18052eba5:	ff c8                	dec    %eax
+   18052eba7:	83 c8 80             	or     $0xffffff80,%eax
+   18052ebaa:	ff c0                	inc    %eax
+   18052ebac:	89 86 e0 04 24 00    	mov    %eax,0x2404e0(%rsi)
+   18052ebb2:	48 63 c8             	movslq %eax,%rcx
+   18052ebb5:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052ebbc:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052ebc1:	8b 05 3d cb 0f 02    	mov    0x20fcb3d(%rip),%eax        # 0x18262b704
+   18052ebc7:	66 0f 6e d0          	movd   %eax,%xmm2
+   18052ebcb:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052ebd1:	ff c0                	inc    %eax
+   18052ebd3:	48 63 c8             	movslq %eax,%rcx
+   18052ebd6:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052ebdd:	0f 5b d2             	cvtdq2ps %xmm2,%xmm2
+   18052ebe0:	f3 0f 59 d0          	mulss  %xmm0,%xmm2
+   18052ebe4:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052ebe9:	8b 05 d9 c9 0f 02    	mov    0x20fc9d9(%rip),%eax        # 0x18262b5c8
+   18052ebef:	66 0f 6e c8          	movd   %eax,%xmm1
+   18052ebf3:	8b 05 07 cb 0f 02    	mov    0x20fcb07(%rip),%eax        # 0x18262b700
+   18052ebf9:	0f 5b c9             	cvtdq2ps %xmm1,%xmm1
+   18052ebfc:	f3 0f 59 c8          	mulss  %xmm0,%xmm1
+   18052ec00:	f3 0f 59 ca          	mulss  %xmm2,%xmm1
+   18052ec04:	f3 0f 58 cd          	addss  %xmm5,%xmm1
+   18052ec08:	f3 0f 2c c9          	cvttss2si %xmm1,%ecx
+   18052ec0c:	0f af c8             	imul   %eax,%ecx
+   18052ec0f:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052ec15:	05 94 62 cb 00       	add    $0xcb6294,%eax
+   18052ec1a:	66 0f 6e f1          	movd   %ecx,%xmm6
+   18052ec1e:	0f 5b f6             	cvtdq2ps %xmm6,%xmm6
+   18052ec21:	25 7f 00 00 80       	and    $0x8000007f,%eax
+   18052ec26:	7d 07                	jge    0x18052ec2f
+   18052ec28:	ff c8                	dec    %eax
+   18052ec2a:	83 c8 80             	or     $0xffffff80,%eax
+   18052ec2d:	ff c0                	inc    %eax
+   18052ec2f:	89 86 e0 04 24 00    	mov    %eax,0x2404e0(%rsi)
+   18052ec35:	48 63 c8             	movslq %eax,%rcx
+   18052ec38:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052ec3f:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052ec44:	8b 05 ba ca 0f 02    	mov    0x20fcaba(%rip),%eax        # 0x18262b704
+   18052ec4a:	66 0f 6e e0          	movd   %eax,%xmm4
+   18052ec4e:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052ec54:	ff c0                	inc    %eax
+   18052ec56:	48 63 c8             	movslq %eax,%rcx
+   18052ec59:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052ec60:	0f 5b e4             	cvtdq2ps %xmm4,%xmm4
+   18052ec63:	f3 0f 59 e0          	mulss  %xmm0,%xmm4
+   18052ec67:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052ec6c:	8b 05 56 c9 0f 02    	mov    0x20fc956(%rip),%eax        # 0x18262b5c8
+   18052ec72:	66 0f 6e d8          	movd   %eax,%xmm3
+   18052ec76:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052ec7c:	0f 5b db             	cvtdq2ps %xmm3,%xmm3
+   18052ec7f:	05 e0 b5 10 00       	add    $0x10b5e0,%eax
+   18052ec84:	f3 0f 59 d8          	mulss  %xmm0,%xmm3
+   18052ec88:	25 7f 00 00 80       	and    $0x8000007f,%eax
+   18052ec8d:	7d 07                	jge    0x18052ec96
+   18052ec8f:	ff c8                	dec    %eax
+   18052ec91:	83 c8 80             	or     $0xffffff80,%eax
+   18052ec94:	ff c0                	inc    %eax
+   18052ec96:	f3 0f 10 3d 06 52 f9 	movss  0x1f95206(%rip),%xmm7        # 0x1824c3ea4
+   18052ec9d:	01 
+   18052ec9e:	33 ff                	xor    %edi,%edi
+   18052eca0:	89 86 e0 04 24 00    	mov    %eax,0x2404e0(%rsi)
+   18052eca6:	48 63 c8             	movslq %eax,%rcx
+   18052eca9:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052ecb0:	f3 0f 59 dc          	mulss  %xmm4,%xmm3
+   18052ecb4:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052ecb9:	8b 05 45 ca 0f 02    	mov    0x20fca45(%rip),%eax        # 0x18262b704
+   18052ecbf:	f3 0f 58 dd          	addss  %xmm5,%xmm3
+   18052ecc3:	66 0f 6e d0          	movd   %eax,%xmm2
+   18052ecc7:	8b 86 e0 04 24 00    	mov    0x2404e0(%rsi),%eax
+   18052eccd:	ff c0                	inc    %eax
+   18052eccf:	48 63 c8             	movslq %eax,%rcx
+   18052ecd2:	48 8b 86 b0 08 54 00 	mov    0x5408b0(%rsi),%rax
+   18052ecd9:	0f 5b d2             	cvtdq2ps %xmm2,%xmm2
+   18052ecdc:	f3 44 0f 2c eb       	cvttss2si %xmm3,%r13d
+   18052ece1:	f3 0f 59 d0          	mulss  %xmm0,%xmm2
+   18052ece5:	f3 0f 10 04 88       	movss  (%rax,%rcx,4),%xmm0
+   18052ecea:	8b 05 d8 c8 0f 02    	mov    0x20fc8d8(%rip),%eax        # 0x18262b5c8
+   18052ecf0:	66 0f 6e c8          	movd   %eax,%xmm1
+   18052ecf4:	8b 05 06 ca 0f 02    	mov    0x20fca06(%rip),%eax        # 0x18262b700
+   18052ecfa:	0f 5b c9             	cvtdq2ps %xmm1,%xmm1
+   18052ecfd:	f3 0f 59 c8          	mulss  %xmm0,%xmm1
+   18052ed01:	f3 0f 59 ca          	mulss  %xmm2,%xmm1
+   18052ed05:	f3 0f 58 cd          	addss  %xmm5,%xmm1
+   18052ed09:	f3 0f 2c c9          	cvttss2si %xmm1,%ecx
+   18052ed0d:	0f af c8             	imul   %eax,%ecx
+   18052ed10:	8b 05 ea c9 0f 02    	mov    0x20fc9ea(%rip),%eax        # 0x18262b700
+   18052ed16:	44 0f af e8          	imul   %eax,%r13d
+   18052ed1a:	44 03 e9             	add    %ecx,%r13d
+   18052ed1d:	84 d2                	test   %dl,%dl
+   18052ed1f:	0f 85 95 03 00 00    	jne    0x18052f0ba
+   18052ed25:	48 8b ce             	mov    %rsi,%rcx
+   18052ed28:	e8 d3 e0 ff ff       	call   0x18052ce00
+   18052ed2d:	8b 86 a0 01 00 00    	mov    0x1a0(%rsi),%eax
+   18052ed33:	48 8d 8e 68 06 54 00 	lea    0x540668(%rsi),%rcx
+   18052ed3a:	0f af c3             	imul   %ebx,%eax
+   18052ed3d:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052ed40:	c1 e0 03             	shl    $0x3,%eax
+   18052ed43:	89 86 68 08 54 00    	mov    %eax,0x540868(%rsi)
+   18052ed49:	99                   	cltd
+   18052ed4a:	2b c2                	sub    %edx,%eax
+   18052ed4c:	d1 f8                	sar    $1,%eax
+   18052ed4e:	8d 14 18             	lea    (%rax,%rbx,1),%edx
+   18052ed51:	89 96 6c 08 54 00    	mov    %edx,0x54086c(%rsi)
+   18052ed57:	03 d2                	add    %edx,%edx
+   18052ed59:	e8 32 f4 ff ff       	call   0x18052e190
+   18052ed5e:	8b 96 6c 08 54 00    	mov    0x54086c(%rsi),%edx
+   18052ed64:	48 8d 8e 98 06 54 00 	lea    0x540698(%rsi),%rcx
+   18052ed6b:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052ed6e:	e8 1d f4 ff ff       	call   0x18052e190
+   18052ed73:	8b d7                	mov    %edi,%edx
+   18052ed75:	39 be a0 06 54 00    	cmp    %edi,0x5406a0(%rsi)
+   18052ed7b:	7e 1e                	jle    0x18052ed9b
+   18052ed7d:	8b cf                	mov    %edi,%ecx
+   18052ed7f:	90                   	nop
+   18052ed80:	48 8b 86 98 06 54 00 	mov    0x540698(%rsi),%rax
+   18052ed87:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052ed8b:	ff c2                	inc    %edx
+   18052ed8d:	f3 0f 11 74 01 fc    	movss  %xmm6,-0x4(%rcx,%rax,1)
+   18052ed93:	3b 96 a0 06 54 00    	cmp    0x5406a0(%rsi),%edx
+   18052ed99:	7c e5                	jl     0x18052ed80
+   18052ed9b:	8b 96 6c 08 54 00    	mov    0x54086c(%rsi),%edx
+   18052eda1:	48 8d 8e a8 06 54 00 	lea    0x5406a8(%rsi),%rcx
+   18052eda8:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052edab:	e8 e0 f3 ff ff       	call   0x18052e190
+   18052edb0:	8b 96 6c 08 54 00    	mov    0x54086c(%rsi),%edx
+   18052edb6:	48 8d 8e b8 06 54 00 	lea    0x5406b8(%rsi),%rcx
+   18052edbd:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052edc0:	e8 cb f3 ff ff       	call   0x18052e190
+   18052edc5:	8b 96 6c 08 54 00    	mov    0x54086c(%rsi),%edx
+   18052edcb:	48 8d 8e c8 06 54 00 	lea    0x5406c8(%rsi),%rcx
+   18052edd2:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052edd5:	e8 b6 f3 ff ff       	call   0x18052e190
+   18052edda:	8b 96 6c 08 54 00    	mov    0x54086c(%rsi),%edx
+   18052ede0:	48 8d 8e d8 06 54 00 	lea    0x5406d8(%rsi),%rcx
+   18052ede7:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052edea:	e8 a1 f3 ff ff       	call   0x18052e190
+   18052edef:	8b 96 6c 08 54 00    	mov    0x54086c(%rsi),%edx
+   18052edf5:	48 8d 8e e8 06 54 00 	lea    0x5406e8(%rsi),%rcx
+   18052edfc:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052edff:	e8 8c f3 ff ff       	call   0x18052e190
+   18052ee04:	45 8b fc             	mov    %r12d,%r15d
+   18052ee07:	44 3b 66 30          	cmp    0x30(%rsi),%r12d
+   18052ee0b:	0f 8d ee 01 00 00    	jge    0x18052efff
+   18052ee11:	45 8b f5             	mov    %r13d,%r14d
+   18052ee14:	49 63 dc             	movslq %r12d,%rbx
+   18052ee17:	45 0f af f5          	imul   %r13d,%r14d
+   18052ee1b:	48 81 c3 73 40 05 00 	add    $0x54073,%rbx
+   18052ee22:	48 c1 e3 04          	shl    $0x4,%rbx
+   18052ee26:	41 c1 e6 0e          	shl    $0xe,%r14d
+   18052ee2a:	48 03 de             	add    %rsi,%rbx
+   18052ee2d:	0f 1f 00             	nopl   (%rax)
+   18052ee30:	8b ae 6c 08 54 00    	mov    0x54086c(%rsi),%ebp
+   18052ee36:	8b 83 50 ff ff ff    	mov    -0xb0(%rbx),%eax
+   18052ee3c:	3b c5                	cmp    %ebp,%eax
+   18052ee3e:	74 3e                	je     0x18052ee7e
+   18052ee40:	85 c0                	test   %eax,%eax
+   18052ee42:	7e 11                	jle    0x18052ee55
+   18052ee44:	48 8b 8b 48 ff ff ff 	mov    -0xb8(%rbx),%rcx
+   18052ee4b:	48 85 c9             	test   %rcx,%rcx
+   18052ee4e:	74 05                	je     0x18052ee55
+   18052ee50:	e8 6b 22 ad ff       	call   0x1800010c0
+   18052ee55:	85 ed                	test   %ebp,%ebp
+   18052ee57:	48 89 bb 48 ff ff ff 	mov    %rdi,-0xb8(%rbx)
+   18052ee5e:	0f 48 ef             	cmovs  %edi,%ebp
+   18052ee61:	89 ab 50 ff ff ff    	mov    %ebp,-0xb0(%rbx)
+   18052ee67:	85 ed                	test   %ebp,%ebp
+   18052ee69:	74 3e                	je     0x18052eea9
+   18052ee6b:	8d 0c ad 00 00 00 00 	lea    0x0(,%rbp,4),%ecx
+   18052ee72:	e8 09 22 ad ff       	call   0x180001080
+   18052ee77:	48 89 83 48 ff ff ff 	mov    %rax,-0xb8(%rbx)
+   18052ee7e:	8b d7                	mov    %edi,%edx
+   18052ee80:	39 bb 50 ff ff ff    	cmp    %edi,-0xb0(%rbx)
+   18052ee86:	7e 21                	jle    0x18052eea9
+   18052ee88:	48 8b cf             	mov    %rdi,%rcx
+   18052ee8b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
+   18052ee90:	48 8b 83 48 ff ff ff 	mov    -0xb8(%rbx),%rax
+   18052ee97:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052ee9b:	ff c2                	inc    %edx
+   18052ee9d:	89 7c 01 fc          	mov    %edi,-0x4(%rcx,%rax,1)
+   18052eea1:	3b 93 50 ff ff ff    	cmp    -0xb0(%rbx),%edx
+   18052eea7:	7c e7                	jl     0x18052ee90
+   18052eea9:	8b 03                	mov    (%rbx),%eax
+   18052eeab:	41 3b c6             	cmp    %r14d,%eax
+   18052eeae:	74 35                	je     0x18052eee5
+   18052eeb0:	85 c0                	test   %eax,%eax
+   18052eeb2:	7e 0e                	jle    0x18052eec2
+   18052eeb4:	48 8b 4b f8          	mov    -0x8(%rbx),%rcx
+   18052eeb8:	48 85 c9             	test   %rcx,%rcx
+   18052eebb:	74 05                	je     0x18052eec2
+   18052eebd:	e8 fe 21 ad ff       	call   0x1800010c0
+   18052eec2:	45 85 f6             	test   %r14d,%r14d
+   18052eec5:	48 89 7b f8          	mov    %rdi,-0x8(%rbx)
+   18052eec9:	41 8b ce             	mov    %r14d,%ecx
+   18052eecc:	0f 48 cf             	cmovs  %edi,%ecx
+   18052eecf:	89 0b                	mov    %ecx,(%rbx)
+   18052eed1:	85 c9                	test   %ecx,%ecx
+   18052eed3:	74 31                	je     0x18052ef06
+   18052eed5:	8d 0c 8d 00 00 00 00 	lea    0x0(,%rcx,4),%ecx
+   18052eedc:	e8 9f 21 ad ff       	call   0x180001080
+   18052eee1:	48 89 43 f8          	mov    %rax,-0x8(%rbx)
+   18052eee5:	8b d7                	mov    %edi,%edx
+   18052eee7:	39 3b                	cmp    %edi,(%rbx)
+   18052eee9:	7e 1b                	jle    0x18052ef06
+   18052eeeb:	48 8b cf             	mov    %rdi,%rcx
+   18052eeee:	66 90                	xchg   %ax,%ax
+   18052eef0:	48 8b 43 f8          	mov    -0x8(%rbx),%rax
+   18052eef4:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052eef8:	ff c2                	inc    %edx
+   18052eefa:	c7 44 01 fc 00 00 80 	movl   $0x3f800000,-0x4(%rcx,%rax,1)
+   18052ef01:	3f 
+   18052ef02:	3b 13                	cmp    (%rbx),%edx
+   18052ef04:	7c ea                	jl     0x18052eef0
+   18052ef06:	8b ae 6c 08 54 00    	mov    0x54086c(%rsi),%ebp
+   18052ef0c:	8b 83 80 00 00 00    	mov    0x80(%rbx),%eax
+   18052ef12:	3b c5                	cmp    %ebp,%eax
+   18052ef14:	74 35                	je     0x18052ef4b
+   18052ef16:	85 c0                	test   %eax,%eax
+   18052ef18:	7e 0e                	jle    0x18052ef28
+   18052ef1a:	48 8b 4b 78          	mov    0x78(%rbx),%rcx
+   18052ef1e:	48 85 c9             	test   %rcx,%rcx
+   18052ef21:	74 05                	je     0x18052ef28
+   18052ef23:	e8 98 21 ad ff       	call   0x1800010c0
+   18052ef28:	85 ed                	test   %ebp,%ebp
+   18052ef2a:	48 89 7b 78          	mov    %rdi,0x78(%rbx)
+   18052ef2e:	0f 48 ef             	cmovs  %edi,%ebp
+   18052ef31:	89 ab 80 00 00 00    	mov    %ebp,0x80(%rbx)
+   18052ef37:	85 ed                	test   %ebp,%ebp
+   18052ef39:	74 3b                	je     0x18052ef76
+   18052ef3b:	8d 0c ad 00 00 00 00 	lea    0x0(,%rbp,4),%ecx
+   18052ef42:	e8 39 21 ad ff       	call   0x180001080
+   18052ef47:	48 89 43 78          	mov    %rax,0x78(%rbx)
+   18052ef4b:	8b d7                	mov    %edi,%edx
+   18052ef4d:	39 bb 80 00 00 00    	cmp    %edi,0x80(%rbx)
+   18052ef53:	7e 21                	jle    0x18052ef76
+   18052ef55:	48 8b cf             	mov    %rdi,%rcx
+   18052ef58:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
+   18052ef5f:	00 
+   18052ef60:	48 8b 43 78          	mov    0x78(%rbx),%rax
+   18052ef64:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052ef68:	ff c2                	inc    %edx
+   18052ef6a:	89 7c 01 fc          	mov    %edi,-0x4(%rcx,%rax,1)
+   18052ef6e:	3b 93 80 00 00 00    	cmp    0x80(%rbx),%edx
+   18052ef74:	7c ea                	jl     0x18052ef60
+   18052ef76:	8b ae 6c 08 54 00    	mov    0x54086c(%rsi),%ebp
+   18052ef7c:	8b 83 a0 00 00 00    	mov    0xa0(%rbx),%eax
+   18052ef82:	3b c5                	cmp    %ebp,%eax
+   18052ef84:	74 3e                	je     0x18052efc4
+   18052ef86:	85 c0                	test   %eax,%eax
+   18052ef88:	7e 11                	jle    0x18052ef9b
+   18052ef8a:	48 8b 8b 98 00 00 00 	mov    0x98(%rbx),%rcx
+   18052ef91:	48 85 c9             	test   %rcx,%rcx
+   18052ef94:	74 05                	je     0x18052ef9b
+   18052ef96:	e8 25 21 ad ff       	call   0x1800010c0
+   18052ef9b:	85 ed                	test   %ebp,%ebp
+   18052ef9d:	48 89 bb 98 00 00 00 	mov    %rdi,0x98(%rbx)
+   18052efa4:	0f 48 ef             	cmovs  %edi,%ebp
+   18052efa7:	89 ab a0 00 00 00    	mov    %ebp,0xa0(%rbx)
+   18052efad:	85 ed                	test   %ebp,%ebp
+   18052efaf:	74 3d                	je     0x18052efee
+   18052efb1:	8d 0c ad 00 00 00 00 	lea    0x0(,%rbp,4),%ecx
+   18052efb8:	e8 c3 20 ad ff       	call   0x180001080
+   18052efbd:	48 89 83 98 00 00 00 	mov    %rax,0x98(%rbx)
+   18052efc4:	8b d7                	mov    %edi,%edx
+   18052efc6:	39 bb a0 00 00 00    	cmp    %edi,0xa0(%rbx)
+   18052efcc:	7e 20                	jle    0x18052efee
+   18052efce:	48 8b cf             	mov    %rdi,%rcx
+   18052efd1:	48 8b 83 98 00 00 00 	mov    0x98(%rbx),%rax
+   18052efd8:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052efdc:	ff c2                	inc    %edx
+   18052efde:	c7 44 01 fc 00 00 80 	movl   $0x3f800000,-0x4(%rcx,%rax,1)
+   18052efe5:	3f 
+   18052efe6:	3b 93 a0 00 00 00    	cmp    0xa0(%rbx),%edx
+   18052efec:	7c e3                	jl     0x18052efd1
+   18052efee:	41 ff c7             	inc    %r15d
+   18052eff1:	48 83 c3 10          	add    $0x10,%rbx
+   18052eff5:	44 3b 7e 30          	cmp    0x30(%rsi),%r15d
+   18052eff9:	0f 8c 31 fe ff ff    	jl     0x18052ee30
+   18052efff:	8b 96 68 08 54 00    	mov    0x540868(%rsi),%edx
+   18052f005:	48 8d 8e f8 06 54 00 	lea    0x5406f8(%rsi),%rcx
+   18052f00c:	c1 e2 03             	shl    $0x3,%edx
+   18052f00f:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052f012:	e8 79 f1 ff ff       	call   0x18052e190
+   18052f017:	8b 96 68 08 54 00    	mov    0x540868(%rsi),%edx
+   18052f01d:	48 8d 8e 08 07 54 00 	lea    0x540708(%rsi),%rcx
+   18052f024:	41 0f af d5          	imul   %r13d,%edx
+   18052f028:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052f02b:	e8 60 f1 ff ff       	call   0x18052e190
+   18052f030:	8b 96 68 08 54 00    	mov    0x540868(%rsi),%edx
+   18052f036:	48 8d 8e 18 07 54 00 	lea    0x540718(%rsi),%rcx
+   18052f03d:	41 0f af d5          	imul   %r13d,%edx
+   18052f041:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052f044:	e8 47 f1 ff ff       	call   0x18052e190
+   18052f049:	8b 96 68 08 54 00    	mov    0x540868(%rsi),%edx
+   18052f04f:	48 8d 8e 98 07 54 00 	lea    0x540798(%rsi),%rcx
+   18052f056:	0f 57 d2             	xorps  %xmm2,%xmm2
+   18052f059:	e8 32 f1 ff ff       	call   0x18052e190
+   18052f05e:	44 8b c7             	mov    %edi,%r8d
+   18052f061:	39 be a0 07 54 00    	cmp    %edi,0x5407a0(%rsi)
+   18052f067:	7e 26                	jle    0x18052f08f
+   18052f069:	48 8b cf             	mov    %rdi,%rcx
+   18052f06c:	0f 1f 40 00          	nopl   0x0(%rax)
+   18052f070:	48 8b 86 98 07 54 00 	mov    0x540798(%rsi),%rax
+   18052f077:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052f07b:	41 ff c0             	inc    %r8d
+   18052f07e:	c7 44 01 fc 00 00 80 	movl   $0x3f800000,-0x4(%rcx,%rax,1)
+   18052f085:	3f 
+   18052f086:	44 3b 86 a0 07 54 00 	cmp    0x5407a0(%rsi),%r8d
+   18052f08d:	7c e1                	jl     0x18052f070
+   18052f08f:	44 8b 86 68 08 54 00 	mov    0x540868(%rsi),%r8d
+   18052f096:	48 8d 8e 30 05 54 00 	lea    0x540530(%rsi),%rcx
+   18052f09d:	8b 56 64             	mov    0x64(%rsi),%edx
+   18052f0a0:	e8 8b eb ff ff       	call   0x18052dc30
+   18052f0a5:	0f 28 df             	movaps %xmm7,%xmm3
+   18052f0a8:	48 8d 8e 30 05 54 00 	lea    0x540530(%rsi),%rcx
+   18052f0af:	45 8b c5             	mov    %r13d,%r8d
+   18052f0b2:	41 8b d5             	mov    %r13d,%edx
+   18052f0b5:	e8 46 0d 00 00       	call   0x18052fe00
+   18052f0ba:	45 8b cc             	mov    %r12d,%r9d
+   18052f0bd:	4c 8b ac 24 00 01 00 	mov    0x100(%rsp),%r13
+   18052f0c4:	00 
+   18052f0c5:	44 3b 66 30          	cmp    0x30(%rsi),%r12d
+   18052f0c9:	0f 8d a8 00 00 00    	jge    0x18052f177
+   18052f0cf:	49 63 cc             	movslq %r12d,%rcx
+   18052f0d2:	48 81 c1 7b 40 05 00 	add    $0x5407b,%rcx
+   18052f0d9:	48 c1 e1 04          	shl    $0x4,%rcx
+   18052f0dd:	48 03 ce             	add    %rsi,%rcx
+   18052f0e0:	44 8b c7             	mov    %edi,%r8d
+   18052f0e3:	39 79 80             	cmp    %edi,-0x80(%rcx)
+   18052f0e6:	7e 22                	jle    0x18052f10a
+   18052f0e8:	48 8b d7             	mov    %rdi,%rdx
+   18052f0eb:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
+   18052f0f0:	48 8b 81 78 ff ff ff 	mov    -0x88(%rcx),%rax
+   18052f0f7:	48 8d 52 04          	lea    0x4(%rdx),%rdx
+   18052f0fb:	41 ff c0             	inc    %r8d
+   18052f0fe:	f3                   	repz
+   18052f0ff:	0f                   	.byte 0xf

handoff/nls_dasm/cons_536100.dis

@@ -0,0 +1,275 @@
+; cons_536100 0x180536000-0x180536400
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+0000000180536000 <.data>:
+   180536000:	e8 bb b0 ac ff       	call   0x1800010c0
+   180536005:	90                   	nop
+   180536006:	48 89 bb 58 07 54 00 	mov    %rdi,0x540758(%rbx)
+   18053600d:	89 bb 60 07 54 00    	mov    %edi,0x540760(%rbx)
+   180536013:	39 bb 50 07 54 00    	cmp    %edi,0x540750(%rbx)
+   180536019:	7e 12                	jle    0x18053602d
+   18053601b:	48 8b 8b 48 07 54 00 	mov    0x540748(%rbx),%rcx
+   180536022:	48 85 c9             	test   %rcx,%rcx
+   180536025:	74 06                	je     0x18053602d
+   180536027:	e8 94 b0 ac ff       	call   0x1800010c0
+   18053602c:	90                   	nop
+   18053602d:	48 89 bb 48 07 54 00 	mov    %rdi,0x540748(%rbx)
+   180536034:	89 bb 50 07 54 00    	mov    %edi,0x540750(%rbx)
+   18053603a:	48 8d 8b 28 07 54 00 	lea    0x540728(%rbx),%rcx
+   180536041:	4c 8d 0d d8 81 ff ff 	lea    -0x7e28(%rip),%r9        # 0x18052e220
+   180536048:	ba 10 00 00 00       	mov    $0x10,%edx
+   18053604d:	44 8d 42 f2          	lea    -0xe(%rdx),%r8d
+   180536051:	e8 c6 b6 bf 00       	call   0x18113171c
+   180536056:	90                   	nop
+   180536057:	39 bb 20 07 54 00    	cmp    %edi,0x540720(%rbx)
+   18053605d:	7e 12                	jle    0x180536071
+   18053605f:	48 8b 8b 18 07 54 00 	mov    0x540718(%rbx),%rcx
+   180536066:	48 85 c9             	test   %rcx,%rcx
+   180536069:	74 06                	je     0x180536071
+   18053606b:	e8 50 b0 ac ff       	call   0x1800010c0
+   180536070:	90                   	nop
+   180536071:	48 89 bb 18 07 54 00 	mov    %rdi,0x540718(%rbx)
+   180536078:	89 bb 20 07 54 00    	mov    %edi,0x540720(%rbx)
+   18053607e:	39 bb 10 07 54 00    	cmp    %edi,0x540710(%rbx)
+   180536084:	7e 12                	jle    0x180536098
+   180536086:	48 8b 8b 08 07 54 00 	mov    0x540708(%rbx),%rcx
+   18053608d:	48 85 c9             	test   %rcx,%rcx
+   180536090:	74 06                	je     0x180536098
+   180536092:	e8 29 b0 ac ff       	call   0x1800010c0
+   180536097:	90                   	nop
+   180536098:	48 89 bb 08 07 54 00 	mov    %rdi,0x540708(%rbx)
+   18053609f:	89 bb 10 07 54 00    	mov    %edi,0x540710(%rbx)
+   1805360a5:	39 bb 00 07 54 00    	cmp    %edi,0x540700(%rbx)
+   1805360ab:	7e 12                	jle    0x1805360bf
+   1805360ad:	48 8b 8b f8 06 54 00 	mov    0x5406f8(%rbx),%rcx
+   1805360b4:	48 85 c9             	test   %rcx,%rcx
+   1805360b7:	74 06                	je     0x1805360bf
+   1805360b9:	e8 02 b0 ac ff       	call   0x1800010c0
+   1805360be:	90                   	nop
+   1805360bf:	48 89 bb f8 06 54 00 	mov    %rdi,0x5406f8(%rbx)
+   1805360c6:	89 bb 00 07 54 00    	mov    %edi,0x540700(%rbx)
+   1805360cc:	39 bb f0 06 54 00    	cmp    %edi,0x5406f0(%rbx)
+   1805360d2:	7e 12                	jle    0x1805360e6
+   1805360d4:	48 8b 8b e8 06 54 00 	mov    0x5406e8(%rbx),%rcx
+   1805360db:	48 85 c9             	test   %rcx,%rcx
+   1805360de:	74 06                	je     0x1805360e6
+   1805360e0:	e8 db af ac ff       	call   0x1800010c0
+   1805360e5:	90                   	nop
+   1805360e6:	48 89 bb e8 06 54 00 	mov    %rdi,0x5406e8(%rbx)
+   1805360ed:	89 bb f0 06 54 00    	mov    %edi,0x5406f0(%rbx)
+   1805360f3:	39 bb e0 06 54 00    	cmp    %edi,0x5406e0(%rbx)
+   1805360f9:	7e 12                	jle    0x18053610d
+   1805360fb:	48 8b 8b d8 06 54 00 	mov    0x5406d8(%rbx),%rcx
+   180536102:	48 85 c9             	test   %rcx,%rcx
+   180536105:	74 06                	je     0x18053610d
+   180536107:	e8 b4 af ac ff       	call   0x1800010c0
+   18053610c:	90                   	nop
+   18053610d:	48 89 bb d8 06 54 00 	mov    %rdi,0x5406d8(%rbx)
+   180536114:	89 bb e0 06 54 00    	mov    %edi,0x5406e0(%rbx)
+   18053611a:	39 bb d0 06 54 00    	cmp    %edi,0x5406d0(%rbx)
+   180536120:	7e 12                	jle    0x180536134
+   180536122:	48 8b 8b c8 06 54 00 	mov    0x5406c8(%rbx),%rcx
+   180536129:	48 85 c9             	test   %rcx,%rcx
+   18053612c:	74 06                	je     0x180536134
+   18053612e:	e8 8d af ac ff       	call   0x1800010c0
+   180536133:	90                   	nop
+   180536134:	48 89 bb c8 06 54 00 	mov    %rdi,0x5406c8(%rbx)
+   18053613b:	89 bb d0 06 54 00    	mov    %edi,0x5406d0(%rbx)
+   180536141:	39 bb c0 06 54 00    	cmp    %edi,0x5406c0(%rbx)
+   180536147:	7e 12                	jle    0x18053615b
+   180536149:	48 8b 8b b8 06 54 00 	mov    0x5406b8(%rbx),%rcx
+   180536150:	48 85 c9             	test   %rcx,%rcx
+   180536153:	74 06                	je     0x18053615b
+   180536155:	e8 66 af ac ff       	call   0x1800010c0
+   18053615a:	90                   	nop
+   18053615b:	48 89 bb b8 06 54 00 	mov    %rdi,0x5406b8(%rbx)
+   180536162:	89 bb c0 06 54 00    	mov    %edi,0x5406c0(%rbx)
+   180536168:	39 bb b0 06 54 00    	cmp    %edi,0x5406b0(%rbx)
+   18053616e:	7e 12                	jle    0x180536182
+   180536170:	48 8b 8b a8 06 54 00 	mov    0x5406a8(%rbx),%rcx
+   180536177:	48 85 c9             	test   %rcx,%rcx
+   18053617a:	74 06                	je     0x180536182
+   18053617c:	e8 3f af ac ff       	call   0x1800010c0
+   180536181:	90                   	nop
+   180536182:	48 89 bb a8 06 54 00 	mov    %rdi,0x5406a8(%rbx)
+   180536189:	89 bb b0 06 54 00    	mov    %edi,0x5406b0(%rbx)
+   18053618f:	39 bb a0 06 54 00    	cmp    %edi,0x5406a0(%rbx)
+   180536195:	7e 12                	jle    0x1805361a9
+   180536197:	48 8b 8b 98 06 54 00 	mov    0x540698(%rbx),%rcx
+   18053619e:	48 85 c9             	test   %rcx,%rcx
+   1805361a1:	74 06                	je     0x1805361a9
+   1805361a3:	e8 18 af ac ff       	call   0x1800010c0
+   1805361a8:	90                   	nop
+   1805361a9:	48 89 bb 98 06 54 00 	mov    %rdi,0x540698(%rbx)
+   1805361b0:	89 bb a0 06 54 00    	mov    %edi,0x5406a0(%rbx)
+   1805361b6:	48 8d 8b 78 06 54 00 	lea    0x540678(%rbx),%rcx
+   1805361bd:	4c 8d 0d 5c 80 ff ff 	lea    -0x7fa4(%rip),%r9        # 0x18052e220
+   1805361c4:	ba 10 00 00 00       	mov    $0x10,%edx
+   1805361c9:	44 8d 42 f2          	lea    -0xe(%rdx),%r8d
+   1805361cd:	e8 4a b5 bf 00       	call   0x18113171c
+   1805361d2:	90                   	nop
+   1805361d3:	39 bb 70 06 54 00    	cmp    %edi,0x540670(%rbx)
+   1805361d9:	7e 12                	jle    0x1805361ed
+   1805361db:	48 8b 8b 68 06 54 00 	mov    0x540668(%rbx),%rcx
+   1805361e2:	48 85 c9             	test   %rcx,%rcx
+   1805361e5:	74 06                	je     0x1805361ed
+   1805361e7:	e8 d4 ae ac ff       	call   0x1800010c0
+   1805361ec:	90                   	nop
+   1805361ed:	48 89 bb 68 06 54 00 	mov    %rdi,0x540668(%rbx)
+   1805361f4:	89 bb 70 06 54 00    	mov    %edi,0x540670(%rbx)
+   1805361fa:	48 8d 8b 30 05 54 00 	lea    0x540530(%rbx),%rcx
+   180536201:	e8 2a 7b ff ff       	call   0x18052dd30
+   180536206:	90                   	nop
+   180536207:	89 bb cc 04 24 00    	mov    %edi,0x2404cc(%rbx)
+   18053620d:	48 8b 8b c0 04 24 00 	mov    0x2404c0(%rbx),%rcx
+   180536214:	ff 15 8e 50 67 01    	call   *0x167508e(%rip)        # 0x181bab2a8
+   18053621a:	90                   	nop
+   18053621b:	48 8d 8b d8 03 00 00 	lea    0x3d8(%rbx),%rcx
+   180536222:	e8 59 70 ff ff       	call   0x18052d280
+   180536227:	90                   	nop
+   180536228:	48 8d 05 49 5e f7 01 	lea    0x1f75e49(%rip),%rax        # 0x1824ac078
+   18053622f:	48 89 83 d0 03 00 00 	mov    %rax,0x3d0(%rbx)
+   180536236:	48 8b cb             	mov    %rbx,%rcx
+   180536239:	48 8b 5c 24 40       	mov    0x40(%rsp),%rbx
+   18053623e:	48 83 c4 30          	add    $0x30,%rsp
+   180536242:	5f                   	pop    %rdi
+   180536243:	e9 58 38 ff ff       	jmp    0x180529aa0
+   180536248:	cc                   	int3
+   180536249:	cc                   	int3
+   18053624a:	cc                   	int3
+   18053624b:	cc                   	int3
+   18053624c:	cc                   	int3
+   18053624d:	cc                   	int3
+   18053624e:	cc                   	int3
+   18053624f:	cc                   	int3
+   180536250:	f2 0f 10 0d e8 de f8 	movsd  0x1f8dee8(%rip),%xmm1        # 0x1824c4140
+   180536257:	01 
+   180536258:	48 8d 81 10 00 08 00 	lea    0x80010(%rcx),%rax
+   18053625f:	f2 0f 11 4c 24 08    	movsd  %xmm1,0x8(%rsp)
+   180536265:	ba 00 80 00 00       	mov    $0x8000,%edx
+   18053626a:	f2 0f 10 44 24 08    	movsd  0x8(%rsp),%xmm0
+   180536270:	4c 8b c1             	mov    %rcx,%r8
+   180536273:	c6 41 04 00          	movb   $0x0,0x4(%rcx)
+   180536277:	48 c7 81 10 00 10 00 	movq   $0x0,0x100010(%rcx)
+   18053627e:	00 00 00 00 
+   180536282:	8b ca                	mov    %edx,%ecx
+   180536284:	66 0f c6 c0 00       	shufpd $0x0,%xmm0,%xmm0
+   180536289:	a8 0f                	test   $0xf,%al
+   18053628b:	75 13                	jne    0x1805362a0
+   18053628d:	0f 1f 00             	nopl   (%rax)
+   180536290:	0f 11 00             	movups %xmm0,(%rax)
+   180536293:	48 8d 40 10          	lea    0x10(%rax),%rax
+   180536297:	48 83 e9 01          	sub    $0x1,%rcx
+   18053629b:	75 f3                	jne    0x180536290
+   18053629d:	eb 0e                	jmp    0x1805362ad
+   18053629f:	90                   	nop
+   1805362a0:	0f 11 00             	movups %xmm0,(%rax)
+   1805362a3:	48 8d 40 10          	lea    0x10(%rax),%rax
+   1805362a7:	48 83 e9 01          	sub    $0x1,%rcx
+   1805362ab:	75 f3                	jne    0x1805362a0
+   1805362ad:	f2 0f 11 4c 24 08    	movsd  %xmm1,0x8(%rsp)
+   1805362b3:	49 8d 40 10          	lea    0x10(%r8),%rax
+   1805362b7:	f2 0f 10 44 24 08    	movsd  0x8(%rsp),%xmm0
+   1805362bd:	66 0f c6 c0 00       	shufpd $0x0,%xmm0,%xmm0
+   1805362c2:	a8 0f                	test   $0xf,%al
+   1805362c4:	75 1b                	jne    0x1805362e1
+   1805362c6:	66 66 0f 1f 84 00 00 	data16 nopw 0x0(%rax,%rax,1)
+   1805362cd:	00 00 00 
+   1805362d0:	0f 11 00             	movups %xmm0,(%rax)
+   1805362d3:	48 8d 40 10          	lea    0x10(%rax),%rax
+   1805362d7:	48 83 ea 01          	sub    $0x1,%rdx
+   1805362db:	75 f3                	jne    0x1805362d0
+   1805362dd:	49 8b c0             	mov    %r8,%rax
+   1805362e0:	c3                   	ret
+   1805362e1:	0f 11 00             	movups %xmm0,(%rax)
+   1805362e4:	48 8d 40 10          	lea    0x10(%rax),%rax
+   1805362e8:	48 83 ea 01          	sub    $0x1,%rdx
+   1805362ec:	75 f3                	jne    0x1805362e1
+   1805362ee:	49 8b c0             	mov    %r8,%rax
+   1805362f1:	c3                   	ret
+   1805362f2:	cc                   	int3
+   1805362f3:	cc                   	int3
+   1805362f4:	cc                   	int3
+   1805362f5:	cc                   	int3
+   1805362f6:	cc                   	int3
+   1805362f7:	cc                   	int3
+   1805362f8:	cc                   	int3
+   1805362f9:	cc                   	int3
+   1805362fa:	cc                   	int3
+   1805362fb:	cc                   	int3
+   1805362fc:	cc                   	int3
+   1805362fd:	cc                   	int3
+   1805362fe:	cc                   	int3
+   1805362ff:	cc                   	int3
+   180536300:	48 89 5c 24 08       	mov    %rbx,0x8(%rsp)
+   180536305:	48 89 6c 24 18       	mov    %rbp,0x18(%rsp)
+   18053630a:	48 89 74 24 20       	mov    %rsi,0x20(%rsp)
+   18053630f:	48 89 54 24 10       	mov    %rdx,0x10(%rsp)
+   180536314:	57                   	push   %rdi
+   180536315:	41 54                	push   %r12
+   180536317:	41 55                	push   %r13
+   180536319:	41 56                	push   %r14
+   18053631b:	41 57                	push   %r15
+   18053631d:	48 83 ec 50          	sub    $0x50,%rsp
+   180536321:	48 63 bc 24 a0 00 00 	movslq 0xa0(%rsp),%rdi
+   180536328:	00 
+   180536329:	48 8d 15 88 aa 11 02 	lea    0x211aa88(%rip),%rdx        # 0x182650db8
+   180536330:	4c 8b b4 24 b0 00 00 	mov    0xb0(%rsp),%r14
+   180536337:	00 
+   180536338:	49 8b e9             	mov    %r9,%rbp
+   18053633b:	0f 29 74 24 40       	movaps %xmm6,0x40(%rsp)
+   180536340:	49 8b d8             	mov    %r8,%rbx
+   180536343:	66 0f 6e b1 80 00 24 	movd   0x240080(%rcx),%xmm6
+   18053634a:	00 
+   18053634b:	8d 04 fd 00 00 00 00 	lea    0x0(,%rdi,8),%eax
+   180536352:	4c 63 d0             	movslq %eax,%r10
+   180536355:	8d 04 3f             	lea    (%rdi,%rdi,1),%eax
+   180536358:	0f 5b f6             	cvtdq2ps %xmm6,%xmm6
+   18053635b:	4f 8d 24 96          	lea    (%r14,%r10,4),%r12
+   18053635f:	4c 63 d0             	movslq %eax,%r10
+   180536362:	4d 8d 3c bc          	lea    (%r12,%rdi,4),%r15
+   180536366:	4c 89 a4 24 b0 00 00 	mov    %r12,0xb0(%rsp)
+   18053636d:	00 
+   18053636e:	f3 0f 59 71 24       	mulss  0x24(%rcx),%xmm6
+   180536373:	48 8d 0d 3e aa 11 02 	lea    0x211aa3e(%rip),%rcx        # 0x182650db8
+   18053637a:	4b 8d 34 97          	lea    (%r15,%r10,4),%rsi
+   18053637e:	4e 8d 2c 96          	lea    (%rsi,%r10,4),%r13
+   180536382:	ff 15 80 4c 67 01    	call   *0x1674c80(%rip)        # 0x181bab008
+   180536388:	f2 0f 10 0d b8 de f8 	movsd  0x1f8deb8(%rip),%xmm1        # 0x1824c4248
+   18053638f:	01 
+   180536390:	44 8b cf             	mov    %edi,%r9d
+   180536393:	0f 5a c6             	cvtps2pd %xmm6,%xmm0
+   180536396:	85 c0                	test   %eax,%eax
+   180536398:	48 8b d3             	mov    %rbx,%rdx
+   18053639b:	49 8b cc             	mov    %r12,%rcx
+   18053639e:	0f 94 84 24 a8 00 00 	sete   0xa8(%rsp)
+   1805363a5:	00 
+   1805363a6:	f2 0f 5e c8          	divsd  %xmm0,%xmm1
+   1805363aa:	66 0f 5a d1          	cvtpd2ps %xmm1,%xmm2
+   1805363ae:	e8 4d 76 ff ff       	call   0x18052da00
+   1805363b3:	80 bd 10 08 00 00 00 	cmpb   $0x0,0x810(%rbp)
+   1805363ba:	44 8b c7             	mov    %edi,%r8d
+   1805363bd:	74 1a                	je     0x1805363d9
+   1805363bf:	f3 0f 10 0d dd da f8 	movss  0x1f8dadd(%rip),%xmm1        # 0x1824c3ea4
+   1805363c6:	01 
+   1805363c7:	48 8b 8c 24 88 00 00 	mov    0x88(%rsp),%rcx
+   1805363ce:	00 
+   1805363cf:	e8 7c 77 ff ff       	call   0x18052db50
+   1805363d4:	e9 88 01 00 00       	jmp    0x180536561
+   1805363d9:	f3 0f 10 35 c3 da f8 	movss  0x1f8dac3(%rip),%xmm6        # 0x1824c3ea4
+   1805363e0:	01 
+   1805363e1:	48 8b ce             	mov    %rsi,%rcx
+   1805363e4:	0f 28 ce             	movaps %xmm6,%xmm1
+   1805363e7:	e8 64 77 ff ff       	call   0x18052db50
+   1805363ec:	44 8b c7             	mov    %edi,%r8d
+   1805363ef:	0f 57 c9             	xorps  %xmm1,%xmm1
+   1805363f2:	49 8b cd             	mov    %r13,%rcx
+   1805363f5:	e8 56 77 ff ff       	call   0x18052db50
+   1805363fa:	33 db                	xor    %ebx,%ebx
+   1805363fc:	39                   	.byte 0x39
+   1805363fd:	9d                   	popf
+   1805363fe:	14 08                	adc    $0x8,%al

handoff/nls_dasm/hot_52e1c0.dis

@@ -0,0 +1,69 @@
+; hot_52e1c0
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+000000018052e1c0 <.data>:
+   18052e1c0:	05 e8 fa 2e ad       	add    $0xad2efae8,%eax
+   18052e1c5:	ff 85 f6 48 89 1f    	incl   0x1f8948f6(%rbp)
+   18052e1cb:	0f 48 f3             	cmovs  %ebx,%esi
+   18052e1ce:	89 77 08             	mov    %esi,0x8(%rdi)
+   18052e1d1:	85 f6                	test   %esi,%esi
+   18052e1d3:	74 2f                	je     0x18052e204
+   18052e1d5:	8d 0c b5 00 00 00 00 	lea    0x0(,%rsi,4),%ecx
+   18052e1dc:	e8 9f 2e ad ff       	call   0x180001080
+   18052e1e1:	48 89 07             	mov    %rax,(%rdi)
+   18052e1e4:	39 5f 08             	cmp    %ebx,0x8(%rdi)
+   18052e1e7:	7e 1b                	jle    0x18052e204
+   18052e1e9:	48 8b cb             	mov    %rbx,%rcx
+   18052e1ec:	0f 1f 40 00          	nopl   0x0(%rax)
+   18052e1f0:	48 8b 07             	mov    (%rdi),%rax
+   18052e1f3:	48 8d 49 04          	lea    0x4(%rcx),%rcx
+   18052e1f7:	ff c3                	inc    %ebx
+   18052e1f9:	f3 0f 11 74 01 fc    	movss  %xmm6,-0x4(%rcx,%rax,1)
+   18052e1ff:	3b 5f 08             	cmp    0x8(%rdi),%ebx
+   18052e202:	7c ec                	jl     0x18052e1f0
+   18052e204:	48 8b 5c 24 40       	mov    0x40(%rsp),%rbx
+   18052e209:	48 8b 74 24 48       	mov    0x48(%rsp),%rsi
+   18052e20e:	0f 28 74 24 20       	movaps 0x20(%rsp),%xmm6
+   18052e213:	48 83 c4 30          	add    $0x30,%rsp
+   18052e217:	5f                   	pop    %rdi
+   18052e218:	c3                   	ret
+   18052e219:	cc                   	int3
+   18052e21a:	cc                   	int3
+   18052e21b:	cc                   	int3
+   18052e21c:	cc                   	int3
+   18052e21d:	cc                   	int3
+   18052e21e:	cc                   	int3
+   18052e21f:	cc                   	int3
+   18052e220:	40 53                	rex push %rbx
+   18052e222:	48 83 ec 20          	sub    $0x20,%rsp
+   18052e226:	83 79 08 00          	cmpl   $0x0,0x8(%rcx)
+   18052e22a:	48 8b d9             	mov    %rcx,%rbx
+   18052e22d:	7e 1b                	jle    0x18052e24a
+   18052e22f:	48 8b 09             	mov    (%rcx),%rcx
+   18052e232:	48 85 c9             	test   %rcx,%rcx
+   18052e235:	74 05                	je     0x18052e23c
+   18052e237:	e8 84 2e ad ff       	call   0x1800010c0
+   18052e23c:	33 c0                	xor    %eax,%eax
+   18052e23e:	48 89 03             	mov    %rax,(%rbx)
+   18052e241:	89 43 08             	mov    %eax,0x8(%rbx)
+   18052e244:	48 83 c4 20          	add    $0x20,%rsp
+   18052e248:	5b                   	pop    %rbx
+   18052e249:	c3                   	ret
+   18052e24a:	33 c0                	xor    %eax,%eax
+   18052e24c:	48 89 01             	mov    %rax,(%rcx)
+   18052e24f:	89 41 08             	mov    %eax,0x8(%rcx)
+   18052e252:	48 83 c4 20          	add    $0x20,%rsp
+   18052e256:	5b                   	pop    %rbx
+   18052e257:	c3                   	ret
+   18052e258:	cc                   	int3
+   18052e259:	cc                   	int3
+   18052e25a:	cc                   	int3
+   18052e25b:	cc                   	int3
+   18052e25c:	cc                   	int3
+   18052e25d:	cc                   	int3
+   18052e25e:	cc                   	int3
+   18052e25f:	cc                   	int3

handoff/nls_dasm/hot_534580.dis

@@ -0,0 +1,198 @@
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+0000000180534580 <.data>:
+   180534580:	48 89 1f             	mov    %rbx,(%rdi)
+   180534583:	0f 48 f3             	cmovs  %ebx,%esi
+   180534586:	89 77 08             	mov    %esi,0x8(%rdi)
+   180534589:	85 f6                	test   %esi,%esi
+   18053458b:	74 26                	je     0x1805345b3
+   18053458d:	8b ce                	mov    %esi,%ecx
+   18053458f:	e8 ec ca ac ff       	call   0x180001080
+   180534594:	48 89 07             	mov    %rax,(%rdi)
+   180534597:	39 5f 08             	cmp    %ebx,0x8(%rdi)
+   18053459a:	7e 17                	jle    0x1805345b3
+   18053459c:	48 8b cb             	mov    %rbx,%rcx
+   18053459f:	90                   	nop
+   1805345a0:	48 8b 07             	mov    (%rdi),%rax
+   1805345a3:	48 8d 49 01          	lea    0x1(%rcx),%rcx
+   1805345a7:	ff c3                	inc    %ebx
+   1805345a9:	c6 44 01 ff 00       	movb   $0x0,-0x1(%rcx,%rax,1)
+   1805345ae:	3b 5f 08             	cmp    0x8(%rdi),%ebx
+   1805345b1:	7c ed                	jl     0x1805345a0
+   1805345b3:	48 8b 5c 24 30       	mov    0x30(%rsp),%rbx
+   1805345b8:	48 8b 74 24 38       	mov    0x38(%rsp),%rsi
+   1805345bd:	48 83 c4 20          	add    $0x20,%rsp
+   1805345c1:	5f                   	pop    %rdi
+   1805345c2:	c3                   	ret
+   1805345c3:	cc                   	int3
+   1805345c4:	cc                   	int3
+   1805345c5:	cc                   	int3
+   1805345c6:	cc                   	int3
+   1805345c7:	cc                   	int3
+   1805345c8:	cc                   	int3
+   1805345c9:	cc                   	int3
+   1805345ca:	cc                   	int3
+   1805345cb:	cc                   	int3
+   1805345cc:	cc                   	int3
+   1805345cd:	cc                   	int3
+   1805345ce:	cc                   	int3
+   1805345cf:	cc                   	int3
+   1805345d0:	40 53                	rex push %rbx
+   1805345d2:	48 83 ec 40          	sub    $0x40,%rsp
+   1805345d6:	48 c7 44 24 30 fe ff 	movq   $0xfffffffffffffffe,0x30(%rsp)
+   1805345dd:	ff ff 
+   1805345df:	48 8b d9             	mov    %rcx,%rbx
+   1805345e2:	48 8d 05 c7 ce f3 ff 	lea    -0xc3139(%rip),%rax        # 0x1804714b0
+   1805345e9:	48 89 44 24 20       	mov    %rax,0x20(%rsp)
+   1805345ee:	4c 8d 0d 8b 00 00 00 	lea    0x8b(%rip),%r9        # 0x180534680
+   1805345f5:	ba 80 00 00 00       	mov    $0x80,%edx
+   1805345fa:	44 8d 42 90          	lea    -0x70(%rdx),%r8d
+   1805345fe:	e8 01 d6 bf 00       	call   0x181131c04
+   180534603:	90                   	nop
+   180534604:	c7 83 00 08 00 00 08 	movl   $0x8,0x800(%rbx)
+   18053460b:	00 00 00 
+   18053460e:	48 c7 83 04 08 00 00 	movq   $0x447a0000,0x804(%rbx)
+   180534615:	00 00 7a 44 
+   180534619:	c7 83 0c 08 00 00 f4 	movl   $0x3f34fdf4,0x80c(%rbx)
+   180534620:	fd 34 3f 
+   180534623:	c6 83 10 08 00 00 00 	movb   $0x0,0x810(%rbx)
+   18053462a:	c7 83 14 08 00 00 01 	movl   $0x1,0x814(%rbx)
+   180534631:	00 00 00 
+   180534634:	33 c0                	xor    %eax,%eax
+   180534636:	48 89 83 18 08 00 00 	mov    %rax,0x818(%rbx)
+   18053463d:	48 89 83 20 08 00 00 	mov    %rax,0x820(%rbx)
+   180534644:	48 8b c3             	mov    %rbx,%rax
+   180534647:	48 83 c4 40          	add    $0x40,%rsp
+   18053464b:	5b                   	pop    %rbx
+   18053464c:	c3                   	ret
+   18053464d:	cc                   	int3
+   18053464e:	cc                   	int3
+   18053464f:	cc                   	int3
+   180534650:	48 83 ec 38          	sub    $0x38,%rsp
+   180534654:	48 c7 44 24 20 fe ff 	movq   $0xfffffffffffffffe,0x20(%rsp)
+   18053465b:	ff ff 
+   18053465d:	4c 8d 0d 4c ce f3 ff 	lea    -0xc31b4(%rip),%r9        # 0x1804714b0
+   180534664:	ba 80 00 00 00       	mov    $0x80,%edx
+   180534669:	44 8d 42 90          	lea    -0x70(%rdx),%r8d
+   18053466d:	e8 aa d0 bf 00       	call   0x18113171c
+   180534672:	90                   	nop
+   180534673:	48 83 c4 38          	add    $0x38,%rsp
+   180534677:	c3                   	ret
+   180534678:	cc                   	int3
+   180534679:	cc                   	int3
+   18053467a:	cc                   	int3
+   18053467b:	cc                   	int3
+   18053467c:	cc                   	int3
+   18053467d:	cc                   	int3
+   18053467e:	cc                   	int3
+   18053467f:	cc                   	int3
+   180534680:	48 83 ec 28          	sub    $0x28,%rsp
+   180534684:	e8 a7 00 00 00       	call   0x180534730
+   180534689:	4c 8b 19             	mov    (%rcx),%r11
+   18053468c:	48 ba 00 00 00 00 00 	movabs $0x3ff0000000000000,%rdx
+   180534693:	00 f0 3f 
+   180534696:	49 89 13             	mov    %rdx,(%r11)
+   180534699:	48 8b 41 08          	mov    0x8(%rcx),%rax
+   18053469d:	48 89 10             	mov    %rdx,(%rax)
+   1805346a0:	48 8b c1             	mov    %rcx,%rax
+   1805346a3:	48 83 c4 28          	add    $0x28,%rsp
+   1805346a7:	c3                   	ret
+   1805346a8:	cc                   	int3
+   1805346a9:	cc                   	int3
+   1805346aa:	cc                   	int3
+   1805346ab:	cc                   	int3
+   1805346ac:	cc                   	int3
+   1805346ad:	cc                   	int3
+   1805346ae:	cc                   	int3
+   1805346af:	cc                   	int3
+   1805346b0:	48 89 5c 24 08       	mov    %rbx,0x8(%rsp)
+   1805346b5:	48 89 74 24 10       	mov    %rsi,0x10(%rsp)
+   1805346ba:	57                   	push   %rdi
+   1805346bb:	48 83 ec 20          	sub    $0x20,%rsp
+   1805346bf:	48 8b d9             	mov    %rcx,%rbx
+   1805346c2:	8b f2                	mov    %edx,%esi
+   1805346c4:	48 83 c1 60          	add    $0x60,%rcx
+   1805346c8:	e8 a3 11 d7 00       	call   0x1812a5870
+   1805346cd:	48 8d 05 64 7f f7 01 	lea    0x1f77f64(%rip),%rax        # 0x1824ac638
+   1805346d4:	48 89 03             	mov    %rax,(%rbx)
+   1805346d7:	48 8b 4b 48          	mov    0x48(%rbx),%rcx
+   1805346db:	c7 43 54 00 00 00 00 	movl   $0x0,0x54(%rbx)
+   1805346e2:	ff 15 c0 6b 67 01    	call   *0x1676bc0(%rip)        # 0x181bab2a8
+   1805346e8:	48 8b 7b 08          	mov    0x8(%rbx),%rdi
+   1805346ec:	48 85 ff             	test   %rdi,%rdi
+   1805346ef:	74 17                	je     0x180534708
+   1805346f1:	48 8b 4f 18          	mov    0x18(%rdi),%rcx
+   1805346f5:	ff 15 ad 6b 67 01    	call   *0x1676bad(%rip)        # 0x181bab2a8
+   1805346fb:	ba 28 01 00 00       	mov    $0x128,%edx
+   180534700:	48 8b cf             	mov    %rdi,%rcx
+   180534703:	e8 ec c9 bf 00       	call   0x1811310f4
+   180534708:	40 f6 c6 01          	test   $0x1,%sil
+   18053470c:	74 0d                	je     0x18053471b
+   18053470e:	ba e0 00 00 00       	mov    $0xe0,%edx
+   180534713:	48 8b cb             	mov    %rbx,%rcx
+   180534716:	e8 d9 c9 bf 00       	call   0x1811310f4
+   18053471b:	48 8b 74 24 38       	mov    0x38(%rsp),%rsi
+   180534720:	48 8b c3             	mov    %rbx,%rax
+   180534723:	48 8b 5c 24 30       	mov    0x30(%rsp),%rbx
+   180534728:	48 83 c4 20          	add    $0x20,%rsp
+   18053472c:	5f                   	pop    %rdi
+   18053472d:	c3                   	ret
+   18053472e:	cc                   	int3
+   18053472f:	cc                   	int3
+   180534730:	4c 8d 41 18          	lea    0x18(%rcx),%r8
+   180534734:	c7 41 10 03 00 00 00 	movl   $0x3,0x10(%rcx)
+   18053473b:	49 8b c0             	mov    %r8,%rax
+   18053473e:	4c 89 01             	mov    %r8,(%rcx)
+   180534741:	0f 57 c9             	xorps  %xmm1,%xmm1
+   180534744:	c6 41 78 01          	movb   $0x1,0x78(%rcx)
+   180534748:	48 83 c0 10          	add    $0x10,%rax
+   18053474c:	f2 0f 11 4c 24 08    	movsd  %xmm1,0x8(%rsp)
+   180534752:	f2 0f 10 44 24 08    	movsd  0x8(%rsp),%xmm0
+   180534758:	48 8d 51 30          	lea    0x30(%rcx),%rdx
+   18053475c:	48 89 51 08          	mov    %rdx,0x8(%rcx)
+   180534760:	66 0f c6 c0 00       	shufpd $0x0,%xmm0,%xmm0
+   180534765:	41 f6 c0 0f          	test   $0xf,%r8b
+   180534769:	75 06                	jne    0x180534771
+   18053476b:	41 0f 11 00          	movups %xmm0,(%r8)
+   18053476f:	eb 0f                	jmp    0x180534780
+   180534771:	41 0f 11 00          	movups %xmm0,(%r8)
+   180534775:	66 66 66 0f 1f 84 00 	data16 data16 nopw 0x0(%rax,%rax,1)
+   18053477c:	00 00 00 00 
+   180534780:	45 33 c9             	xor    %r9d,%r9d
+   180534783:	f2 0f 11 4c 24 08    	movsd  %xmm1,0x8(%rsp)
+   180534789:	f2 0f 10 44 24 08    	movsd  0x8(%rsp),%xmm0
+   18053478f:	4c 89 08             	mov    %r9,(%rax)
+   180534792:	48 8b c2             	mov    %rdx,%rax
+   180534795:	48 83 c0 10          	add    $0x10,%rax
+   180534799:	66 0f c6 c0 00       	shufpd $0x0,%xmm0,%xmm0
+   18053479e:	f6 c2 0f             	test   $0xf,%dl
+   1805347a1:	75 05                	jne    0x1805347a8
+   1805347a3:	0f 11 02             	movups %xmm0,(%rdx)
+   1805347a6:	eb 08                	jmp    0x1805347b0
+   1805347a8:	0f 11 02             	movups %xmm0,(%rdx)
+   1805347ab:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
+   1805347b0:	4c 89 08             	mov    %r9,(%rax)
+   1805347b3:	49 ba 00 00 00 00 00 	movabs $0x3ff0000000000000,%r10
+   1805347ba:	00 f0 3f 
+   1805347bd:	4d 89 10             	mov    %r10,(%r8)
+   1805347c0:	4c 8d 41 48          	lea    0x48(%rcx),%r8
+   1805347c4:	49 8b c0             	mov    %r8,%rax
+   1805347c7:	f2 0f 11 4c 24 08    	movsd  %xmm1,0x8(%rsp)
+   1805347cd:	f2 0f 10 44 24 08    	movsd  0x8(%rsp),%xmm0
+   1805347d3:	48 83 c0 10          	add    $0x10,%rax
+   1805347d7:	4c 89 12             	mov    %r10,(%rdx)
+   1805347da:	66 0f c6 c0 00       	shufpd $0x0,%xmm0,%xmm0
+   1805347df:	41 f6 c0 0f          	test   $0xf,%r8b
+   1805347e3:	75 06                	jne    0x1805347eb
+   1805347e5:	41 0f 11 00          	movups %xmm0,(%r8)
+   1805347e9:	eb 05                	jmp    0x1805347f0
+   1805347eb:	41 0f 11 00          	movups %xmm0,(%r8)
+   1805347ef:	90                   	nop
+   1805347f0:	48 8d 51 60          	lea    0x60(%rcx),%rdx
+   1805347f4:	4c 89 08             	mov    %r9,(%rax)
+   1805347f7:	48 8b c2             	mov    %rdx,%rax
+   1805347fa:	f2 0f 11 4c 24 08    	movsd  %xmm1,0x8(%rsp)

handoff/nls_dasm/hot_b0c3e0.dis

@@ -0,0 +1,235 @@
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+0000000180b0c3a0 <.data>:
+   180b0c3a0:	00 80 7d 07 ff c9    	add    %al,-0x3600f883(%rax)
+   180b0c3a6:	83 c9 fe             	or     $0xfffffffe,%ecx
+   180b0c3a9:	ff c1                	inc    %ecx
+   180b0c3ab:	85 c9                	test   %ecx,%ecx
+   180b0c3ad:	75 b2                	jne    0x180b0c361
+   180b0c3af:	ff 54 24 60          	call   *0x60(%rsp)
+   180b0c3b3:	48 83 f8 01          	cmp    $0x1,%rax
+   180b0c3b7:	be 00 00 00 00       	mov    $0x0,%esi
+   180b0c3bc:	76 2e                	jbe    0x180b0c3ec
+   180b0c3be:	48 8d 84 24 c8 00 00 	lea    0xc8(%rsp),%rax
+   180b0c3c5:	00 
+   180b0c3c6:	48 b9 cc cc cc cc cc 	movabs $0xcccccccccccccccc,%rcx
+   180b0c3cd:	cc cc cc 
+   180b0c3d0:	48 39 08             	cmp    %rcx,(%rax)
+   180b0c3d3:	74 17                	je     0x180b0c3ec
+   180b0c3d5:	66 66 66 0f 1f 84 00 	data16 data16 nopw 0x0(%rax,%rax,1)
+   180b0c3dc:	00 00 00 00 
+   180b0c3e0:	48 89 30             	mov    %rsi,(%rax)
+   180b0c3e3:	48 8d 40 40          	lea    0x40(%rax),%rax
+   180b0c3e7:	48 39 08             	cmp    %rcx,(%rax)
+   180b0c3ea:	75 f4                	jne    0x180b0c3e0
+   180b0c3ec:	48 8d b4 24 c8 00 00 	lea    0xc8(%rsp),%rsi
+   180b0c3f3:	00 
+   180b0c3f4:	eb 03                	jmp    0x180b0c3f9
+   180b0c3f6:	4c 8b ca             	mov    %rdx,%r9
+   180b0c3f9:	41 53                	push   %r11
+   180b0c3fb:	41 56                	push   %r14
+   180b0c3fd:	4c 8d 1d 78 fa ff ff 	lea    -0x588(%rip),%r11        # 0x180b0be7c
+   180b0c404:	4d 8b f3             	mov    %r11,%r14
+   180b0c407:	49 81 c6 ae 06 00 00 	add    $0x6ae,%r14
+   180b0c40e:	48 8d 64 24 f0       	lea    -0x10(%rsp),%rsp
+   180b0c413:	4d 03 cf             	add    %r15,%r9
+   180b0c416:	4d 85 e0             	test   %r12,%r8
+   180b0c419:	49 3b d0             	cmp    %r8,%rdx
+   180b0c41c:	4d 2b cf             	sub    %r15,%r9
+   180b0c41f:	4c 89 74 24 08       	mov    %r14,0x8(%rsp)
+   180b0c424:	48 f7 d2             	not    %rdx
+   180b0c427:	48 8d 52 01          	lea    0x1(%rdx),%rdx
+   180b0c42b:	4c 3b e8             	cmp    %rax,%r13
+   180b0c42e:	4d 85 cf             	test   %r9,%r15
+   180b0c431:	48 f7 d2             	not    %rdx
+   180b0c434:	48 8d 52 01          	lea    0x1(%rdx),%rdx
+   180b0c438:	48 83 ec f8          	sub    $0xfffffffffffffff8,%rsp
+   180b0c43c:	49 c7 c6 83 1f 00 00 	mov    $0x1f83,%r14
+   180b0c443:	4d 03 f3             	add    %r11,%r14
+   180b0c446:	41 56                	push   %r14
+   180b0c448:	49 c7 c6 3c 06 00 00 	mov    $0x63c,%r14
+   180b0c44f:	4d 03 f3             	add    %r11,%r14
+   180b0c452:	41 56                	push   %r14
+   180b0c454:	49 c7 c6 49 cc 01 00 	mov    $0x1cc49,%r14
+   180b0c45b:	4d 03 f3             	add    %r11,%r14
+   180b0c45e:	48 83 c4 e8          	add    $0xffffffffffffffe8,%rsp
+   180b0c462:	49 81 c4 8e ee 39 13 	add    $0x1339ee8e,%r12
+   180b0c469:	48 a9 1d 6a 9f 2f    	test   $0x2f9f6a1d,%rax
+   180b0c46f:	49 f7 c2 89 fe 1a 73 	test   $0x731afe89,%r10
+   180b0c476:	49 81 ec 8e ee 39 13 	sub    $0x1339ee8e,%r12
+   180b0c47d:	4c 89 74 24 10       	mov    %r14,0x10(%rsp)
+   180b0c482:	49 81 e9 b1 fe 6e 2c 	sub    $0x2c6efeb1,%r9
+   180b0c489:	49 3b c1             	cmp    %r9,%rax
+   180b0c48c:	49 f7 c4 a6 46 72 79 	test   $0x797246a6,%r12
+   180b0c493:	49 81 c1 b1 fe 6e 2c 	add    $0x2c6efeb1,%r9
+   180b0c49a:	48 83 ec f0          	sub    $0xfffffffffffffff0,%rsp
+   180b0c49e:	4d 85 ea             	test   %r13,%r10
+   180b0c4a1:	49 c7 c6 3c 06 00 00 	mov    $0x63c,%r14
+   180b0c4a8:	4d 03 f3             	add    %r11,%r14
+   180b0c4ab:	48 8d 64 24 f8       	lea    -0x8(%rsp),%rsp
+   180b0c4b0:	4d 2b cd             	sub    %r13,%r9
+   180b0c4b3:	eb 04                	jmp    0x180b0c4b9
+   180b0c4b5:	32 04 24             	xor    (%rsp),%al
+   180b0c4b8:	c3                   	ret
+   180b0c4b9:	4d 03 cd             	add    %r13,%r9
+   180b0c4bc:	4c 89 34 24          	mov    %r14,(%rsp)
+   180b0c4c0:	4d 8b f3             	mov    %r11,%r14
+   180b0c4c3:	49 81 c6 83 1f 00 00 	add    $0x1f83,%r14
+   180b0c4ca:	48 83 c4 e8          	add    $0xffffffffffffffe8,%rsp
+   180b0c4ce:	4c 89 74 24 10       	mov    %r14,0x10(%rsp)
+   180b0c4d3:	4d 2b d0             	sub    %r8,%r10
+   180b0c4d6:	eb 08                	jmp    0x180b0c4e0
+   180b0c4d8:	2b 04 24             	sub    (%rsp),%eax
+   180b0c4db:	03 44 24 f8          	add    -0x8(%rsp),%eax
+   180b0c4df:	c3                   	ret
+   180b0c4e0:	4d 03 d0             	add    %r8,%r10
+   180b0c4e3:	48 83 c4 10          	add    $0x10,%rsp
+   180b0c4e7:	4d 8b f3             	mov    %r11,%r14
+   180b0c4ea:	49 81 c6 33 d0 ff ff 	add    $0xffffffffffffd033,%r14
+   180b0c4f1:	41 56                	push   %r14
+   180b0c4f3:	49 c7 c6 5f 1f 00 00 	mov    $0x1f5f,%r14
+   180b0c4fa:	4d 03 f3             	add    %r11,%r14
+   180b0c4fd:	41 56                	push   %r14
+   180b0c4ff:	4d 8b f3             	mov    %r11,%r14
+   180b0c502:	49 81 c6 3c 06 00 00 	add    $0x63c,%r14
+   180b0c509:	41 ff e6             	jmp    *%r14
+   180b0c50c:	7c 16                	jl     0x180b0c524
+   180b0c50e:	4c 2b fa             	sub    %rdx,%r15
+   180b0c511:	48 81 fa bd da 55 14 	cmp    $0x1455dabd,%rdx
+   180b0c518:	48 f7 c2 bf a9 c1 1f 	test   $0x1fc1a9bf,%rdx
+   180b0c51f:	4c 03 fa             	add    %rdx,%r15
+   180b0c522:	eb 06                	jmp    0x180b0c52a
+   180b0c524:	eb 04                	jmp    0x180b0c52a
+   180b0c526:	02 24 24             	add    (%rsp),%ah
+   180b0c529:	c3                   	ret
+   180b0c52a:	48 81 ea da 69 00 00 	sub    $0x69da,%rdx
+   180b0c531:	41 5e                	pop    %r14
+   180b0c533:	41 5b                	pop    %r11
+   180b0c535:	8b 06                	mov    (%rsi),%eax
+   180b0c537:	8d 48 01             	lea    0x1(%rax),%ecx
+   180b0c53a:	0f af c8             	imul   %eax,%ecx
+   180b0c53d:	81 e1 01 00 00 80    	and    $0x80000001,%ecx
+   180b0c543:	7d 07                	jge    0x180b0c54c
+   180b0c545:	ff c9                	dec    %ecx
+   180b0c547:	83 c9 fe             	or     $0xfffffffe,%ecx
+   180b0c54a:	ff c1                	inc    %ecx
+   180b0c54c:	85 c9                	test   %ecx,%ecx
+   180b0c54e:	0f 85 a0 fe ff ff    	jne    0x180b0c3f4
+   180b0c554:	4d 3b f7             	cmp    %r15,%r14
+   180b0c557:	0f 84 a3 01 00 00    	je     0x180b0c700
+   180b0c55d:	4b 8d 34 34          	lea    (%r12,%r14,1),%rsi
+   180b0c561:	4d 03 fc             	add    %r12,%r15
+   180b0c564:	49 f7 df             	neg    %r15
+   180b0c567:	48 8d 9c 24 c8 00 00 	lea    0xc8(%rsp),%rbx
+   180b0c56e:	00 
+   180b0c56f:	4c 8d 25 4a 5a b1 01 	lea    0x1b15a4a(%rip),%r12        # 0x182621fc0
+   180b0c576:	66 66 0f 1f 84 00 00 	data16 nopw 0x0(%rax,%rax,1)
+   180b0c57d:	00 00 00 
+   180b0c580:	4c 8b f6             	mov    %rsi,%r14
+   180b0c583:	48 85 ff             	test   %rdi,%rdi
+   180b0c586:	0f 84 a4 00 00 00    	je     0x180b0c630
+   180b0c58c:	48 8b 17             	mov    (%rdi),%rdx
+   180b0c58f:	48 85 d2             	test   %rdx,%rdx
+   180b0c592:	0f 88 98 00 00 00    	js     0x180b0c630
+   180b0c598:	48 b8 c0 1f 62 02 00 	movabs $0x2621fc0,%rax
+   180b0c59f:	00 00 00 
+   180b0c5a2:	48 89 44 24 48       	mov    %rax,0x48(%rsp)
+   180b0c5a7:	48 8b 44 24 48       	mov    0x48(%rsp),%rax
+   180b0c5ac:	4d 8b c4             	mov    %r12,%r8
+   180b0c5af:	4c 2b c0             	sub    %rax,%r8
+   180b0c5b2:	49 8d 40 08          	lea    0x8(%r8),%rax
+   180b0c5b6:	48 03 c2             	add    %rdx,%rax
+   180b0c5b9:	48 3b c6             	cmp    %rsi,%rax
+   180b0c5bc:	77 0e                	ja     0x180b0c5cc
+   180b0c5be:	48 83 c7 08          	add    $0x8,%rdi
+   180b0c5c2:	48 8b 17             	mov    (%rdi),%rdx
+   180b0c5c5:	48 85 d2             	test   %rdx,%rdx
+   180b0c5c8:	79 e8                	jns    0x180b0c5b2
+   180b0c5ca:	eb 64                	jmp    0x180b0c630
+   180b0c5cc:	48 85 d2             	test   %rdx,%rdx
+   180b0c5cf:	78 5f                	js     0x180b0c630
+   180b0c5d1:	49 8d 0c 10          	lea    (%r8,%rdx,1),%rcx
+   180b0c5d5:	4c 8d 5e 04          	lea    0x4(%rsi),%r11
+   180b0c5d9:	49 3b cb             	cmp    %r11,%rcx
+   180b0c5dc:	73 52                	jae    0x180b0c630
+   180b0c5de:	4c 8b cf             	mov    %rdi,%r9
+   180b0c5e1:	4c 8d b4 24 88 00 00 	lea    0x88(%rsp),%r14
+   180b0c5e8:	00 
+   180b0c5e9:	8b 06                	mov    (%rsi),%eax
+   180b0c5eb:	89 84 24 88 00 00 00 	mov    %eax,0x88(%rsp)
+   180b0c5f2:	4d 8b d0             	mov    %r8,%r10
+   180b0c5f5:	4c 2b d6             	sub    %rsi,%r10
+   180b0c5f8:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
+   180b0c5ff:	00 
+   180b0c600:	48 8b 09             	mov    (%rcx),%rcx
+   180b0c603:	49 2b c8             	sub    %r8,%rcx
+   180b0c606:	49 8d 04 12          	lea    (%r10,%rdx,1),%rax
+   180b0c60a:	48 89 8c 04 88 00 00 	mov    %rcx,0x88(%rsp,%rax,1)
+   180b0c611:	00 
+   180b0c612:	4d 8d 49 08          	lea    0x8(%r9),%r9
+   180b0c616:	49 8b 11             	mov    (%r9),%rdx
+   180b0c619:	48 85 d2             	test   %rdx,%rdx
+   180b0c61c:	78 12                	js     0x180b0c630
+   180b0c61e:	49 8d 0c 10          	lea    (%r8,%rdx,1),%rcx
+   180b0c622:	49 3b cb             	cmp    %r11,%rcx
+   180b0c625:	72 d9                	jb     0x180b0c600
+   180b0c627:	66 0f 1f 84 00 00 00 	nopw   0x0(%rax,%rax,1)
+   180b0c62e:	00 00 
+   180b0c630:	4c 8d 4c 24 50       	lea    0x50(%rsp),%r9
+   180b0c635:	45 33 c0             	xor    %r8d,%r8d
+   180b0c638:	49 8b d6             	mov    %r14,%rdx
+   180b0c63b:	b9 14 72 00 00       	mov    $0x7214,%ecx
+   180b0c640:	39 c8                	cmp    %ecx,%eax
+   180b0c642:	48 85 c0             	test   %rax,%rax
+   180b0c645:	48 83 c4 c8          	add    $0xffffffffffffffc8,%rsp
+   180b0c649:	49 81 c1 b2 c6 45 2b 	add    $0x2b45c6b2,%r9
+   180b0c650:	48 85 d0             	test   %rdx,%rax
+   180b0c653:	49 81 e9 b2 c6 45 2b 	sub    $0x2b45c6b2,%r9
+   180b0c65a:	48 89 74 24 30       	mov    %rsi,0x30(%rsp)
+   180b0c65f:	49 81 f5 ce cd f1 1a 	xor    $0x1af1cdce,%r13
+   180b0c666:	4d 85 ec             	test   %r13,%r12
+   180b0c669:	48 81 fa ff 37 12 61 	cmp    $0x611237ff,%rdx
+   180b0c670:	49 81 f5 ce cd f1 1a 	xor    $0x1af1cdce,%r13
+   180b0c677:	48 83 ec d0          	sub    $0xffffffffffffffd0,%rsp
+   180b0c67b:	48 8b f2             	mov    %rdx,%rsi
+   180b0c67e:	eb 01                	jmp    0x180b0c681
+   180b0c680:	35 8b 06 eb 01       	xor    $0x1eb068b,%eax
+   180b0c685:	c3                   	ret
+   180b0c686:	41 89 01             	mov    %eax,(%r9)
+   180b0c689:	48 83 c4 d8          	add    $0xffffffffffffffd8,%rsp
+   180b0c68d:	4d 85 e0             	test   %r12,%r8
+   180b0c690:	48 3d 0c 68 55 6c    	cmp    $0x6c55680c,%rax
+   180b0c696:	49 f7 c2 cf c3 7a 65 	test   $0x657ac3cf,%r10
+   180b0c69d:	48 8b 74 24 28       	mov    0x28(%rsp),%rsi
+   180b0c6a2:	f6 c1 c1             	test   $0xc1,%cl
+   180b0c6a5:	74 04                	je     0x180b0c6ab
+   180b0c6a7:	2c 02                	sub    $0x2,%al
+   180b0c6a9:	24 f5                	and    $0xf5,%al
+   180b0c6ab:	48 83 c4 30          	add    $0x30,%rsp
+   180b0c6af:	8b 0b                	mov    (%rbx),%ecx
+   180b0c6b1:	8d 41 01             	lea    0x1(%rcx),%eax
+   180b0c6b4:	0f af c1             	imul   %ecx,%eax
+   180b0c6b7:	25 01 00 00 80       	and    $0x80000001,%eax
+   180b0c6bc:	7d 07                	jge    0x180b0c6c5
+   180b0c6be:	ff c8                	dec    %eax
+   180b0c6c0:	83 c8 fe             	or     $0xfffffffe,%eax
+   180b0c6c3:	ff c0                	inc    %eax
+   180b0c6c5:	85 c0                	test   %eax,%eax
+   180b0c6c7:	0f 85 63 ff ff ff    	jne    0x180b0c630
+   180b0c6cd:	03 6c 24 50          	add    0x50(%rsp),%ebp
+   180b0c6d1:	41 0f af ed          	imul   %r13d,%ebp
+   180b0c6d5:	8b c5                	mov    %ebp,%eax
+   180b0c6d7:	c1 e8 10             	shr    $0x10,%eax
+   180b0c6da:	33 e8                	xor    %eax,%ebp
+   180b0c6dc:	48 83 c6 04          	add    $0x4,%rsi
+   180b0c6e0:	49 8d 04 37          	lea    (%r15,%rsi,1),%rax
+   180b0c6e4:	48 85 c0             	test   %rax,%rax
+   180b0c6e7:	0f 85 93 fe ff ff    	jne    0x180b0c580
+   180b0c6ed:	48 8b 5c 24 68       	mov    0x68(%rsp),%rbx
+   180b0c6f2:	48 8d b4 24 c8 00 00 	lea    0xc8(%rsp),%rsi
+   180b0c6f9:	00 
+   180b0c6fa:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)

handoff/nls_dasm/imp_141400.dis

@@ -0,0 +1,15 @@
+; imp_141400: VA 0x180141400-0x180141420 (32 bytes)
+
+/tmp/opencode/dis/imp_141400.bin:     file format binary
+
+
+Disassembly of section .data:
+
+0000000000000000 <.data>:
+   0:	48 8b 05 d1 6d 4d 02 	mov    0x24d6dd1(%rip),%rax        # 0x24d6dd8
+   7:	ff e0                	jmp    *%rax
+   9:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
+  10:	00 
+  11:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
+  18:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
+  1f:	00 

handoff/nls_dasm/imp_141580.dis

@@ -0,0 +1,15 @@
+; imp_141580: VA 0x180141580-0x1801415a0 (32 bytes)
+
+/tmp/opencode/dis/imp_141580.bin:     file format binary
+
+
+Disassembly of section .data:
+
+0000000000000000 <.data>:
+   0:	48 8b 05 41 6e 4d 02 	mov    0x24d6e41(%rip),%rax        # 0x24d6e48
+   7:	ff e0                	jmp    *%rax
+   9:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
+  10:	00 
+  11:	0f 1f 80 00 00 00 00 	nopl   0x0(%rax)
+  18:	0f 1f 84 00 00 00 00 	nopl   0x0(%rax,%rax,1)
+  1f:	00 

handoff/nls_dasm/vt_542100.dis

@@ -0,0 +1,594 @@
+; vt_542100
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+0000000180542100 <.data>:
+   180542100:	40 3d 57 41 56 45    	rex cmp $0x45564157,%eax
+   180542106:	0f 85 6b 14 00 00    	jne    0x180543577
+   18054210c:	41 80 bd 84 00 00 00 	cmpb   $0x0,0x84(%r13)
+   180542113:	00 
+   180542114:	74 6e                	je     0x180542184
+   180542116:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   18054211a:	48 8b 01             	mov    (%rcx),%rax
+   18054211d:	ff 50 40             	call   *0x40(%rax)
+   180542120:	3d 64 73 36 34       	cmp    $0x34367364,%eax
+   180542125:	75 5d                	jne    0x180542184
+   180542127:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   18054212b:	48 8b 01             	mov    (%rcx),%rax
+   18054212e:	ff 50 40             	call   *0x40(%rax)
+   180542131:	83 f8 1c             	cmp    $0x1c,%eax
+   180542134:	0f 82 89 14 00 00    	jb     0x1805435c3
+   18054213a:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   18054213e:	8b d8                	mov    %eax,%ebx
+   180542140:	48 8b 01             	mov    (%rcx),%rax
+   180542143:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   180542149:	8b fb                	mov    %ebx,%edi
+   18054214b:	83 e7 01             	and    $0x1,%edi
+   18054214e:	48 03 c3             	add    %rbx,%rax
+   180542151:	48 03 f8             	add    %rax,%rdi
+   180542154:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542158:	48 8b 01             	mov    (%rcx),%rax
+   18054215b:	ff 50 50             	call   *0x50(%rax)
+   18054215e:	4c 8d 3c 06          	lea    (%rsi,%rax,1),%r15
+   180542162:	4c 89 7d 88          	mov    %r15,-0x78(%rbp)
+   180542166:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   18054216a:	48 8b 01             	mov    (%rcx),%rax
+   18054216d:	ff 50 50             	call   *0x50(%rax)
+   180542170:	49 89 45 78          	mov    %rax,0x78(%r13)
+   180542174:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542178:	48 8b 01             	mov    (%rcx),%rax
+   18054217b:	48 8b d7             	mov    %rdi,%rdx
+   18054217e:	ff 90 b0 00 00 00    	call   *0xb0(%rax)
+   180542184:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542188:	48 8b 01             	mov    (%rcx),%rax
+   18054218b:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   180542191:	49 3b c7             	cmp    %r15,%rax
+   180542194:	0f 83 dd 13 00 00    	jae    0x180543577
+   18054219a:	4c 8d 3d ff aa f6 01 	lea    0x1f6aaff(%rip),%r15        # 0x1824acca0
+   1805421a1:	48 8d 35 f0 aa f6 01 	lea    0x1f6aaf0(%rip),%rsi        # 0x1824acc98
+   1805421a8:	4c 8d 25 20 ab f6 01 	lea    0x1f6ab20(%rip),%r12        # 0x1824acccf
+   1805421af:	4c 8d 35 12 ab f6 01 	lea    0x1f6ab12(%rip),%r14        # 0x1824accc8
+   1805421b6:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   1805421ba:	48 8b 01             	mov    (%rcx),%rax
+   1805421bd:	ff 50 10             	call   *0x10(%rax)
+   1805421c0:	84 c0                	test   %al,%al
+   1805421c2:	0f 85 7b 11 00 00    	jne    0x180543343
+   1805421c8:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   1805421cc:	48 8b 01             	mov    (%rcx),%rax
+   1805421cf:	ff 50 40             	call   *0x40(%rax)
+   1805421d2:	8b d8                	mov    %eax,%ebx
+   1805421d4:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   1805421d8:	48 8b 01             	mov    (%rcx),%rax
+   1805421db:	ff 50 40             	call   *0x40(%rax)
+   1805421de:	44 8b e8             	mov    %eax,%r13d
+   1805421e1:	48 8b 4c 24 20       	mov    0x20(%rsp),%rcx
+   1805421e6:	48 8b 49 50          	mov    0x50(%rcx),%rcx
+   1805421ea:	8b f8                	mov    %eax,%edi
+   1805421ec:	48 8b 01             	mov    (%rcx),%rax
+   1805421ef:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   1805421f5:	41 8b cd             	mov    %r13d,%ecx
+   1805421f8:	83 e1 01             	and    $0x1,%ecx
+   1805421fb:	49 03 c5             	add    %r13,%rax
+   1805421fe:	48 03 c8             	add    %rax,%rcx
+   180542201:	48 89 4c 24 28       	mov    %rcx,0x28(%rsp)
+   180542206:	81 fb 66 6d 74 20    	cmp    $0x20746d66,%ebx
+   18054220c:	0f 85 65 03 00 00    	jne    0x180542577
+   180542212:	48 8b 7c 24 20       	mov    0x20(%rsp),%rdi
+   180542217:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   18054221b:	48 8b 01             	mov    (%rcx),%rax
+   18054221e:	ff 50 30             	call   *0x30(%rax)
+   180542221:	0f b7 d8             	movzwl %ax,%ebx
+   180542224:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   180542228:	48 8b 01             	mov    (%rcx),%rax
+   18054222b:	ff 50 30             	call   *0x30(%rax)
+   18054222e:	0f bf c8             	movswl %ax,%ecx
+   180542231:	89 4f 20             	mov    %ecx,0x20(%rdi)
+   180542234:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   180542238:	48 8b 01             	mov    (%rcx),%rax
+   18054223b:	ff 50 40             	call   *0x40(%rax)
+   18054223e:	66 0f 6e c0          	movd   %eax,%xmm0
+   180542242:	f3 0f e6 c0          	cvtdq2pd %xmm0,%xmm0
+   180542246:	f2 0f 11 47 08       	movsd  %xmm0,0x8(%rdi)
+   18054224b:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   18054224f:	48 8b 01             	mov    (%rcx),%rax
+   180542252:	ff 50 40             	call   *0x40(%rax)
+   180542255:	8b f8                	mov    %eax,%edi
+   180542257:	48 8b 4c 24 20       	mov    0x20(%rsp),%rcx
+   18054225c:	48 8b 49 50          	mov    0x50(%rcx),%rcx
+   180542260:	48 8b 01             	mov    (%rcx),%rax
+   180542263:	ba 02 00 00 00       	mov    $0x2,%edx
+   180542268:	ff 90 b8 00 00 00    	call   *0xb8(%rax)
+   18054226e:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   180542273:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   180542277:	48 8b 01             	mov    (%rcx),%rax
+   18054227a:	ff 50 30             	call   *0x30(%rax)
+   18054227d:	0f bf c8             	movswl %ax,%ecx
+   180542280:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   180542285:	89 48 10             	mov    %ecx,0x10(%rax)
+   180542288:	83 f9 40             	cmp    $0x40,%ecx
+   18054228b:	76 26                	jbe    0x1805422b3
+   18054228d:	f2 0f 2c 48 08       	cvttsd2si 0x8(%rax),%ecx
+   180542292:	8b c7                	mov    %edi,%eax
+   180542294:	99                   	cltd
+   180542295:	f7 f9                	idiv   %ecx
+   180542297:	48 8b 7c 24 20       	mov    0x20(%rsp),%rdi
+   18054229c:	89 87 80 00 00 00    	mov    %eax,0x80(%rdi)
+   1805422a2:	8d 04 c5 00 00 00 00 	lea    0x0(,%rax,8),%eax
+   1805422a9:	33 d2                	xor    %edx,%edx
+   1805422ab:	f7 77 20             	divl   0x20(%rdi)
+   1805422ae:	89 47 10             	mov    %eax,0x10(%rdi)
+   1805422b1:	eb 14                	jmp    0x1805422c7
+   1805422b3:	48 8b 7c 24 20       	mov    0x20(%rsp),%rdi
+   1805422b8:	8b 47 20             	mov    0x20(%rdi),%eax
+   1805422bb:	0f af c1             	imul   %ecx,%eax
+   1805422be:	c1 e8 03             	shr    $0x3,%eax
+   1805422c1:	89 87 80 00 00 00    	mov    %eax,0x80(%rdi)
+   1805422c7:	66 83 fb 03          	cmp    $0x3,%bx
+   1805422cb:	75 0f                	jne    0x1805422dc
+   1805422cd:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   1805422d2:	41 c6 45 24 01       	movb   $0x1,0x24(%r13)
+   1805422d7:	e9 a3 11 00 00       	jmp    0x18054347f
+   1805422dc:	b8 fe ff 00 00       	mov    $0xfffe,%eax
+   1805422e1:	66 3b d8             	cmp    %ax,%bx
+   1805422e4:	0f 85 3f 02 00 00    	jne    0x180542529
+   1805422ea:	41 83 fd 28          	cmp    $0x28,%r13d
+   1805422ee:	73 15                	jae    0x180542305
+   1805422f0:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   1805422f5:	41 c7 85 80 00 00 00 	movl   $0x0,0x80(%r13)
+   1805422fc:	00 00 00 00 
+   180542300:	e9 7a 11 00 00       	jmp    0x18054347f
+   180542305:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   180542309:	48 8b 01             	mov    (%rcx),%rax
+   18054230c:	ba 04 00 00 00       	mov    $0x4,%edx
+   180542311:	ff 90 b8 00 00 00    	call   *0xb8(%rax)
+   180542317:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   18054231b:	48 8b 01             	mov    (%rcx),%rax
+   18054231e:	ff 50 40             	call   *0x40(%rax)
+   180542321:	8b d8                	mov    %eax,%ebx
+   180542323:	48 8d 15 46 ac f6 01 	lea    0x1f6ac46(%rip),%rdx        # 0x1824acf70
+   18054232a:	48 8d 4d 98          	lea    -0x68(%rbp),%rcx
+   18054232e:	e8 ad a1 f5 ff       	call   0x18049c4e0
+   180542333:	90                   	nop
+   180542334:	8b d3                	mov    %ebx,%edx
+   180542336:	48 8d 8d 00 02 00 00 	lea    0x200(%rbp),%rcx
+   18054233d:	e8 ce 1a cf 00       	call   0x181233e10
+   180542342:	4c 8d 85 ff 01 00 00 	lea    0x1ff(%rbp),%r8
+   180542349:	4c 2b c0             	sub    %rax,%r8
+   18054234c:	48 8b d0             	mov    %rax,%rdx
+   18054234f:	48 8d 4d 90          	lea    -0x70(%rbp),%rcx
+   180542353:	e8 f8 2d f5 ff       	call   0x180495150
+   180542358:	4c 8d 45 90          	lea    -0x70(%rbp),%r8
+   18054235c:	48 8d 55 98          	lea    -0x68(%rbp),%rdx
+   180542360:	48 8d 4f 28          	lea    0x28(%rdi),%rcx
+   180542364:	e8 17 a5 ce 00       	call   0x18122c880
+   180542369:	48 8b 4d 90          	mov    -0x70(%rbp),%rcx
+   18054236d:	48 83 c1 f0          	add    $0xfffffffffffffff0,%rcx
+   180542371:	8b 01                	mov    (%rcx),%eax
+   180542373:	a9 00 00 00 30       	test   $0x30000000,%eax
+   180542378:	75 16                	jne    0x180542390
+   18054237a:	b8 ff ff ff ff       	mov    $0xffffffff,%eax
+   18054237f:	f0 0f c1 01          	lock xadd %eax,(%rcx)
+   180542383:	ff c8                	dec    %eax
+   180542385:	83 f8 ff             	cmp    $0xffffffff,%eax
+   180542388:	75 06                	jne    0x180542390
+   18054238a:	e8 65 ed be 00       	call   0x1811310f4
+   18054238f:	90                   	nop
+   180542390:	48 8b 4d 98          	mov    -0x68(%rbp),%rcx
+   180542394:	48 83 c1 f0          	add    $0xfffffffffffffff0,%rcx
+   180542398:	8b 01                	mov    (%rcx),%eax
+   18054239a:	a9 00 00 00 30       	test   $0x30000000,%eax
+   18054239f:	75 15                	jne    0x1805423b6
+   1805423a1:	b8 ff ff ff ff       	mov    $0xffffffff,%eax
+   1805423a6:	f0 0f c1 01          	lock xadd %eax,(%rcx)
+   1805423aa:	ff c8                	dec    %eax
+   1805423ac:	83 f8 ff             	cmp    $0xffffffff,%eax
+   1805423af:	75 05                	jne    0x1805423b6
+   1805423b1:	e8 3e ed be 00       	call   0x1811310f4
+   1805423b6:	44 8b 47 20          	mov    0x20(%rdi),%r8d
+   1805423ba:	8b d3                	mov    %ebx,%edx
+   1805423bc:	48 8d 8d 98 01 00 00 	lea    0x198(%rbp),%rcx
+   1805423c3:	e8 68 17 00 00       	call   0x180543b30
+   1805423c8:	48 8b d0             	mov    %rax,%rdx
+   1805423cb:	48 8b 8f 88 00 00 00 	mov    0x88(%rdi),%rcx
+   1805423d2:	48 89 8d 70 01 00 00 	mov    %rcx,0x170(%rbp)
+   1805423d9:	48 8b 00             	mov    (%rax),%rax
+   1805423dc:	48 89 87 88 00 00 00 	mov    %rax,0x88(%rdi)
+   1805423e3:	48 89 0a             	mov    %rcx,(%rdx)
+   1805423e6:	0f 10 42 08          	movups 0x8(%rdx),%xmm0
+   1805423ea:	0f 11 87 90 00 00 00 	movups %xmm0,0x90(%rdi)
+   1805423f1:	48 8b 42 18          	mov    0x18(%rdx),%rax
+   1805423f5:	48 89 87 a0 00 00 00 	mov    %rax,0xa0(%rdi)
+   1805423fc:	8b 42 20             	mov    0x20(%rdx),%eax
+   1805423ff:	89 87 a8 00 00 00    	mov    %eax,0xa8(%rdi)
+   180542405:	0f b6 42 24          	movzbl 0x24(%rdx),%eax
+   180542409:	88 87 ac 00 00 00    	mov    %al,0xac(%rdi)
+   18054240f:	48 8b 8d 98 01 00 00 	mov    0x198(%rbp),%rcx
+   180542416:	ff 15 8c 8e 66 01    	call   *0x1668e8c(%rip)        # 0x181bab2a8
+   18054241c:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   180542420:	48 8b 01             	mov    (%rcx),%rax
+   180542423:	ff 50 40             	call   *0x40(%rax)
+   180542426:	89 85 88 01 00 00    	mov    %eax,0x188(%rbp)
+   18054242c:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   180542430:	48 8b 01             	mov    (%rcx),%rax
+   180542433:	ff 50 30             	call   *0x30(%rax)
+   180542436:	66 89 85 8c 01 00 00 	mov    %ax,0x18c(%rbp)
+   18054243d:	48 8b 4f 50          	mov    0x50(%rdi),%rcx
+   180542441:	48 8b 01             	mov    (%rcx),%rax
+   180542444:	ff 50 30             	call   *0x30(%rax)
+   180542447:	66 89 85 8e 01 00 00 	mov    %ax,0x18e(%rbp)
+   18054244e:	bb 08 00 00 00       	mov    $0x8,%ebx
+   180542453:	48 89 9d 28 01 00 00 	mov    %rbx,0x128(%rbp)
+   18054245a:	4c 8b 6f 50          	mov    0x50(%rdi),%r13
+   18054245e:	33 ff                	xor    %edi,%edi
+   180542460:	41 bc 00 00 00 70    	mov    $0x70000000,%r12d
+   180542466:	44 8b c3             	mov    %ebx,%r8d
+   180542469:	49 3b dc             	cmp    %r12,%rbx
+   18054246c:	45 0f 47 c4          	cmova  %r12d,%r8d
+   180542470:	48 8d 95 90 01 00 00 	lea    0x190(%rbp),%rdx
+   180542477:	48 03 d7             	add    %rdi,%rdx
+   18054247a:	49 8b 45 00          	mov    0x0(%r13),%rax
+   18054247e:	49 8b cd             	mov    %r13,%rcx
+   180542481:	ff 50 18             	call   *0x18(%rax)
+   180542484:	83 f8 01             	cmp    $0x1,%eax
+   180542487:	7c 0a                	jl     0x180542493
+   180542489:	48 98                	cltq
+   18054248b:	48 03 f8             	add    %rax,%rdi
+   18054248e:	48 2b d8             	sub    %rax,%rbx
+   180542491:	75 d3                	jne    0x180542466
+   180542493:	48 89 9d 28 01 00 00 	mov    %rbx,0x128(%rbp)
+   18054249a:	48 8b 8d 88 01 00 00 	mov    0x188(%rbp),%rcx
+   1805424a1:	48 8b c1             	mov    %rcx,%rax
+   1805424a4:	48 8b 95 90 01 00 00 	mov    0x190(%rbp),%rdx
+   1805424ab:	48 2b 05 d6 96 e1 01 	sub    0x1e196d6(%rip),%rax        # 0x18235bb88
+   1805424b2:	4c 8d 25 16 a8 f6 01 	lea    0x1f6a816(%rip),%r12        # 0x1824acccf
+   1805424b9:	75 0a                	jne    0x1805424c5
+   1805424bb:	48 8b c2             	mov    %rdx,%rax
+   1805424be:	48 2b 05 cb 96 e1 01 	sub    0x1e196cb(%rip),%rax        # 0x18235bb90
+   1805424c5:	48 85 c0             	test   %rax,%rax
+   1805424c8:	0f 94 c0             	sete   %al
+   1805424cb:	84 c0                	test   %al,%al
+   1805424cd:	74 0f                	je     0x1805424de
+   1805424cf:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   1805424d4:	41 c6 45 24 01       	movb   $0x1,0x24(%r13)
+   1805424d9:	e9 a1 0f 00 00       	jmp    0x18054347f
+   1805424de:	48 8b c1             	mov    %rcx,%rax
+   1805424e1:	48 2b 05 38 96 e1 01 	sub    0x1e19638(%rip),%rax        # 0x18235bb20
+   1805424e8:	75 0a                	jne    0x1805424f4
+   1805424ea:	48 8b c2             	mov    %rdx,%rax
+   1805424ed:	48 2b 05 34 96 e1 01 	sub    0x1e19634(%rip),%rax        # 0x18235bb28
+   1805424f4:	48 85 c0             	test   %rax,%rax
+   1805424f7:	0f 94 c0             	sete   %al
+   1805424fa:	84 c0                	test   %al,%al
+   1805424fc:	0f 94 c0             	sete   %al
+   1805424ff:	84 c0                	test   %al,%al
+   180542501:	0f 84 73 0f 00 00    	je     0x18054347a
+   180542507:	48 2b 0d 5a 96 e1 01 	sub    0x1e1965a(%rip),%rcx        # 0x18235bb68
+   18054250e:	75 0a                	jne    0x18054251a
+   180542510:	48 8b ca             	mov    %rdx,%rcx
+   180542513:	48 2b 0d 56 96 e1 01 	sub    0x1e19656(%rip),%rcx        # 0x18235bb70
+   18054251a:	48 85 c9             	test   %rcx,%rcx
+   18054251d:	0f 94 c0             	sete   %al
+   180542520:	84 c0                	test   %al,%al
+   180542522:	0f 94 c0             	sete   %al
+   180542525:	84 c0                	test   %al,%al
+   180542527:	eb 2e                	jmp    0x180542557
+   180542529:	0f b7 c3             	movzwl %bx,%eax
+   18054252c:	b9 4f 67 00 00       	mov    $0x674f,%ecx
+   180542531:	66 2b c1             	sub    %cx,%ax
+   180542534:	66 83 f8 02          	cmp    $0x2,%ax
+   180542538:	0f 86 6f 0f 00 00    	jbe    0x1805434ad
+   18054253e:	0f b7 c3             	movzwl %bx,%eax
+   180542541:	b9 6f 67 00 00       	mov    $0x676f,%ecx
+   180542546:	66 2b c1             	sub    %cx,%ax
+   180542549:	66 83 f8 02          	cmp    $0x2,%ax
+   18054254d:	0f 86 5a 0f 00 00    	jbe    0x1805434ad
+   180542553:	66 83 fb 01          	cmp    $0x1,%bx
+   180542557:	48 8b 54 24 28       	mov    0x28(%rsp),%rdx
+   18054255c:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   180542561:	0f 84 1d 0f 00 00    	je     0x180543484
+   180542567:	41 c7 85 80 00 00 00 	movl   $0x0,0x80(%r13)
+   18054256e:	00 00 00 00 
+   180542572:	e9 0d 0f 00 00       	jmp    0x180543484
+   180542577:	81 fb 64 61 74 61    	cmp    $0x61746164,%ebx
+   18054257d:	75 7a                	jne    0x1805425f9
+   18054257f:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   180542584:	41 80 bd 84 00 00 00 	cmpb   $0x0,0x84(%r13)
+   18054258b:	00 
+   18054258c:	74 2b                	je     0x1805425b9
+   18054258e:	49 83 7d 78 00       	cmpq   $0x0,0x78(%r13)
+   180542593:	7e 28                	jle    0x1805425bd
+   180542595:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542599:	49 8b 5d 78          	mov    0x78(%r13),%rbx
+   18054259d:	48 8b 01             	mov    (%rcx),%rax
+   1805425a0:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   1805425a6:	48 8b cb             	mov    %rbx,%rcx
+   1805425a9:	83 e1 01             	and    $0x1,%ecx
+   1805425ac:	48 03 c3             	add    %rbx,%rax
+   1805425af:	48 03 c8             	add    %rax,%rcx
+   1805425b2:	48 89 4c 24 28       	mov    %rcx,0x28(%rsp)
+   1805425b7:	eb 04                	jmp    0x1805425bd
+   1805425b9:	49 89 7d 78          	mov    %rdi,0x78(%r13)
+   1805425bd:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   1805425c1:	48 8b 01             	mov    (%rcx),%rax
+   1805425c4:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   1805425ca:	49 89 45 70          	mov    %rax,0x70(%r13)
+   1805425ce:	49 63 85 80 00 00 00 	movslq 0x80(%r13),%rax
+   1805425d5:	85 c0                	test   %eax,%eax
+   1805425d7:	7e 15                	jle    0x1805425ee
+   1805425d9:	48 8b c8             	mov    %rax,%rcx
+   1805425dc:	49 8b 45 78          	mov    0x78(%r13),%rax
+   1805425e0:	48 99                	cqto
+   1805425e2:	48 f7 f9             	idiv   %rcx
+   1805425e5:	49 89 45 18          	mov    %rax,0x18(%r13)
+   1805425e9:	e9 91 0e 00 00       	jmp    0x18054347f
+   1805425ee:	33 c0                	xor    %eax,%eax
+   1805425f0:	49 89 45 18          	mov    %rax,0x18(%r13)
+   1805425f4:	e9 86 0e 00 00       	jmp    0x18054347f
+   1805425f9:	81 fb 62 65 78 74    	cmp    $0x74786562,%ebx
+   1805425ff:	75 75                	jne    0x180542676
+   180542601:	48 8b 5c 24 20       	mov    0x20(%rsp),%rbx
+   180542606:	48 8b 4b 50          	mov    0x50(%rbx),%rcx
+   18054260a:	48 8b 01             	mov    (%rcx),%rax
+   18054260d:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   180542613:	48 89 43 60          	mov    %rax,0x60(%rbx)
+   180542617:	48 89 7b 68          	mov    %rdi,0x68(%rbx)
+   18054261b:	49 8d 5d 01          	lea    0x1(%r13),%rbx
+   18054261f:	33 c9                	xor    %ecx,%ecx
+   180542621:	ff 15 81 8c 66 01    	call   *0x1668c81(%rip)        # 0x181bab2a8
+   180542627:	bf 5b 02 00 00       	mov    $0x25b,%edi
+   18054262c:	48 3b df             	cmp    %rdi,%rbx
+   18054262f:	48 0f 42 df          	cmovb  %rdi,%rbx
+   180542633:	ba 01 00 00 00       	mov    $0x1,%edx
+   180542638:	48 8b cb             	mov    %rbx,%rcx
+   18054263b:	ff 15 5f 8c 66 01    	call   *0x1668c5f(%rip)        # 0x181bab2a0
+   180542641:	48 8b d8             	mov    %rax,%rbx
+   180542644:	48 89 85 78 01 00 00 	mov    %rax,0x178(%rbp)
+   18054264b:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   180542650:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   180542654:	48 8b 01             	mov    (%rcx),%rax
+   180542657:	45 8b c5             	mov    %r13d,%r8d
+   18054265a:	48 8b d3             	mov    %rbx,%rdx
+   18054265d:	ff 50 18             	call   *0x18(%rax)
+   180542660:	45 8b c5             	mov    %r13d,%r8d
+   180542663:	48 8b 54 24 60       	mov    0x60(%rsp),%rdx
+   180542668:	48 8b cb             	mov    %rbx,%rcx
+   18054266b:	e8 20 c7 ff ff       	call   0x18053ed90
+   180542670:	90                   	nop
+   180542671:	e9 fb 0d 00 00       	jmp    0x180543471
+   180542676:	81 fb 73 6d 70 6c    	cmp    $0x6c706d73,%ebx
+   18054267c:	75 5a                	jne    0x1805426d8
+   18054267e:	49 8d 5d 01          	lea    0x1(%r13),%rbx
+   180542682:	33 c9                	xor    %ecx,%ecx
+   180542684:	ff 15 1e 8c 66 01    	call   *0x1668c1e(%rip)        # 0x181bab2a8
+   18054268a:	48 83 fb 3c          	cmp    $0x3c,%rbx
+   18054268e:	b8 3c 00 00 00       	mov    $0x3c,%eax
+   180542693:	48 0f 42 d8          	cmovb  %rax,%rbx
+   180542697:	8d 50 c5             	lea    -0x3b(%rax),%edx
+   18054269a:	48 8b cb             	mov    %rbx,%rcx
+   18054269d:	ff 15 fd 8b 66 01    	call   *0x1668bfd(%rip)        # 0x181bab2a0
+   1805426a3:	48 8b d8             	mov    %rax,%rbx
+   1805426a6:	48 89 85 80 01 00 00 	mov    %rax,0x180(%rbp)
+   1805426ad:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   1805426b2:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   1805426b6:	48 8b 01             	mov    (%rcx),%rax
+   1805426b9:	45 8b c5             	mov    %r13d,%r8d
+   1805426bc:	48 8b d3             	mov    %rbx,%rdx
+   1805426bf:	ff 50 18             	call   *0x18(%rax)
+   1805426c2:	45 8b c5             	mov    %r13d,%r8d
+   1805426c5:	48 8b 54 24 60       	mov    0x60(%rsp),%rdx
+   1805426ca:	48 8b cb             	mov    %rbx,%rcx
+   1805426cd:	e8 5e d0 ff ff       	call   0x18053f730
+   1805426d2:	90                   	nop
+   1805426d3:	e9 99 0d 00 00       	jmp    0x180543471
+   1805426d8:	81 fb 69 6e 73 74    	cmp    $0x74736e69,%ebx
+   1805426de:	0f 84 b8 0c 00 00    	je     0x18054339c
+   1805426e4:	81 fb 49 4e 53 54    	cmp    $0x54534e49,%ebx
+   1805426ea:	0f 84 ac 0c 00 00    	je     0x18054339c
+   1805426f0:	81 fb 63 75 65 20    	cmp    $0x20657563,%ebx
+   1805426f6:	75 5a                	jne    0x180542752
+   1805426f8:	49 8d 5d 01          	lea    0x1(%r13),%rbx
+   1805426fc:	33 c9                	xor    %ecx,%ecx
+   1805426fe:	ff 15 a4 8b 66 01    	call   *0x1668ba4(%rip)        # 0x181bab2a8
+   180542704:	48 83 fb 1c          	cmp    $0x1c,%rbx
+   180542708:	b8 1c 00 00 00       	mov    $0x1c,%eax
+   18054270d:	48 0f 42 d8          	cmovb  %rax,%rbx
+   180542711:	8d 50 e5             	lea    -0x1b(%rax),%edx
+   180542714:	48 8b cb             	mov    %rbx,%rcx
+   180542717:	ff 15 83 8b 66 01    	call   *0x1668b83(%rip)        # 0x181bab2a0
+   18054271d:	48 8b d8             	mov    %rax,%rbx
+   180542720:	48 89 85 50 01 00 00 	mov    %rax,0x150(%rbp)
+   180542727:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   18054272c:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   180542730:	48 8b 01             	mov    (%rcx),%rax
+   180542733:	45 8b c5             	mov    %r13d,%r8d
+   180542736:	48 8b d3             	mov    %rbx,%rdx
+   180542739:	ff 50 18             	call   *0x18(%rax)
+   18054273c:	45 8b c5             	mov    %r13d,%r8d
+   18054273f:	48 8b 54 24 60       	mov    0x60(%rsp),%rdx
+   180542744:	48 8b cb             	mov    %rbx,%rcx
+   180542747:	e8 e4 e0 ff ff       	call   0x180540830
+   18054274c:	90                   	nop
+   18054274d:	e9 1f 0d 00 00       	jmp    0x180543471
+   180542752:	81 fb 61 78 6d 6c    	cmp    $0x6c6d7861,%ebx
+   180542758:	0f 85 a6 00 00 00    	jne    0x180542804
+   18054275e:	33 db                	xor    %ebx,%ebx
+   180542760:	48 89 5d 60          	mov    %rbx,0x60(%rbp)
+   180542764:	48 89 5d 68          	mov    %rbx,0x68(%rbp)
+   180542768:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   18054276d:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542771:	48 8b 01             	mov    (%rcx),%rax
+   180542774:	4c 8b c7             	mov    %rdi,%r8
+   180542777:	48 8d 55 60          	lea    0x60(%rbp),%rdx
+   18054277b:	ff 90 a0 00 00 00    	call   *0xa0(%rax)
+   180542781:	48 8b 55 60          	mov    0x60(%rbp),%rdx
+   180542785:	48 85 d2             	test   %rdx,%rdx
+   180542788:	74 28                	je     0x1805427b2
+   18054278a:	48 8b 45 68          	mov    0x68(%rbp),%rax
+   18054278e:	85 c0                	test   %eax,%eax
+   180542790:	79 0c                	jns    0x18054279e
+   180542792:	48 8d 4c 24 78       	lea    0x78(%rsp),%rcx
+   180542797:	e8 44 a2 f5 ff       	call   0x18049c9e0
+   18054279c:	eb 20                	jmp    0x1805427be
+   18054279e:	7e 12                	jle    0x1805427b2
+   1805427a0:	4c 63 c0             	movslq %eax,%r8
+   1805427a3:	4c 03 c2             	add    %rdx,%r8
+   1805427a6:	48 8d 4c 24 78       	lea    0x78(%rsp),%rcx
+   1805427ab:	e8 f0 80 d0 00       	call   0x18124a8a0
+   1805427b0:	eb 0c                	jmp    0x1805427be
+   1805427b2:	48 8d 05 df 97 c9 01 	lea    0x1c997df(%rip),%rax        # 0x1821dbf98
+   1805427b9:	48 89 44 24 78       	mov    %rax,0x78(%rsp)
+   1805427be:	48 8d 54 24 78       	lea    0x78(%rsp),%rdx
+   1805427c3:	49 8d 4d 28          	lea    0x28(%r13),%rcx
+   1805427c7:	e8 e4 b2 e2 00       	call   0x18136dab0
+   1805427cc:	90                   	nop
+   1805427cd:	48 8b 4c 24 78       	mov    0x78(%rsp),%rcx
+   1805427d2:	48 83 c1 f0          	add    $0xfffffffffffffff0,%rcx
+   1805427d6:	8b 01                	mov    (%rcx),%eax
+   1805427d8:	a9 00 00 00 30       	test   $0x30000000,%eax
+   1805427dd:	75 16                	jne    0x1805427f5
+   1805427df:	b8 ff ff ff ff       	mov    $0xffffffff,%eax
+   1805427e4:	f0 0f c1 01          	lock xadd %eax,(%rcx)
+   1805427e8:	ff c8                	dec    %eax
+   1805427ea:	83 f8 ff             	cmp    $0xffffffff,%eax
+   1805427ed:	75 06                	jne    0x1805427f5
+   1805427ef:	e8 00 e9 be 00       	call   0x1811310f4
+   1805427f4:	90                   	nop
+   1805427f5:	48 8b 4d 60          	mov    0x60(%rbp),%rcx
+   1805427f9:	ff 15 a9 8a 66 01    	call   *0x1668aa9(%rip)        # 0x181bab2a8
+   1805427ff:	e9 7b 0c 00 00       	jmp    0x18054347f
+   180542804:	81 fb 4c 49 53 54    	cmp    $0x5453494c,%ebx
+   18054280a:	0f 85 2a 0a 00 00    	jne    0x18054323a
+   180542810:	4c 8b 6c 24 20       	mov    0x20(%rsp),%r13
+   180542815:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542819:	48 8b 01             	mov    (%rcx),%rax
+   18054281c:	ff 50 40             	call   *0x40(%rax)
+   18054281f:	3d 69 6e 66 6f       	cmp    $0x6f666e69,%eax
+   180542824:	0f 84 f9 09 00 00    	je     0x180543223
+   18054282a:	3d 49 4e 46 4f       	cmp    $0x4f464e49,%eax
+   18054282f:	0f 84 ee 09 00 00    	je     0x180543223
+   180542835:	3d 61 64 74 6c       	cmp    $0x6c746461,%eax
+   18054283a:	0f 85 3f 0c 00 00    	jne    0x18054347f
+   180542840:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542844:	48 8b 01             	mov    (%rcx),%rax
+   180542847:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   18054284d:	48 8b 54 24 28       	mov    0x28(%rsp),%rdx
+   180542852:	48 3b c2             	cmp    %rdx,%rax
+   180542855:	0f 8d 29 0c 00 00    	jge    0x180543484
+   18054285b:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
+   180542860:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542864:	48 8b 01             	mov    (%rcx),%rax
+   180542867:	ff 50 40             	call   *0x40(%rax)
+   18054286a:	8b f8                	mov    %eax,%edi
+   18054286c:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542870:	48 8b 01             	mov    (%rcx),%rax
+   180542873:	ff 50 40             	call   *0x40(%rax)
+   180542876:	8b d8                	mov    %eax,%ebx
+   180542878:	89 44 24 68          	mov    %eax,0x68(%rsp)
+   18054287c:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542880:	48 8b 01             	mov    (%rcx),%rax
+   180542883:	ff 90 a8 00 00 00    	call   *0xa8(%rax)
+   180542889:	48 8b c8             	mov    %rax,%rcx
+   18054288c:	8b c3                	mov    %ebx,%eax
+   18054288e:	83 e0 01             	and    $0x1,%eax
+   180542891:	03 c3                	add    %ebx,%eax
+   180542893:	48 03 c8             	add    %rax,%rcx
+   180542896:	48 89 8d f8 00 00 00 	mov    %rcx,0xf8(%rbp)
+   18054289d:	81 ff 6c 61 62 6c    	cmp    $0x6c62616c,%edi
+   1805428a3:	0f 84 89 05 00 00    	je     0x180542e32
+   1805428a9:	81 ff 6e 6f 74 65    	cmp    $0x65746f6e,%edi
+   1805428af:	0f 84 7d 05 00 00    	je     0x180542e32
+   1805428b5:	81 ff 6c 74 78 74    	cmp    $0x7478746c,%edi
+   1805428bb:	0f 85 31 09 00 00    	jne    0x1805431f2
+   1805428c1:	8b 5c 24 58          	mov    0x58(%rsp),%ebx
+   1805428c5:	8b d3                	mov    %ebx,%edx
+   1805428c7:	48 8d 8d 30 01 00 00 	lea    0x130(%rbp),%rcx
+   1805428ce:	e8 8d 80 d0 00       	call   0x18124a960
+   1805428d3:	90                   	nop
+   1805428d4:	4c 8b c0             	mov    %rax,%r8
+   1805428d7:	48 8d 15 a2 a6 f6 01 	lea    0x1f6a6a2(%rip),%rdx        # 0x1824acf80
+   1805428de:	48 8d 4c 24 38       	lea    0x38(%rsp),%rcx
+   1805428e3:	e8 68 3c d0 00       	call   0x181246550
+   1805428e8:	90                   	nop
+   1805428e9:	ff c3                	inc    %ebx
+   1805428eb:	89 5c 24 58          	mov    %ebx,0x58(%rsp)
+   1805428ef:	48 8b 8d 30 01 00 00 	mov    0x130(%rbp),%rcx
+   1805428f6:	48 83 c1 f0          	add    $0xfffffffffffffff0,%rcx
+   1805428fa:	8b 01                	mov    (%rcx),%eax
+   1805428fc:	a9 00 00 00 30       	test   $0x30000000,%eax
+   180542901:	75 15                	jne    0x180542918
+   180542903:	b8 ff ff ff ff       	mov    $0xffffffff,%eax
+   180542908:	f0 0f c1 01          	lock xadd %eax,(%rcx)
+   18054290c:	ff c8                	dec    %eax
+   18054290e:	83 f8 ff             	cmp    $0xffffffff,%eax
+   180542911:	75 05                	jne    0x180542918
+   180542913:	e8 dc e7 be 00       	call   0x1811310f4
+   180542918:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   18054291c:	48 8b 01             	mov    (%rcx),%rax
+   18054291f:	ff 50 40             	call   *0x40(%rax)
+   180542922:	8b d8                	mov    %eax,%ebx
+   180542924:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542928:	48 8b 01             	mov    (%rcx),%rax
+   18054292b:	ff 50 40             	call   *0x40(%rax)
+   18054292e:	8b f8                	mov    %eax,%edi
+   180542930:	49 8b 4d 50          	mov    0x50(%r13),%rcx
+   180542934:	48 8b 01             	mov    (%rcx),%rax
+   180542937:	ff 50 40             	call   *0x40(%rax)
+   18054293a:	44 8b e8             	mov    %eax,%r13d
+   18054293d:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   180542942:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   180542946:	48 8b 01             	mov    (%rcx),%rax
+   180542949:	ff 50 30             	call   *0x30(%rax)
+   18054294c:	66 89 44 24 5c       	mov    %ax,0x5c(%rsp)
+   180542951:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   180542956:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   18054295a:	48 8b 01             	mov    (%rcx),%rax
+   18054295d:	ff 50 30             	call   *0x30(%rax)
+   180542960:	66 89 44 24 50       	mov    %ax,0x50(%rsp)
+   180542965:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   18054296a:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   18054296e:	48 8b 01             	mov    (%rcx),%rax
+   180542971:	ff 50 30             	call   *0x30(%rax)
+   180542974:	66 89 44 24 52       	mov    %ax,0x52(%rsp)
+   180542979:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   18054297e:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   180542982:	48 8b 01             	mov    (%rcx),%rax
+   180542985:	ff 50 30             	call   *0x30(%rax)
+   180542988:	66 89 44 24 54       	mov    %ax,0x54(%rsp)
+   18054298d:	8b 54 24 68          	mov    0x68(%rsp),%edx
+   180542991:	83 c2 ec             	add    $0xffffffec,%edx
+   180542994:	33 c0                	xor    %eax,%eax
+   180542996:	48 89 85 80 00 00 00 	mov    %rax,0x80(%rbp)
+   18054299d:	48 89 85 88 00 00 00 	mov    %rax,0x88(%rbp)
+   1805429a4:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
+   1805429a9:	48 8b 48 50          	mov    0x50(%rax),%rcx
+   1805429ad:	48 8b 01             	mov    (%rcx),%rax
+   1805429b0:	4c 63 c2             	movslq %edx,%r8
+   1805429b3:	48 8d 95 80 00 00 00 	lea    0x80(%rbp),%rdx
+   1805429ba:	ff 90 a0 00 00 00    	call   *0xa0(%rax)
+   1805429c0:	8b d3                	mov    %ebx,%edx
+   1805429c2:	48 8d 4d a8          	lea    -0x58(%rbp),%rcx
+   1805429c6:	e8 05 f6 cc 00       	call   0x181211fd0
+   1805429cb:	90                   	nop
+   1805429cc:	48 8b 5c 24 38       	mov    0x38(%rsp),%rbx
+   1805429d1:	48 89 5d a0          	mov    %rbx,-0x60(%rbp)
+   1805429d5:	8b 43 f0             	mov    -0x10(%rbx),%eax
+   1805429d8:	a9 00 00 00 30       	test   $0x30000000,%eax
+   1805429dd:	75 0a                	jne    0x1805429e9
+   1805429df:	b8 01 00 00 00       	mov    $0x1,%eax
+   1805429e4:	f0 0f c1 43 f0       	lock xadd %eax,-0x10(%rbx)
+   1805429e9:	4c 8d 05 68 a2 f6 01 	lea    0x1f6a268(%rip),%r8        # 0x1824acc58
+   1805429f0:	48 8d 55 a0          	lea    -0x60(%rbp),%rdx
+   1805429f4:	48 8d 8d a0 00 00 00 	lea    0xa0(%rbp),%rcx
+   1805429fb:	e8 e0 3b d0 00       	call   0x1812465e0
+   180542a00:	4c 8d 45 a8          	lea    -0x58(%rbp),%r8
+   180542a04:	48 8b d0             	mov    %rax,%rdx
+   180542a07:	48 8b 4c 24 60       	mov    0x60(%rsp),%rcx
+   180542a0c:	e8 6f 9e ce 00       	call   0x18122c880
+   180542a11:	48 8b 8d a0 00 00 00 	mov    0xa0(%rbp),%rcx
+   180542a18:	48 83 c1 f0          	add    $0xfffffffffffffff0,%rcx
+   180542a1c:	8b 01                	mov    (%rcx),%eax
+   180542a1e:	a9                   	.byte 0xa9
+	...

handoff/nls_dasm/vt_54b600.dis

@@ -0,0 +1,247 @@
+; vt_54b600
+
+/tmp/slice.bin:     file format binary
+
+
+Disassembly of section .data:
+
+000000018054b600 <.data>:
+   18054b600:	8b f8                	mov    %eax,%edi
+   18054b602:	00 00                	add    %al,(%rax)
+   18054b604:	00 48 85             	add    %cl,-0x7b(%rax)
+   18054b607:	c9                   	leave
+   18054b608:	74 07                	je     0x18054b611
+   18054b60a:	48 8b 01             	mov    (%rcx),%rax
+   18054b60d:	ff 50 10             	call   *0x10(%rax)
+   18054b610:	90                   	nop
+   18054b611:	48 8b cb             	mov    %rbx,%rcx
+   18054b614:	e8 07 f0 ff ff       	call   0x18054a620
+   18054b619:	90                   	nop
+   18054b61a:	40 f6 c7 01          	test   $0x1,%dil
+   18054b61e:	74 0e                	je     0x18054b62e
+   18054b620:	ba 30 01 00 00       	mov    $0x130,%edx
+   18054b625:	48 8b cb             	mov    %rbx,%rcx
+   18054b628:	e8 c7 5a be 00       	call   0x1811310f4
+   18054b62d:	90                   	nop
+   18054b62e:	48 8b c3             	mov    %rbx,%rax
+   18054b631:	48 8b 5c 24 40       	mov    0x40(%rsp),%rbx
+   18054b636:	48 83 c4 30          	add    $0x30,%rsp
+   18054b63a:	5f                   	pop    %rdi
+   18054b63b:	c3                   	ret
+   18054b63c:	cc                   	int3
+   18054b63d:	cc                   	int3
+   18054b63e:	cc                   	int3
+   18054b63f:	cc                   	int3
+   18054b640:	40 53                	rex push %rbx
+   18054b642:	48 83 ec 20          	sub    $0x20,%rsp
+   18054b646:	48 8b d9             	mov    %rcx,%rbx
+   18054b649:	84 d2                	test   %dl,%dl
+   18054b64b:	74 1e                	je     0x18054b66b
+   18054b64d:	b9 10 00 00 00       	mov    $0x10,%ecx
+   18054b652:	e8 89 60 be 00       	call   0x1811316e0
+   18054b657:	44 8b 43 2c          	mov    0x2c(%rbx),%r8d
+   18054b65b:	48 8d 0d 56 27 f6 01 	lea    0x1f62756(%rip),%rcx        # 0x1824addb8
+   18054b662:	48 89 08             	mov    %rcx,(%rax)
+   18054b665:	44 89 40 0c          	mov    %r8d,0xc(%rax)
+   18054b669:	eb 46                	jmp    0x18054b6b1
+   18054b66b:	8b 81 9c 00 00 00    	mov    0x9c(%rcx),%eax
+   18054b671:	b9 10 00 00 00       	mov    $0x10,%ecx
+   18054b676:	83 f8 04             	cmp    $0x4,%eax
+   18054b679:	75 0e                	jne    0x18054b689
+   18054b67b:	e8 60 60 be 00       	call   0x1811316e0
+   18054b680:	48 8d 15 39 24 f6 01 	lea    0x1f62439(%rip),%rdx        # 0x1824adac0
+   18054b687:	eb 1f                	jmp    0x18054b6a8
+   18054b689:	83 f8 03             	cmp    $0x3,%eax
+   18054b68c:	75 0e                	jne    0x18054b69c
+   18054b68e:	e8 4d 60 be 00       	call   0x1811316e0
+   18054b693:	48 8d 15 0e 1f f6 01 	lea    0x1f61f0e(%rip),%rdx        # 0x1824ad5a8
+   18054b69a:	eb 0c                	jmp    0x18054b6a8
+   18054b69c:	e8 3f 60 be 00       	call   0x1811316e0
+   18054b6a1:	48 8d 15 30 1f f6 01 	lea    0x1f61f30(%rip),%rdx        # 0x1824ad5d8
+   18054b6a8:	8b 4b 2c             	mov    0x2c(%rbx),%ecx
+   18054b6ab:	89 48 0c             	mov    %ecx,0xc(%rax)
+   18054b6ae:	48 89 10             	mov    %rdx,(%rax)
+   18054b6b1:	c7 40 08 01 00 00 00 	movl   $0x1,0x8(%rax)
+   18054b6b8:	48 8b 8b 00 01 00 00 	mov    0x100(%rbx),%rcx
+   18054b6bf:	48 89 83 00 01 00 00 	mov    %rax,0x100(%rbx)
+   18054b6c6:	48 89 44 24 40       	mov    %rax,0x40(%rsp)
+   18054b6cb:	48 85 c9             	test   %rcx,%rcx
+   18054b6ce:	74 10                	je     0x18054b6e0
+   18054b6d0:	48 8b 01             	mov    (%rcx),%rax
+   18054b6d3:	ba 01 00 00 00       	mov    $0x1,%edx
+   18054b6d8:	48 83 c4 20          	add    $0x20,%rsp
+   18054b6dc:	5b                   	pop    %rbx
+   18054b6dd:	48 ff 20             	rex.W jmp *(%rax)
+   18054b6e0:	48 83 c4 20          	add    $0x20,%rsp
+   18054b6e4:	5b                   	pop    %rbx
+   18054b6e5:	c3                   	ret
+   18054b6e6:	cc                   	int3
+   18054b6e7:	cc                   	int3
+   18054b6e8:	cc                   	int3
+   18054b6e9:	cc                   	int3
+   18054b6ea:	cc                   	int3
+   18054b6eb:	cc                   	int3
+   18054b6ec:	cc                   	int3
+   18054b6ed:	cc                   	int3
+   18054b6ee:	cc                   	int3
+   18054b6ef:	cc                   	int3
+   18054b6f0:	40 53                	rex push %rbx
+   18054b6f2:	48 83 ec 20          	sub    $0x20,%rsp
+   18054b6f6:	83 79 28 00          	cmpl   $0x0,0x28(%rcx)
+   18054b6fa:	48 8b d9             	mov    %rcx,%rbx
+   18054b6fd:	7f 08                	jg     0x18054b707
+   18054b6ff:	33 c0                	xor    %eax,%eax
+   18054b701:	48 83 c4 20          	add    $0x20,%rsp
+   18054b705:	5b                   	pop    %rbx
+   18054b706:	c3                   	ret
+   18054b707:	80 79 40 00          	cmpb   $0x0,0x40(%rcx)
+   18054b70b:	75 2b                	jne    0x18054b738
+   18054b70d:	48 8b 49 10          	mov    0x10(%rcx),%rcx
+   18054b711:	48 8d 54 24 30       	lea    0x30(%rsp),%rdx
+   18054b716:	c7 44 24 30 00 00 00 	movl   $0x0,0x30(%rsp)
+   18054b71d:	00 
+   18054b71e:	48 8b 01             	mov    (%rcx),%rax
+   18054b721:	ff 50 30             	call   *0x30(%rax)
+   18054b724:	85 c0                	test   %eax,%eax
+   18054b726:	78 10                	js     0x18054b738
+   18054b728:	8b 83 98 00 00 00    	mov    0x98(%rbx),%eax
+   18054b72e:	2b 44 24 30          	sub    0x30(%rsp),%eax
+   18054b732:	48 83 c4 20          	add    $0x20,%rsp
+   18054b736:	5b                   	pop    %rbx
+   18054b737:	c3                   	ret
+   18054b738:	8b 83 98 00 00 00    	mov    0x98(%rbx),%eax
+   18054b73e:	48 83 c4 20          	add    $0x20,%rsp
+   18054b742:	5b                   	pop    %rbx
+   18054b743:	c3                   	ret
+   18054b744:	cc                   	int3
+   18054b745:	cc                   	int3
+   18054b746:	cc                   	int3
+   18054b747:	cc                   	int3
+   18054b748:	cc                   	int3
+   18054b749:	cc                   	int3
+   18054b74a:	cc                   	int3
+   18054b74b:	cc                   	int3
+   18054b74c:	cc                   	int3
+   18054b74d:	cc                   	int3
+   18054b74e:	cc                   	int3
+   18054b74f:	cc                   	int3
+   18054b750:	48 8b c4             	mov    %rsp,%rax
+   18054b753:	48 89 50 10          	mov    %rdx,0x10(%rax)
+   18054b757:	55                   	push   %rbp
+   18054b758:	57                   	push   %rdi
+   18054b759:	48 83 ec 68          	sub    $0x68,%rsp
+   18054b75d:	83 79 28 00          	cmpl   $0x0,0x28(%rcx)
+   18054b761:	41 8b e9             	mov    %r9d,%ebp
+   18054b764:	48 8b f9             	mov    %rcx,%rdi
+   18054b767:	0f 8e b6 01 00 00    	jle    0x18054b923
+   18054b76d:	48 89 70 e8          	mov    %rsi,-0x18(%rax)
+   18054b771:	33 f6                	xor    %esi,%esi
+   18054b773:	4c 89 60 e0          	mov    %r12,-0x20(%rax)
+   18054b777:	44 8b e6             	mov    %esi,%r12d
+   18054b77a:	4c 89 68 d8          	mov    %r13,-0x28(%rax)
+   18054b77e:	4d 63 e8             	movslq %r8d,%r13
+   18054b781:	45 85 c9             	test   %r9d,%r9d
+   18054b784:	0f 8e 8a 01 00 00    	jle    0x18054b914
+   18054b78a:	48 89 58 18          	mov    %rbx,0x18(%rax)
+   18054b78e:	4c 89 70 d0          	mov    %r14,-0x30(%rax)
+   18054b792:	4c 89 78 c8          	mov    %r15,-0x38(%rax)
+   18054b796:	4c 8b bc 24 a0 00 00 	mov    0xa0(%rsp),%r15
+   18054b79d:	00 
+   18054b79e:	66 90                	xchg   %ax,%ax
+   18054b7a0:	80 7f 40 00          	cmpb   $0x0,0x40(%rdi)
+   18054b7a4:	75 1d                	jne    0x18054b7c3
+   18054b7a6:	4d 85 ff             	test   %r15,%r15
+   18054b7a9:	74 18                	je     0x18054b7c3
+   18054b7ab:	49 8b 4f 58          	mov    0x58(%r15),%rcx
+   18054b7af:	33 d2                	xor    %edx,%edx
+   18054b7b1:	ff 15 69 ed 65 01    	call   *0x165ed69(%rip)        # 0x181baa520
+   18054b7b7:	85 c0                	test   %eax,%eax
+   18054b7b9:	75 08                	jne    0x18054b7c3
+   18054b7bb:	49 8b cf             	mov    %r15,%rcx
+   18054b7be:	e8 7d fc ff ff       	call   0x18054b440
+   18054b7c3:	83 7f 28 00          	cmpl   $0x0,0x28(%rdi)
+   18054b7c7:	7f 04                	jg     0x18054b7cd
+   18054b7c9:	8b de                	mov    %esi,%ebx
+   18054b7cb:	eb 38                	jmp    0x18054b805
+   18054b7cd:	80 7f 40 00          	cmpb   $0x0,0x40(%rdi)
+   18054b7d1:	75 2c                	jne    0x18054b7ff
+   18054b7d3:	48 8b 4f 10          	mov    0x10(%rdi),%rcx
+   18054b7d7:	48 8d 94 24 80 00 00 	lea    0x80(%rsp),%rdx
+   18054b7de:	00 
+   18054b7df:	89 b4 24 80 00 00 00 	mov    %esi,0x80(%rsp)
+   18054b7e6:	48 8b 01             	mov    (%rcx),%rax
+   18054b7e9:	ff 50 30             	call   *0x30(%rax)
+   18054b7ec:	85 c0                	test   %eax,%eax
+   18054b7ee:	78 0f                	js     0x18054b7ff
+   18054b7f0:	8b 9f 98 00 00 00    	mov    0x98(%rdi),%ebx
+   18054b7f6:	2b 9c 24 80 00 00 00 	sub    0x80(%rsp),%ebx
+   18054b7fd:	eb 06                	jmp    0x18054b805
+   18054b7ff:	8b 9f 98 00 00 00    	mov    0x98(%rdi),%ebx
+   18054b805:	3b eb                	cmp    %ebx,%ebp
+   18054b807:	0f 4c dd             	cmovl  %ebp,%ebx
+   18054b80a:	85 db                	test   %ebx,%ebx
+   18054b80c:	75 32                	jne    0x18054b840
+   18054b80e:	48 8b 84 24 a8 00 00 	mov    0xa8(%rsp),%rax
+   18054b815:	00 
+   18054b816:	8b 80 b8 01 00 00    	mov    0x1b8(%rax),%eax
+   18054b81c:	85 c0                	test   %eax,%eax
+   18054b81e:	0f 85 de 00 00 00    	jne    0x18054b902
+   18054b824:	48 8b 4f 58          	mov    0x58(%rdi),%rcx
+   18054b828:	ba e8 03 00 00       	mov    $0x3e8,%edx
+   18054b82d:	ff 15 ed ec 65 01    	call   *0x165eced(%rip)        # 0x181baa520
+   18054b833:	85 c0                	test   %eax,%eax
+   18054b835:	0f 85 c7 00 00 00    	jne    0x18054b902
+   18054b83b:	e9 ba 00 00 00       	jmp    0x18054b8fa
+   18054b840:	80 7f 40 00          	cmpb   $0x0,0x40(%rdi)
+   18054b844:	74 1a                	je     0x18054b860
+   18054b846:	48 8b 4f 58          	mov    0x58(%rdi),%rcx
+   18054b84a:	ba e8 03 00 00       	mov    $0x3e8,%edx
+   18054b84f:	ff 15 cb ec 65 01    	call   *0x165eccb(%rip)        # 0x181baa520
+   18054b855:	3d 02 01 00 00       	cmp    $0x102,%eax
+   18054b85a:	0f 84 a2 00 00 00    	je     0x18054b902
+   18054b860:	48 8b 8f f8 00 00 00 	mov    0xf8(%rdi),%rcx
+   18054b867:	4c 8d 44 24 30       	lea    0x30(%rsp),%r8
+   18054b86c:	48 89 74 24 30       	mov    %rsi,0x30(%rsp)
+   18054b871:	8b d3                	mov    %ebx,%edx
+   18054b873:	48 8b 01             	mov    (%rcx),%rax
+   18054b876:	ff 50 18             	call   *0x18(%rax)
+   18054b879:	85 c0                	test   %eax,%eax
+   18054b87b:	78 78                	js     0x18054b8f5
+   18054b87d:	4d 85 ed             	test   %r13,%r13
+   18054b880:	7e 5f                	jle    0x18054b8e1
+   18054b882:	4c 8b bc 24 88 00 00 	mov    0x88(%rsp),%r15
+   18054b889:	00 
+   18054b88a:	49 63 c4             	movslq %r12d,%rax
+   18054b88d:	4c 8d 34 85 00 00 00 	lea    0x0(,%rax,4),%r14
+   18054b894:	00 
+   18054b895:	66 66 66 0f 1f 84 00 	data16 data16 nopw 0x0(%rax,%rax,1)
+   18054b89c:	00 00 00 00 
+   18054b8a0:	48 8b 8f 00 01 00 00 	mov    0x100(%rdi),%rcx
+   18054b8a7:	48 8b 87 88 00 00 00 	mov    0x88(%rdi),%rax
+   18054b8ae:	4d 8b 0c f7          	mov    (%r15,%rsi,8),%r9
+   18054b8b2:	48 8b 54 24 30       	mov    0x30(%rsp),%rdx
+   18054b8b7:	4d 03 ce             	add    %r14,%r9
+   18054b8ba:	4c 8b 11             	mov    (%rcx),%r10
+   18054b8bd:	44 8b 04 b0          	mov    (%rax,%rsi,4),%r8d
+   18054b8c1:	89 5c 24 28          	mov    %ebx,0x28(%rsp)
+   18054b8c5:	c7 44 24 20 00 00 00 	movl   $0x0,0x20(%rsp)
+   18054b8cc:	00 
+   18054b8cd:	41 ff 52 08          	call   *0x8(%r10)
+   18054b8d1:	48 ff c6             	inc    %rsi
+   18054b8d4:	49 3b f5             	cmp    %r13,%rsi
+   18054b8d7:	7c c7                	jl     0x18054b8a0
+   18054b8d9:	4c 8b bc 24 a0 00 00 	mov    0xa0(%rsp),%r15
+   18054b8e0:	00 
+   18054b8e1:	48 8b 8f f8 00 00 00 	mov    0xf8(%rdi),%rcx
+   18054b8e8:	45 33 c0             	xor    %r8d,%r8d
+   18054b8eb:	8b d3                	mov    %ebx,%edx
+   18054b8ed:	48 8b 01             	mov    (%rcx),%rax
+   18054b8f0:	ff 50 20             	call   *0x20(%rax)
+   18054b8f3:	33 f6                	xor    %esi,%esi
+   18054b8f5:	2b eb                	sub    %ebx,%ebp
+   18054b8f7:	44 03 e3             	add    %ebx,%r12d
+   18054b8fa:	85 ed                	test   %ebp,%ebp
+   18054b8fc:	0f                   	.byte 0xf
+   18054b8fd:	8f                   	(bad)
+   18054b8fe:	9e                   	sahf
+   18054b8ff:	fe                   	.byte 0xfe

scripts/amseries.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""amseries.py — amplitude sweep via rendersnap: scratch vs input level.
+Gives ka = d(scr)/d(ln am) of the log-domain law."""
+import glob
+import subprocess
+import sys
+
+import numpy as np
+
+CASES = [('t_-24', -24.0), ('t_-12', -12.0), ('t_0', 0.0), ('t_24', 24.0)]
+
+
+def steady(tag):
+    fs = sorted(glob.glob('/tmp/opencode/rendersnap/phase*.npz'))
+    for f in fs[::-1]:
+        z = np.load(f)
+        sc = z['0x540628']
+        if sc[85] < -1e-4:
+            return float(sc[85]), float(sc[85])
+    return None
+
+
+def main():
+    out = []
+    for tag, db in CASES:
+        rpp = f'/tmp/opencode/{tag}.rpp'
+        subprocess.run(['timeout', '100', 'python3',
+                        '/home/m/re-tools/scripts/rendersnap.py', rpp],
+                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        st = steady(tag)
+        if st:
+            out.append((db, st))
+            print(tag, db, 'scr43=%.4f scr171=%.4f' % st, flush=True)
+        else:
+            print(tag, 'NO STEADY', flush=True)
+    if len(out) >= 2:
+        (d1, s1), (d2, s2) = out[0], out[-1]
+        ka = (s2[0] - s1[0]) / ((d2 - d1) * np.log(10) / 20)
+        ka171 = (s2[1] - s1[1]) / ((d2 - d1) * np.log(10) / 20)
+        print('ka(d scr/d ln am) @85: %.4f' % ka)
+    pass
+
+
+if __name__ == '__main__':
+    main()

scripts/firstop.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+"""firstop.py — catch the plugin INSIDE its audio callback by repeatedly
+SIGSTOP-ing the yabridge host and reading only the ctx-referenced arrays.
+
+Between callbacks the FIR work buffer (ctx+0x540668) is reset to the complex
+identity (1,0)x2049. A snapshot where FIR != identity means we stopped after
+the mask->FIR build stage; those snapshots are saved with the full pipeline
+state (bands/scratch/f6f8/track/R curves).
+
+Usage: python3 scripts/firstop.py [rpp] [nattempts]
+"""
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+import numpy as np
+
+SNAPDIR = '/tmp/opencode/firstop'
+SLOTS = [0x540548, 0x540550, 0x540598, 0x540628, 0x540668, 0x540678, 0x540688,
+         0x540698, 0x5406a8, 0x5406b8, 0x5406c8, 0x5406d8, 0x5406e8, 0x5406f8,
+         0x540708, 0x540718, 0x540728, 0x540738, 0x540748, 0x540758,
+         0x540768, 0x540778, 0x540788, 0x540798, 0x5407a8, 0x5407b8,
+         0x5407c8, 0x5407d8, 0x5407e8, 0x5407f8, 0x540808, 0x540818,
+         0x540828, 0x540838, 0x540848]
+NARR = 8194
+
+
+def find_host():
+    import glob
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    rpp = sys.argv[1] if len(sys.argv) > 1 else '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    nattempts = int(sys.argv[2]) if len(sys.argv) > 2 else 120
+    os.makedirs(SNAPDIR, exist_ok=True)
+    subprocess.run('pkill -9 -x reaser 2>/dev/null; pkill -9 -x reaper 2>/dev/null; '
+                   "pkill -9 -f '[y]abridge' 2>/dev/null; sleep 1", shell=True)
+    proc = subprocess.Popen(
+        ['/usr/bin/reaper', '-nosplash', '-ignoreerrors', rpp,
+         '/home/m/re-tools/play_loop.lua'],
+        stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    t0 = time.time()
+    host = None
+    while time.time() - t0 < 60 and not host:
+        host = find_host()
+        time.sleep(0.2)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host', host, flush=True)
+    time.sleep(12)
+
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    def rd(addr, n):
+        try:
+            return os.pread(fd, n, addr)
+        except OSError:
+            return None
+
+    def get_ctx():
+        # cheap probe: sens scalar must be >100 at known offset
+        for base in (CTX.get('base'),):
+            pass
+        return CTX.get('base')
+
+    # locate ctx once (while running): marker scan over heap only is heavy;
+    # reuse known-good address from prior sessions, validate via sens scalar.
+    CTX = {}
+    ctx = None
+    b = rd(0x2370040 + 0x540870, 4)
+    if b and struct.unpack('<f', b)[0] > 100:
+        ctx = 0x2370040
+    else:
+        print('known ctx invalid; full scan needed')
+        return 1
+    print('ctx', hex(ctx), flush=True)
+
+    hits = 0
+    saved = []
+    rng = np.random.default_rng(7)
+    for k in range(nattempts):
+        os.kill(host, signal.SIGSTOP)
+        try:
+            fir_p = struct.unpack('<Q', rd(ctx + 0x540668, 8))[0]
+            fb = rd(fir_p, 64 * 4)
+            ident = False
+            if fb:
+                arr = np.frombuffer(fb[:256], dtype='<f4')
+                ident = bool(np.all(np.abs(arr[0::2] - 1.0) < 1e-6))
+                ident = ident and bool(np.all(arr[1::2] == 0))
+            if not ident:
+                hits += 1
+                store = {}
+                for off in SLOTS:
+                    pb = rd(ctx + off, 8)
+                    if not pb:
+                        continue
+                    p = struct.unpack('<Q', pb)[0]
+                    if p < 0x10000:
+                        continue
+                    ab = rd(p, NARR * 4)
+                    if not ab:
+                        continue
+                    store[hex(off)] = np.frombuffer(ab, dtype='<f4').astype(np.float32)
+                fn = f'{SNAPDIR}/hit{k:03d}.npz'
+                np.savez_compressed(fn, **store)
+                saved.append(fn)
+                sc = rd(ctx + 0x2404dc, 4)
+                print(f'[{k}] HIT fir!=identity -> {fn} '
+                      f'(fir[0..5]={np.round(store["0x540668"][:6],4)})', flush=True)
+        finally:
+            os.kill(host, signal.SIGCONT)
+        time.sleep(float(rng.uniform(0.02, 0.09)))
+    os.close(fd)
+    if proc.poll() is None:
+        proc.kill()
+    print(f'done: {hits} hits / {nattempts} attempts -> {SNAPDIR}')
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/firtrace.py

@@ -0,0 +1,206 @@
+#!/usr/bin/env python3
+"""firtrace.py — live capture of mask->FIR pipeline buffers during realtime
+playback, with GUI-publish flag forced ON so bands[i] curves are copied into
+the 0x540728+ slots inside the audio callback (decomp 529fe0:144-183).
+
+Dumps full vector-object arrays for every ctx slot in [0x540500,0x540900):
+reads {data_ptr, end_ptr, cap_ptr} (std::vector layout) when available,
+falls back to fixed-length float view.
+
+Usage: python3 scripts/firtrace.py [rpp] [nsnap]
+"""
+import json
+import os
+import struct
+import subprocess
+import sys
+import time
+
+import numpy as np
+
+SNAPDIR = '/tmp/opencode/firtrace'
+
+
+def find_host():
+    import glob
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def mem_read(fd, addr, n):
+    try:
+        return os.pread(fd, n, addr)
+    except OSError:
+        return None
+
+
+def mem_write(fd, addr, data):
+    try:
+        os.pwrite(fd, data, addr)
+        return True
+    except OSError:
+        return False
+
+
+def parse_snap(path):
+    data = open(path, 'rb').read()
+    regs = []
+    i = 0
+    while i + 16 <= len(data):
+        lo, sz = struct.unpack_from('<QQ', data, i)
+        regs.append((lo, data[i + 16:i + 16 + sz]))
+        i += 16 + sz
+    return regs
+
+
+def readabs(regs, addr, n):
+    for lo, body in regs:
+        if lo <= addr < lo + len(body) and addr - lo + n <= len(body):
+            return body[addr - lo:addr - lo + n]
+    return None
+
+
+def find_ctx(regs):
+    sig = struct.pack('<I', 0x473b8000)
+    cands = []
+    for lo, body in regs:
+        j = body.find(sig)
+        while j >= 0:
+            base = lo + j - 0x24
+            b = readabs(regs, base + 0x540870, 4)
+            if b and struct.unpack('<f', b)[0] > 100:
+                cands.append(base)
+            j = body.find(sig, j + 1)
+    return sorted(set(cands))
+
+
+SLOTS = list(range(0x540600, 0x540900, 8))
+EXTRA = [0x540548, 0x540550, 0x540558, 0x540560, 0x540568, 0x540570,
+         0x540578, 0x540580, 0x540588, 0x540590, 0x540598, 0x5405a0,
+         0x5405a8, 0x5405b0, 0x5405b8, 0x5405c0, 0x5405c8, 0x5405d0,
+         0x5405d8, 0x5405e0, 0x5405e8, 0x5405f0, 0x5405f8]
+
+
+def dump_slot(regs, ctx, off, maxf=65536):
+    """Read qword at ctx+off; if it looks like a heap array, dump floats."""
+    b = readabs(regs, ctx + off, 8)
+    if not b:
+        return None
+    ptr = struct.unpack('<Q', b)[0]
+    if ptr < 0x10000 or ptr > 0x7fffffffffff:
+        return None
+    body = readabs(regs, ptr, min(maxf, 262144) * 4)
+    if body is None or len(body) < 64:
+        return None
+    a = np.frombuffer(body, dtype='<f4').astype(np.float64)
+    # trim trailing zeros beyond a floor of 2049 samples
+    nz = np.nonzero(a != 0)[0]
+    keep = max(2049, (nz[-1] + 1) if len(nz) else 0)
+    return a[:min(len(a), ((keep + 63) // 64) * 64)]
+
+
+def main():
+    rpp = sys.argv[1] if len(sys.argv) > 1 else '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    nsnap = int(sys.argv[2]) if len(sys.argv) > 2 else 4
+    os.makedirs(SNAPDIR, exist_ok=True)
+    subprocess.run('pkill -9 -x reaser 2>/dev/null; pkill -9 -x reaper 2>/dev/null; '
+                   "pkill -9 -f '[y]abridge' 2>/dev/null; sleep 1", shell=True)
+    proc = subprocess.Popen(
+        ['/usr/bin/reaper', '-nosplash', '-ignoreerrors', rpp,
+         '/home/m/re-tools/play_loop.lua'],
+        stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    t0 = time.time()
+    host = None
+    while time.time() - t0 < 60 and not host:
+        host = find_host()
+        time.sleep(0.2)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host', host, flush=True)
+    time.sleep(12)
+
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+    # locate ctx via one full snapshot
+    snap0 = f'{SNAPDIR}/probe.bin'
+    snapshot(fd, host, snap0)
+    regs = parse_snap(snap0)
+    cands = find_ctx(regs)
+    print('ctx candidates:', ['0x%x' % c for c in cands][:5], flush=True)
+    if not cands:
+        return 1
+    ctx = cands[0]
+
+    # force GUI publish flag (byte at ctx+0x2404bc)
+    ok = mem_write(fd, ctx + 0x2404bc, b'\x01')
+    print('GUI flag write:', ok, flush=True)
+
+    store = {}
+    meta = {}
+    for k in range(nsnap):
+        time.sleep(1.5)
+        # re-arm flag (callback consumes it)
+        mem_write(fd, ctx + 0x2404bc, b'\x01')
+        time.sleep(0.05)
+        p = f'{SNAPDIR}/s{k}.bin'
+        snapshot(fd, host, p)
+        rg = parse_snap(p)
+        cs = find_ctx(rg)
+        if not cs:
+            continue
+        c = cs[0]
+        tag = f's{k}'
+        scal = {}
+        for a in range(0x540860, 0x5408a8, 4):
+            bb = readabs(rg, c + a, 4)
+            scal[hex(a)] = struct.unpack('<f', bb)[0] if bb else None
+        store[f'{tag}_scalars'] = json.dumps(scal)
+        for off in SLOTS + EXTRA:
+            arr = dump_slot(rg, c, off)
+            if arr is not None:
+                store[f'{tag}_{hex(off)}'] = arr
+                meta.setdefault(hex(off), []).append(len(arr))
+        print(f'snap {k}: dumped {sum(1 for x in store if x.startswith(tag+"_") and x!=tag+"_scalars")} arrays',
+              flush=True)
+    os.close(fd)
+    if proc.poll() is None:
+        proc.kill()
+
+    json.dump(meta, open(f'{SNAPDIR}/meta.json', 'w'), indent=1)
+    np.savez_compressed(f'{SNAPDIR}/firtrace.npz', **store)
+    print('saved', f'{SNAPDIR}/firtrace.npz')
+    return 0
+
+
+def snapshot(fd, host, path):
+    out = open(path, 'wb')
+    nreg = nbytes = 0
+    for line in open(f'/proc/{host}/maps').read().splitlines():
+        p = line.split()
+        if len(p) < 2 or 'r' not in p[1]:
+            continue
+        lo, hi = (int(x, 16) for x in p[0].split('-'))
+        a = lo
+        while a < hi:
+            n = min(hi - a, 8 * 1024 * 1024)
+            d = mem_read(fd, a, n)
+            if d:
+                out.write(struct.pack('<QQ', a, len(d)))
+                out.write(d)
+                nreg += 1
+                nbytes += len(d)
+            a += n
+    out.close()
+    return nreg, nbytes
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fnall.py

@@ -0,0 +1,233 @@
+#!/usr/bin/env python3
+"""fnall.py — safe full-thread INT3 tracer.
+
+Invariant: every thread is SEIZE+INTERRUPT-stopped BEFORE the breakpoint is
+armed, so any later clone descends from a traced thread and its SIGTRAPs come
+to us instead of killing the host.
+
+Env: FN_ADDR, FN_DUR, FN_MAXHITS
+"""
+import ctypes
+import glob
+import json
+import os
+import signal
+import struct
+import numpy as np
+import subprocess
+import sys
+import time
+
+FN = int(os.environ.get('FN_ADDR', '0x180529FE0'), 16)
+DUR = float(os.environ.get('FN_DUR', '15'))
+MAXHITS = int(os.environ.get('FN_MAXHITS', '50'))
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKDATA = 2
+PTRACE_POKETEXT = 4
+PTRACE_SINGLESTEP = 9
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_O_TRACECLONE = 0x00000002
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    if r == -1:
+        return None, ctypes.get_errno()
+    return r, 0
+
+
+def find_host():
+    # proven maps-based finder (same as rendersnap.py)
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+def drain_waits():
+    out = []
+    while True:
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == 0:
+            break
+        out.append((pid, status))
+    return out
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        if host is None and time.time() - t0 > 2:
+            # fallback: maps-based
+            for p in glob.glob('/proc/[0-9]*'):
+                pid = int(os.path.basename(p))
+                try:
+                    cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+                    maps = open(f'/proc/{pid}/maps').read()
+                except Exception:
+                    continue
+                if 'soothe2' in maps and 'reaper' not in cmd:
+                    host = pid
+                    break
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.3fs' % (host, time.time() - t0), flush=True)
+
+    # phase 1: seize main, interrupt, wait stop
+    seized = []
+    r, e = pt(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+    if r is None:
+        print('seize fail', e)
+        return 1
+    seized.append(host)
+    pt(PTRACE_INTERRUPT, host)
+
+    # phase 2: pump events, seize newcomers until set stabilizes
+    stable_until = time.time() + float(os.environ.get('FN_STAB','0.05'))
+    deadline = time.time() + 3.0
+    while time.time() < deadline:
+        for pid, st in drain_waits():
+            pass  # they stay stopped; we hold them
+        grew = False
+        for tid_s in glob.glob(f'/proc/{host}/task/*'):
+            tid = int(os.path.basename(tid_s))
+            if tid not in seized:
+                r, e = pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+                if r is not None or e != 3:
+                    seized.append(tid)
+                    pt(PTRACE_INTERRUPT, tid)
+                    grew = True
+        if grew:
+            stable_until = time.time() + 0.5
+        elif time.time() > stable_until:
+            break
+        time.sleep(0.002)
+    print('stopped %d threads' % len(seized), flush=True)
+
+    orig, _ = pt(PTRACE_PEEKDATA, host, FN)
+    cc = (orig & ~0xFF) | 0xCC
+    r, e = pt(PTRACE_POKETEXT, host, FN, cc)
+    if r is None:
+        print('arm fail', e)
+        return 1
+    print('armed %#x' % FN, flush=True)
+
+    log = []
+    hits = 0
+    EVENTS = []
+    for tid in seized:
+        pt(PTRACE_CONT, tid, 0, 0)
+
+    t_end = time.time() + DUR
+    last_resweep = time.time()
+    while hits < MAXHITS and time.time() < t_end:
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        EVENTS.append((time.time()-t0, pid, hex(status), status >> 16))
+        if pid == 0:
+            if time.time() - last_resweep > 0.05:
+                last_resweep = time.time()
+                for tid_s in glob.glob(f'/proc/{host}/task/*'):
+                    tid = int(os.path.basename(tid_s))
+                    if tid not in seized:
+                        r, e = pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+                        if r is not None or e != 3:
+                            seized.append(tid)
+                            pt(PTRACE_INTERRUPT, tid)
+                            drain_waits()
+                            pt(PTRACE_CONT, tid, 0, 0)
+            time.sleep(0.0005)
+            continue
+        sig = status >> 8
+        ev = status >> 16
+        if os.WIFEXITED(status) or os.WIFSIGNALED(status):
+            EVENTS.append((time.time()-t0, pid, hex(status), ev))
+            continue
+        if ev == 3 or ev == 1:
+            pt(PTRACE_CONT, pid, 0, 0)
+            continue
+        if os.WIFSTOPPED(pid) and sig == signal.SIGTRAP and ev == 0:
+            regs = UserRegs()
+            r, _ = pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs))
+            if r is None:
+                continue
+            if regs.rip - 1 == FN:
+                ret, _ = pt(PTRACE_PEEKDATA, pid, regs.rsp)
+                rec = dict(ctx=regs.rcx, a2=regs.rdx, cnt=regs.r8 & 0xffffffff,
+                           r9=regs.r9 & 0xffffffff, ret=ret,
+                           rbx=regs.rbx, r12=regs.r12, r13=regs.r13,
+                           r14=regs.r14, r15=regs.r15, rsp=regs.rsp, tid=pid,
+                           dump_in=[], dump_out=[], dump_r14=[], dump_rbx=[])
+                # dump arrays referenced by registers (process is stopped)
+                fdm = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+                def rdarr(ptr, n=2049):
+                    try:
+                        b = os.pread(fdm, n * 4, ptr)
+                        return np.frombuffer(b, dtype='<f4').astype(np.float32).tolist()
+                    except OSError:
+                        return []
+                rec['dump_in'] = rdarr(regs.rcx)
+                rec['dump_out'] = rdarr(regs.rdx)
+                if FN != 0x18052dbc0:
+                    rec['dump_r14'] = rdarr(regs.r14)
+                os.close(fdm)
+                log.append(rec)
+                hits += 1
+                if hits <= 20:
+                    print('HIT ctx=%#x a2=%#x cnt=%#x ret=%#x'
+                          % (rec['ctx'], rec['a2'], rec['cnt'], rec['ret']), flush=True)
+                pt(PTRACE_POKETEXT, pid, FN, orig)
+                regs.rip = FN
+                pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+                pt(PTRACE_SINGLESTEP, pid, 0, 0)
+                os.waitpid(pid, os.WUNTRACED)
+                pt(PTRACE_POKETEXT, pid, FN, cc)
+                pt(PTRACE_CONT, pid, 0, 0)
+            else:
+                pt(PTRACE_CONT, pid, 0, 0)
+        elif os.WIFSTOPPED(pid):
+            pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
+
+    pt(PTRACE_POKETEXT, host, FN, orig)
+    print('total hits:', hits)
+    json.dump(dict(log=log, events=EVENTS[:8000], nseized=len(seized)),
+              open('/tmp/opencode/fntrace/allhits.json', 'w'), indent=1)
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fnexec.py

@@ -0,0 +1,257 @@
+#!/usr/bin/env python3
+"""fnexec.py — hardware EXEC breakpoints on 529fe0 entry and FIR-loop head.
+Answers definitively whether the decoded mask chain executes during render."""
+import ctypes
+import glob
+import os
+import signal
+import struct
+import numpy as np
+import subprocess
+import sys
+import time
+
+DUR = float(os.environ.get('EXEC_DUR', '20'))
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKUSER = 3
+PTRACE_POKEUSER = 6
+PTRACE_SINGLESTEP = 9
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_O_TRACECLONE = 2
+
+DR_BASE = 0x350
+DR7_OFF = DR_BASE + 56
+# DR0=exec 529fe0, DR1=exec 52b550; RW=00 LEN=00 both; L0,L1 enabled
+DR7_VAL = 0x00000003
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    return None if r == -1 else r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
+                   "rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
+    wav = '/home/m/soothe-bt/dual_b1q_0.5.wav'
+    wt0 = os.path.getmtime(wav) if os.path.exists(wav) else 0
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.2fs' % (host, time.time() - t0), flush=True)
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    # EARLY arm: exec watch on DESIGN bodies (inherited by future clones)
+    fd0 = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+    pt(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+    pt(PTRACE_INTERRUPT, host)
+    for _ in range(60):
+        try:
+            wpid, _st = os.waitpid(host, os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if wpid == host:
+            break
+        time.sleep(0.001)
+    pt(PTRACE_POKEUSER, host, DR_BASE + 0, 0x1802A24C0)
+    pt(PTRACE_POKEUSER, host, DR_BASE + 8, 0x1802FA420)
+    pt(PTRACE_POKEUSER, host, DR_BASE + 16, 0x180535A70)
+    pt(PTRACE_POKEUSER, host, DR_BASE + 24, 0x18052D650)
+    pt(PTRACE_POKEUSER, host, DR7_OFF, 0xF)
+    ok0 = pt(PTRACE_PEEKUSER, host, DR7_OFF)
+    print('early arm dr7=%#x' % (ok0 or 0), flush=True)
+    pt(PTRACE_CONT, host, 0, 0)
+
+    # phase B: seize ALL tids NOW and arm exec watches
+    def arm(tid):
+        pt(PTRACE_POKEUSER, tid, DR_BASE + 0, 0x180529FE0)
+        pt(PTRACE_POKEUSER, tid, DR_BASE + 8, 0x18052B550)
+        pt(PTRACE_POKEUSER, tid, DR7_OFF, DR7_VAL)
+        v = pt(PTRACE_PEEKUSER, tid, DR7_OFF)
+        return v is not None and (v & ~0x400) == DR7_VAL
+
+    seized = {host}
+    armed = set()
+    for tid_s in glob.glob(f'/proc/{host}/task/*') or [host]:
+        tid = int(os.path.basename(tid_s))
+        pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+        pt(PTRACE_INTERRUPT, tid)
+        for _ in range(40):
+            try:
+                wpid, _st = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+            except ChildProcessError:
+                break
+            if wpid == tid:
+                break
+            time.sleep(0.001)
+        if arm(tid):
+            armed.add(tid)
+        try:
+            pt(PTRACE_CONT, tid, 0, 0)
+        except OSError:
+            pass
+    print('armed %d/%d tids' % (len(armed), len(seized)), flush=True)
+
+    n0 = n1 = 0
+    STOPLOG=[]
+    samples = []
+    t_end = time.time() + DUR
+    last_sweep = 0.0
+    fresh_t = None
+    while time.time() < t_end:
+        now = time.time()
+        if now - last_sweep > 0.03:
+            last_sweep = now
+            for tid_s in glob.glob(f'/proc/{host}/task/*'):
+                tid = int(os.path.basename(tid_s))
+                if tid not in seized:
+                    if pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE) is not None:
+                        seized.add(tid)
+                    pt(PTRACE_INTERRUPT, tid)
+                    for _ in range(40):
+                        try:
+                            wpid, _st = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+                        except ChildProcessError:
+                            break
+                        if wpid == tid:
+                            break
+                        time.sleep(0.001)
+                    if arm(tid):
+                        armed.add(tid)
+                        d0=pt(PTRACE_PEEKUSER,tid,DR_BASE)
+                        d7=pt(PTRACE_PEEKUSER,tid,DR7_OFF)
+                        print('   tid %d dr0=%#x dr7=%#x'%(tid,d0 or 0,d7 or 0),flush=True)
+                    try:
+                        pt(PTRACE_CONT, tid, 0, 0)
+                    except OSError:
+                        pass
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == 0:
+            time.sleep(0.0004)
+            continue
+        ent=[round(time.time()-t0,3), pid, hex(status)]
+        if os.WIFSTOPPED(pid) and (status>>8)==5:
+            rg=UserRegs()
+            if pt(PTRACE_GETREGS,pid,0,ctypes.addressof(rg)) is not None:
+                ent+= [rg.rip, pt(PTRACE_PEEKUSER,pid,DR_BASE+48)]
+                # auto-dump arrays on design hits
+                if rg.rip in (0x1802A24C0,0x1802FA420):
+                    def dmp(ptr):
+                        try:
+                            b=os.pread(fd,2049*4,ptr)
+                            return np.frombuffer(b,dtype='<f4').astype(np.float32).tolist()
+                        except OSError: return []
+                    ent.append({'rcx':rg.rcx,'rdx':rg.rdx,
+                                'in':dmp(rg.rcx),'out':dmp(rg.rdx)})
+        STOPLOG.append(ent)
+        sig = status >> 8
+        if os.WIFEXITED(status) or os.WIFSIGNALED(status):
+            continue
+        if os.WIFSTOPPED(pid) and sig == signal.SIGTRAP:
+            regs = UserRegs()
+            if pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs)) is None:
+                continue
+            rip = regs.rip - (1 if False else 0)
+            if pid not in armed:
+                seized.add(pid)
+                if arm(pid):
+                    armed.add(pid)
+                # re-read regs after arming? DR change does not touch GPRs
+            if rip not in (0x180529FE0, 0x18052B550, 0x1802A24C0, 0x1802FA420, 0x180535A70, 0x18052D650):
+                pt(PTRACE_CONT, pid, 0, 0)
+                continue
+            if rip == 0x180529FE0:
+                n0 += 1
+            elif rip == 0x18052B550:
+                n1 += 1
+            rec = dict(which='design' if rip in (0x1802A24C0, 0x1802FA420)
+                       else ('529fe0' if rip == 0x180529FE0 else 'loop'),
+                       rip=rip, rcx=regs.rcx, rdx=regs.rdx,
+                       cnt=regs.r8 & 0xffffffff,
+                       t=round(time.time() - t0, 3), tid=pid)
+            # dump band curve (rcx) and scratch (rdx) for design hits
+            if rec['which'] == 'design':
+                def rdarr(ptr, n=2049):
+                    try:
+                        b = os.pread(fd, n * 4, ptr)
+                        return np.frombuffer(b, dtype='<f4').astype(np.float32).tolist()
+                    except OSError:
+                        return []
+                rec['in'] = rdarr(regs.rcx)
+                rec['out'] = rdarr(regs.rdx)
+                print('DESIGN hit tid=%d rcx=%#x rdx=%#x cnt=%#x in[85]=%g'
+                      % (pid, regs.rcx, regs.rdx, rec['cnt'],
+                         rec['in'][85] if rec['in'] else -1), flush=True)
+            samples.append(rec)
+            if len(samples) > 400:
+                break
+            # pass exec trap: RF flag suppresses next report
+            pt(PTRACE_POKEUSER, pid, DR_BASE + 48, 0xFFFF0FF0)
+            regs.eflags |= 0x10000
+            pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+            pt(PTRACE_CONT, pid, 0, 0)
+        elif os.WIFSTOPPED(pid):
+            if pid not in armed and sig == signal.SIGTRAP:
+                seized.add(pid)
+                if arm(pid):
+                    armed.add(pid)
+            pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
+        if fresh_t is None and os.path.exists(wav) and os.path.getmtime(wav) > wt0:
+            fresh_t = time.time() - t0
+            print('wav fresh at %.2fs' % fresh_t, flush=True)
+
+    fresh = fresh_t is not None
+    print('hits: 529fe0=%d loop=%d render_fresh=%s armed=%d/%d'
+          % (n0, n1, fresh, len(armed), len(seized)))
+    import json
+    json.dump(dict(samples=samples[:300], stops=STOPLOG[:4000]),
+              open('/tmp/opencode/fnexec/hits.json', 'w'), indent=1, default=str)
+    proc.kill()
+    return 0
+
+
+def rdsp(sp, pid):
+    return None
+
+
+if __name__ == '__main__':
+    os.makedirs('/tmp/opencode/fnexec', exist_ok=True)
+    sys.exit(main())

scripts/fnhw.py

@@ -0,0 +1,224 @@
+#!/usr/bin/env python3
+"""fnhw.py — hardware-breakpoint tracer (DR0) for the yabridge host.
+Safe for un-traced threads (code is never patched). Auto-arms new threads.
+
+Env: FN_ADDR (target VA), FN_DUR (seconds), FN_SKIP (skip first N hits)
+"""
+import ctypes
+import glob
+import json
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+FN = int(os.environ.get('FN_ADDR', '0x180529FE0'), 16)
+DUR = float(os.environ.get('FN_DUR', '15'))
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKUSER = 3
+PTRACE_POKEUSER = 6
+PTRACE_SINGLESTEP = 9
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    if r == -1:
+        return None, ctypes.get_errno()
+    return r, 0
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def find_dr0_off(pid):
+    """Locate DR0 slot inside the USER area by probing."""
+    probe = 0x1234567890abcdef
+    for off in range(0x200, 0x400, 8):
+        r, e = pt(PTRACE_POKEUSER, pid, off, probe)
+        if r is None:
+            continue
+        v, _ = pt(PTRACE_PEEKUSER, pid, off)
+        if v == (probe & 0xFFFFFFFFFFFFFFFF):
+            # restore zero & sanity-check neighbours exist
+            pt(PTRACE_POKEUSER, pid, off, 0)
+            return off
+    return None
+
+
+def arm(tid, dr0_off):
+    """Arm DR0/DR7 - requires tid to be STOPPED; caller handles stop/cont."""
+    pt(PTRACE_POKEUSER, tid, dr0_off, FN)
+    # DR7 (index 7): L0=1, RW0=00 (exec), LEN0=00
+    pt(PTRACE_POKEUSER, tid, dr0_off + 7 * 8, 0x1)
+    v, _ = pt(PTRACE_PEEKUSER, tid, dr0_off + 7 * 8)
+    return v == 1
+
+
+def disarm(tid, dr0_off):
+    pt(PTRACE_POKEUSER, tid, dr0_off + 7 * 8, 0)
+    pt(PTRACE_POKEUSER, tid, dr0_off, 0)
+
+
+def arm_stopped(tid, dr0_off):
+    """INTERRUPT -> (bounded) wait -> arm -> CONT. True if DR7 verified."""
+    pt(PTRACE_INTERRUPT, tid)
+    for _ in range(30):
+        try:
+            pid, st = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            return False
+        if pid == tid:
+            break
+        time.sleep(0.002)
+    r0, e0 = pt(PTRACE_POKEUSER, tid, dr0_off, FN)
+    r7, e7 = pt(PTRACE_POKEUSER, tid, dr0_off + 7 * 8, 0x1)
+    v, _ = pt(PTRACE_PEEKUSER, tid, dr0_off + 7 * 8)
+    print('   arm tid=%d poke_dr0=%s(e%s) poke_dr7=%s(e%s) dr7_read=%s'
+          % (tid, 'ok' if r0 is not None else 'FAIL', e0,
+             'ok' if r7 is not None else 'FAIL', e7, hex(v or 0)), flush=True)
+    pt(PTRACE_CONT, tid, 0, 0)
+    return v == 1
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.3fs' % (host, time.time() - t0), flush=True)
+
+    seized = []
+    for tid in [int(os.path.basename(p)) for p in glob.glob(f'/proc/{host}/task/*')] or [host]:
+        if tid not in seized:
+            r, e = pt(PTRACE_SEIZE, tid, 0, 0)
+            if r is not None or e != 3:
+                seized.append(tid)
+
+    # stop one thread briefly to locate DR0 offset
+    tgt = seized[0]
+    pt(PTRACE_INTERRUPT, tgt)
+    os.waitpid(tgt, os.WUNTRACED)
+    dr0_off = find_dr0_off(tgt)
+    print('DR0 user-offset:', hex(dr0_off) if dr0_off else 'NOT FOUND', flush=True)
+    if not dr0_off:
+        return 1
+    pt(PTRACE_CONT, tgt, 0, 0)
+    n_ok = 0
+    for tid in seized:
+        if arm_stopped(tid, dr0_off):
+            n_ok += 1
+    print('armed %#x on %d/%d tids (DR7 verified)' % (FN, n_ok, len(seized)), flush=True)
+
+    log = []
+    hits = 0
+    skip = int(os.environ.get('FN_SKIP', '0'))
+    t_end = time.time() + DUR
+    last_resweep = 0.0
+    while time.time() < t_end:
+        now = time.time()
+        if now - last_resweep > 0.03:
+            last_resweep = now
+            for tid_s in glob.glob(f'/proc/{host}/task/*'):
+                tid = int(os.path.basename(tid_s))
+                if tid not in seized:
+                    r, e = pt(PTRACE_SEIZE, tid, 0, 0)
+                    if r is not None or e != 3:
+                        seized.append(tid)
+                        if arm_stopped(tid, dr0_off):
+                            print('+tid', tid, flush=True)
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == 0:
+            time.sleep(0.0005)
+            continue
+        sig = status >> 8
+        ev = status >> 16
+        if os.WIFEXITED(status) or os.WIFSIGNALED(status):
+            continue
+        if ev == 3 or ev == 1:
+            pt(PTRACE_CONT, pid, 0, 0)
+            continue
+        if os.WIFSTOPPED(pid) and sig == signal.SIGTRAP:
+            regs = UserRegs()
+            r, _ = pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs))
+            if r is None:
+                continue
+            if regs.rip == FN or regs.rip == FN + 1:
+                rip = FN
+                ret, _ = pt(PTRACE_PEEKDATA, pid, regs.rsp)
+                rec = dict(ctx=regs.rcx, a2=regs.rdx, cnt=regs.r8 & 0xffffffff,
+                           r9=regs.r9 & 0xffffffff, ret=ret,
+                           rbx=regs.rbx, r12=regs.r12, r13=regs.r13,
+                           r14=regs.r14, r15=regs.r15, rsp=regs.rsp, tid=pid)
+                if hits >= skip:
+                    log.append(rec)
+                    print('HIT ctx=%#x a2=%#x cnt=%#x r9d=%#x ret=%#x'
+                          % (rec['ctx'], rec['a2'], rec['cnt'], rec['r9'], rec['ret']),
+                          flush=True)
+                hits += 1
+                # pass bp: clear DR0 temporarily, single-step, re-arm
+                pt(PTRACE_POKEUSER, pid, dr0_off + 7 * 8, 0)
+                regs.eflags |= 0x100  # TF
+                pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+                pt(PTRACE_SINGLESTEP, pid, 0, 0)
+                os.waitpid(pid, os.WUNTRACED)
+                regs2 = UserRegs()
+                pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs2))
+                regs2.eflags &= ~0x100
+                pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs2))
+                arm(pid, dr0_off)
+                pt(PTRACE_CONT, pid, 0, 0)
+            else:
+                # stray SIGTRAP (wine internal): forward
+                pt(PTRACE_CONT, pid, 0, signal.SIGTRAP)
+        elif os.WIFSTOPPED(pid):
+            pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
+
+    print('total hits:', hits, 'logged:', len(log))
+    json.dump(log, open('/tmp/opencode/fntrace/hwhits.json', 'w'), indent=1)
+    for tid in seized:
+        disarm(tid, dr0_off)
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fnsample.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+"""fnsample.py — active RIP sampling of all threads via PTRACE_INTERRUPT
+during the offline-render burst. Finds which code ACTUALLY executes."""
+import ctypes
+import glob
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+MOD_LO, MOD_HI = 0x180001000, 0x181baa000
+DUR = float(os.environ.get('SAMP_DUR', '2.5'))
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_INTERRUPT = 0x4207
+PTRACE_SEIZE = 0x4206
+PTRACE_O_TRACECLONE = 2
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    return None if r == -1 else r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.3fs' % (host, time.time() - t0), flush=True)
+
+    seized = {host}
+    pt(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+    pt(PTRACE_CONT, host, 0, 0)
+
+    ips = {}
+    t_end = time.time() + DUR
+    t_start = None
+    nsamp = 0
+    while time.time() < t_end:
+        # resweep tids occasionally
+        for tid_s in glob.glob(f'/proc/{host}/task/*'):
+            tid = int(os.path.basename(tid_s))
+            if tid not in seized:
+                if pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE) is not None:
+                    seized.add(tid)
+        for tid in list(seized):
+            if pt(PTRACE_INTERRUPT, tid) is None:
+                continue
+            got = False
+            for _ in range(20):
+                try:
+                    pid, status = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+                except ChildProcessError:
+                    break
+                if pid == tid:
+                    got = True
+                    break
+                time.sleep(0.0002)
+            if got:
+                regs = UserRegs()
+                if pt(PTRACE_GETREGS, tid, 0, ctypes.addressof(regs)) is not None:
+                    nsamp += 1
+                    if t_start is None:
+                        t_start = time.time()
+                    if MOD_LO <= regs.rip < MOD_HI:
+                        b = regs.rip >> 4 << 4
+                        ips[b] = ips.get(b, 0) + 1
+            pt(PTRACE_CONT, tid, 0, 0)
+    print('samples=%d in-module=%d unique64=%d window=%.2fs..%.2fs'
+          % (nsamp, sum(ips.values()), len(ips),
+             (t_start or t0) - t0, time.time() - t0))
+    core = {a: c for a, c in ips.items() if 0x180520000 <= a < 0x180560000}
+    for a, c in sorted(core.items(), key=lambda x: -x[1])[:18]:
+        print('CORE %#x %d' % (a, c))
+    for b, c in sorted(ips.items(), key=lambda x: -x[1])[:6]:
+        print('%#x %d' % (b, c))
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fntrace.py

@@ -0,0 +1,225 @@
+#!/usr/bin/env python3
+"""fntrace.py — ptrace INT3 tracer for FUN_180529fe0 (mask chain vtbl slot 6)
+in the live yabridge host. The wine module is mapped at its preferred base,
+so dump VAs == runtime addresses (verified: exec map 0x180001000-0x181baa000).
+
+On each hit logs: RIP, RCX (ctx), RDX, R8D (count), R9D, [RSP] (return addr),
+plus xmm0/xmm1 low scalars if available via GETFPREGS (skipped: not portable).
+
+Usage: python3 scripts/fntrace.py [rpp] [nhits]
+"""
+import ctypes
+import glob
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+FN = int(os.environ.get('FN_ADDR', '0x180529FE0'), 16)
+SNAPDIR = '/tmp/opencode/fntrace'
+
+PTRACE_TRACEME = 0
+PTRACE_PEEKTEXT = 1
+PTRACE_PEEKDATA = 2
+PTRACE_POKETEXT = 4
+PTRACE_CONT = 7
+PTRACE_SINGLESTEP = 9
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_ATTACH = 16
+PTRACE_DETACH = 17
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_O_TRACECLONE = 0x00000002
+PTRACE_EVENT_CLONE = 3  # status >> 16 == 4 (event+1)? actually event = status>>16, CLONE==3 -> 4? use raw compare below
+PTRACE_EVENT_FORK = 1
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+def ptrace(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    if r == -1:
+        e = ctypes.get_errno()
+        if req not in (PTRACE_PEEKTEXT, PTRACE_PEEKDATA):
+            raise OSError(e, f'ptrace({req:#x},{pid}) failed')
+        return None
+    return r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    rpp = sys.argv[1] if len(sys.argv) > 1 else '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    nhits = int(sys.argv[2]) if len(sys.argv) > 2 else 24
+    render = '--render' in sys.argv
+    os.makedirs(SNAPDIR, exist_ok=True)
+    subprocess.run('pkill -9 -x reaser 2>/dev/null; pkill -9 -x reaper 2>/dev/null; '
+                   "pkill -9 -f '[y]abridge' 2>/dev/null; sleep 1", shell=True)
+    if render:
+        proc = subprocess.Popen(
+            ['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+             '-renderproject', rpp],
+            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    else:
+        proc = subprocess.Popen(
+            ['/usr/bin/reaper', '-nosplash', '-ignoreerrors', rpp,
+             '/home/m/re-tools/play_loop.lua'],
+            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    t0 = time.time()
+    host = None
+    while time.time() - t0 < 60 and not host:
+        host = find_host()
+        time.sleep(0.05)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host', host, 'at %.1fs' % (time.time() - t0), flush=True)
+
+    tids = [int(os.path.basename(p)) for p in glob.glob(f'/proc/{host}/task/*')]
+    print('tids:', tids, flush=True)
+
+    seized = []
+    for tid in tids:
+        try:
+            ptrace(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+            seized.append(tid)
+        except OSError as e:
+            print('seize fail', tid, e)
+    if not seized:
+        return 1
+    # stop everyone
+    stopped = []
+    for tid in seized:
+        try:
+            ptrace(PTRACE_INTERRUPT, tid)
+            os.waitpid(tid, os.WUNTRACED)
+            stopped.append(tid)
+        except (OSError, ChildProcessError):
+            pass
+
+    orig = ptrace(PTRACE_PEEKTEXT, stopped[0], FN)
+    cc = (orig & ~0xFF) | 0xCC
+    ptrace(PTRACE_POKETEXT, stopped[0], FN, cc)
+    print('breakpoint armed at %#x (orig=%#x)' % (FN, orig), flush=True)
+
+    for tid in stopped:
+        try:
+            ptrace(PTRACE_CONT, tid, 0, 0)
+        except OSError:
+            pass
+
+    hits = 0
+    log = []
+    import select
+    import time as _t
+    t_last = _t.time()
+    idle_deadline = float(os.environ.get('FNTRACE_IDLE', '20'))
+    while hits < nhits and _t.time() - t_last < idle_deadline:
+        try:
+            pid, status = os.waitpid(-1, os.WUNTRACED | os.WSTOPPED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == 0:
+            _t.sleep(0.005)
+            continue
+        sig = status >> 8
+        if os.WIFEXITED(pid and status or status) or os.WIFSIGNALED(status):
+            # thread/process exited (normal in wine): forget it
+            if pid in seized:
+                seized.remove(pid)
+            if pid in stopped:
+                stopped.remove(pid)
+            continue
+        if not os.WIFSTOPPED(pid):
+            continue
+        t_last = _t.time()
+        ev = status >> 16
+        if ev == PTRACE_EVENT_CLONE or ev == PTRACE_EVENT_FORK:
+            if pid not in seized:
+                seized.append(pid)
+            ptrace(PTRACE_CONT, pid, 0, 0)
+            continue
+        if sig == signal.SIGTRAP:
+            regs = UserRegs()
+            try:
+                ptrace(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs))
+            except OSError:
+                ptrace(PTRACE_CONT, pid, 0, 0)
+                continue
+            if regs.rip - 1 == FN:
+                ret = ptrace(PTRACE_PEEKDATA, pid, regs.rsp)
+                rec = dict(rip=regs.rip - 1, ctx=regs.rcx, a2=regs.rdx,
+                           cnt=regs.r8 & 0xffffffff, r9=regs.r9 & 0xffffffff,
+                           ret=ret, tid=pid,
+                           rbx=regs.rbx, rbp_=regs.rbp, rsi=regs.rsi, rdi=regs.rdi)
+                log.append(rec)
+                hits += 1
+                print(f'hit {hits}: tid={pid} ctx={regs.rcx:#x} '
+                      f'a2={regs.rdx:#x} cnt={regs.r8:#x} r9d={regs.r9:#x} '
+                      f'ret={ret:#x}', flush=True)
+                # step over int3
+                lo = struct.unpack('<Q', struct.pack('<Q', orig ^ ((orig ^ cc) & 0xFF)))[0]
+                ptrace(PTRACE_POKETEXT, pid, FN, orig)
+                regs.rip = FN
+                ptrace(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+                ptrace(PTRACE_SINGLESTEP, pid, 0, 0)
+                os.waitpid(pid, os.WUNTRACED)
+                ptrace(PTRACE_POKETEXT, pid, FN, cc)
+                ptrace(PTRACE_CONT, pid, 0, 0)
+            else:
+                ptrace(PTRACE_CONT, pid, 0, 0)
+        else:
+            # other stop signals: deliver and continue
+            ptrace(PTRACE_CONT, pid, 0, sig if 0 < sig < 0x20 else 0)
+
+    # cleanup: remove breakpoint, detach
+    print('done hits=', hits, 'cleaning up...', flush=True)
+    for tid in seized:
+        try:
+            ptrace(PTRACE_INTERRUPT, tid)
+            os.waitpid(tid, os.WUNTRACED)
+        except (OSError, ChildProcessError):
+            continue
+    try:
+        ptrace(PTRACE_POKETEXT, stopped[0], FN, orig)
+    except Exception as e:
+        print('restore fail', e)
+    for tid in seized:
+        try:
+            ptrace(PTRACE_DETACH, tid, 0, 0)
+        except OSError:
+            pass
+    import json
+    json.dump(log, open(f'{SNAPDIR}/hits.json', 'w'), indent=1)
+    print('saved', f'{SNAPDIR}/hits.json')
+    if proc.poll() is None:
+        proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fntrace2.py

@@ -0,0 +1,195 @@
+#!/usr/bin/env python3
+"""fntrace2.py — fast single-point INT3 tracer for the live yabridge host.
+
+Flow: poll for host spawn (5ms), immediately PTRACE_SEIZE the main thread,
+poke INT3 at FN (no stop required - word write is atomic), then serve
+waitpid events (clone children are auto-traced and continued). Logs args at
+each hit. Works best against `reaper -renderproject` where all DSP work
+happens in a burst right after host spawn.
+
+Usage: python3 scripts/fntrace2.py [rpp] [nhits] [--render]
+Env:   FN_ADDR (default 0x180529fe0)
+"""
+import ctypes
+import glob
+import json
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+FN = int(os.environ.get('FN_ADDR', '0x180529FE0'), 16)
+SNAPDIR = '/tmp/opencode/fntrace'
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKDATA = 2
+PTRACE_POKETEXT = 4
+PTRACE_SINGLESTEP = 9
+PTRACE_DETACH = 17
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_O_TRACECLONE = 0x00000002
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+def ptrace(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    if r == -1:
+        e = ctypes.get_errno()
+        if req not in (PTRACE_PEEKDATA,):
+            raise OSError(e, f'ptrace({req:#x},{pid}) failed')
+        return None
+    return r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    rpp = sys.argv[1] if len(sys.argv) > 1 else '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    nhits = int(sys.argv[2]) if len(sys.argv) > 2 else 12
+    render = '--render' in sys.argv
+    os.makedirs(SNAPDIR, exist_ok=True)
+    subprocess.run('pkill -9 -x reaser 2>/dev/null; pkill -9 -x reaper 2>/dev/null; '
+                   "pkill -9 -f '[y]abridge' 2>/dev/null; sleep 1", shell=True)
+    if render:
+        proc = subprocess.Popen(
+            ['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+             '-renderproject', rpp],
+            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    else:
+        proc = subprocess.Popen(
+            ['/usr/bin/reaper', '-nosplash', '-ignoreerrors', rpp,
+             '/home/m/re-tools/play_loop.lua'],
+            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 60 and not host:
+        host = find_host()
+        time.sleep(0.005)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.2fs' % (host, time.time() - t0), flush=True)
+
+    ptrace(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+    try:
+        ptrace(PTRACE_INTERRUPT, host)
+        os.waitpid(host, os.WUNTRACED)
+    except (OSError, ChildProcessError) as e:
+        print('interrupt fail', e)
+    orig = ptrace(PTRACE_PEEKDATA, host, FN)
+    cc = (orig & ~0xFF) | 0xCC
+    ptrace(PTRACE_POKETEXT, host, FN, cc)
+    print('armed %#x orig=%#x' % (FN, orig), flush=True)
+    try:
+        ptrace(PTRACE_CONT, host, 0, 0)
+    except OSError:
+        pass
+
+    known = {host}
+    log = []
+    hits = 0
+    t_last = time.time()
+    deadline_idle = float(os.environ.get('FNTRACE_IDLE', '25'))
+    while hits < nhits and time.time() - t_last < deadline_idle:
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WUNTRACED)
+        except ChildProcessError:
+            break
+        sig = status >> 8
+        ev = status >> 16
+        known.add(pid)
+        t_last = time.time()
+        if ev == 3 or ev == 1:      # CLONE/FORK event stop
+            try:
+                ptrace(PTRACE_CONT, pid, 0, 0)
+            except OSError:
+                pass
+            continue
+        if not os.WIFSTOPPED(pid):
+            continue
+        if sig == signal.SIGTRAP:
+            regs = UserRegs()
+            try:
+                ptrace(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs))
+            except OSError:
+                continue
+            if regs.rip - 1 == FN:
+                ret = ptrace(PTRACE_PEEKDATA, pid, regs.rsp)
+                rec = dict(ctx=regs.rcx, a2=regs.rdx, cnt=regs.r8 & 0xffffffff,
+                           r9=regs.r9 & 0xffffffff, ret=ret, rsp=regs.rsp,
+                           rbx=regs.rbx, r12=regs.r12, r13=regs.r13,
+                           r14=regs.r14, r15=regs.r15, rsi=regs.rsi, rdi=regs.rdi,
+                           rip=regs.rip - 1, tid=pid)
+                log.append(rec)
+                hits += 1
+                print('hit %d tid=%d ctx=%#x a2=%#x cnt=%#x r9d=%#x ret=%#x'
+                      % (hits, pid, regs.rcx, regs.rdx,
+                         regs.r8 & 0xffffffff, regs.r9 & 0xffffffff, ret),
+                      flush=True)
+                # step over
+                ptrace(PTRACE_POKETEXT, pid, FN, orig)
+                regs.rip = FN
+                ptrace(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+                ptrace(PTRACE_SINGLESTEP, pid, 0, 0)
+                try:
+                    os.waitpid(pid, os.WUNTRACED)
+                except ChildProcessError:
+                    pass
+                ptrace(PTRACE_POKETEXT, pid, FN, cc)
+                try:
+                    ptrace(PTRACE_CONT, pid, 0, 0)
+                except OSError:
+                    pass
+            else:
+                try:
+                    ptrace(PTRACE_CONT, pid, 0, 0)
+                except OSError:
+                    pass
+        else:
+            try:
+                ptrace(PTRACE_CONT, pid, 0, sig if 0 < sig < 0x20 else 0)
+            except OSError:
+                pass
+
+    print('hits:', hits, flush=True)
+    json.dump(log, open(f'{SNAPDIR}/hits.json', 'w'), indent=1)
+    for pid in list(known):
+        try:
+            os.kill(pid, signal.SIGKILL)
+        except OSError:
+            pass
+    proc.kill()
+    print('saved', f'{SNAPDIR}/hits.json')
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fntrace3.py

@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+"""fntrace3.py — decisive INT3 experiment: seize ALL tids within milliseconds
+of host spawn, arm breakpoint, log EVERY waitpid event for N seconds."""
+import ctypes
+import glob
+import json
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+FN = int(os.environ.get('FN_ADDR', '0x180529FE0'), 16)
+DUR = float(os.environ.get('FN_DUR', '25'))
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKDATA = 2
+PTRACE_POKETEXT = 4
+PTRACE_SINGLESTEP = 9
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_LISTEN = 0x4208
+PTRACE_O_TRACECLONE = 2
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    if r == -1:
+        return None, ctypes.get_errno()
+    return r, 0
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    rpp = '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    subprocess.run('pkill -9 -x reaper; pkill -9 -f \'[y]abridge\'; sleep 1', shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', rpp],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.3fs' % (host, time.time() - t0), flush=True)
+
+    seized = []
+    for tid in [host] + [int(os.path.basename(p)) for p in glob.glob(f'/proc/{host}/task/*')]:
+        if tid in seized:
+            continue
+        r, e = pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+        if r is None and e == 3:  # ESRCH - gone
+            continue
+        seized.append(tid)
+        # interrupt to allow poke below (poke needs SOME stopped thread)
+    print('seized:', seized, flush=True)
+    # stop one thread to enable POKETEXT
+    tgt = seized[0]
+    pt(PTRACE_INTERRUPT, tgt)
+    os.waitpid(tgt, os.WUNTRACED)
+    orig, _ = pt(PTRACE_PEEKDATA, tgt, FN)
+    cc = (orig & ~0xFF) | 0xCC
+    pt(PTRACE_POKETEXT, tgt, FN, cc)
+    print('armed orig=%#x' % orig, flush=True)
+    # seize any tids spawned meanwhile
+    for tid in [int(os.path.basename(p)) for p in glob.glob(f'/proc/{host}/task/*')]:
+        if tid not in seized:
+            r, e = pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+            if r is not None or e != 3:
+                seized.append(tid)
+    for tid in seized:
+        try:
+            pt(PTRACE_CONT, tid, 0, 0)
+        except Exception:
+            pass
+
+    log = []
+    events = []
+    hits = 0
+    t_end = time.time() + DUR
+    last_resweep = 0.0
+    while time.time() < t_end:
+        now = time.time()
+        if now - last_resweep > 0.05:
+            last_resweep = now
+            for tid_s in glob.glob(f'/proc/{host}/task/*'):
+                tid = int(os.path.basename(tid_s))
+                if tid not in seized:
+                    r, e = pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE)
+                    if r is not None or e != 3:
+                        seized.append(tid)
+                        print('+tid', tid, flush=True)
+        pid, status = os.waitpid(-1, os.WSTOPPED | os.WUNTRACED | os.WNOHANG)
+        if pid == 0:
+            time.sleep(0.001)
+            continue
+        sig = status >> 8
+        ev = status >> 16
+        events.append((time.time() - t0, pid, hex(status), ev))
+        if pid not in seized:
+            r, e = pt(PTRACE_SEIZE, pid, 0, PTRACE_O_TRACECLONE)
+            if r is not None or e != 3:
+                seized.append(pid)
+        if ev == 3 or ev == 1:
+            pt(PTRACE_CONT, pid, 0, 0)
+            continue
+        if os.WIFSTOPPED(pid) and sig == signal.SIGTRAP:
+            regs = UserRegs()
+            r, _ = pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs))
+            if r is None:
+                continue
+            if regs.rip - 1 == FN:
+                ret, _ = pt(PTRACE_PEEKDATA, pid, regs.rsp)
+                rec = dict(ctx=regs.rcx, a2=regs.rdx, cnt=regs.r8 & 0xffffffff,
+                           r9=regs.r9 & 0xffffffff, ret=ret, rbx=regs.rbx,
+                           r12=regs.r12, r13=regs.r13, r14=regs.r14,
+                           r15=regs.r15, rsp=regs.rsp, tid=pid)
+                log.append(rec)
+                hits += 1
+                print('HIT ctx=%#x a2=%#x cnt=%#x ret=%#x'
+                      % (regs.rcx, regs.rdx, regs.r8 & 0xffffffff, ret), flush=True)
+                pt(PTRACE_POKETEXT, pid, FN, orig)
+                regs.rip = FN
+                pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+                pt(PTRACE_SINGLESTEP, pid, 0, 0)
+                os.waitpid(pid, os.WUNTRACED)
+                pt(PTRACE_POKETEXT, pid, FN, cc)
+                pt(PTRACE_CONT, pid, 0, 0)
+            else:
+                pt(PTRACE_CONT, pid, 0, 0)
+        elif os.WIFEXITED(status) or os.WIFSIGNALED(status):
+            continue
+        else:
+            pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
+
+    print('total hits:', hits, 'events:', len(events))
+    json.dump(dict(log=log, events=events[:400]),
+              open('/tmp/opencode/fntrace/hits3.json', 'w'), indent=1)
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/fnwatch.py

@@ -0,0 +1,234 @@
+#!/usr/bin/env python3
+"""fnwatch.py — hardware data-watchpoint (DR0 RW) on the live FIR kernel word.
+Catches whoever READS the built kernel during offline render -> consumer RIP."""
+import ctypes
+import glob
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+DUR = float(os.environ.get('WATCH_DUR', '20'))
+BIN = '/home/m/re-tools/soothe_mem.bin'
+BASE = 0x180000000
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKUSER = 3
+PTRACE_POKEUSER = 6
+PTRACE_SINGLESTEP = 9
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_O_TRACECLONE = 2
+
+DR0_OFF = 0x350          # empirically verified debugreg base
+DR7_OFF = DR0_OFF + 56   # 0x388
+DR7_VAL = 0x000F0001     # L0=1, R/W0=11 (rd/wr), LEN0=11 (4 bytes)
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+_mod = open(BIN, 'rb').read()
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    return None if r == -1 else r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
+                   "rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    def rd(a, n):
+        try:
+            return os.pread(fd, n, a)
+        except OSError:
+            return None
+
+    # find ctx & FIR ptr while running (poll till instance exists)
+    ctx = firptr = None
+    vt = struct.pack('<Q', 0x1824AC210)
+    while time.time() - t0 < 25 and firptr is None:
+        for line in open(f'/proc/{host}/maps'):
+            parts = line.split()
+            if 'rw' not in parts[1]:
+                continue
+            lo, hi = (int(x, 16) for x in parts[0].split('-'))
+            CH = 16 * 1024 * 1024
+            a = lo
+            while a < hi and firptr is None:
+                d = rd(a, min(CH + 4096, hi - a))
+                if not d:
+                    break
+                j = d.find(vt)
+                while j >= 0:
+                    cand = a + j
+                    sb = rd(cand + 0x540870, 4)
+                    if sb and struct.unpack('<f', sb)[0] > 100:
+                        ctx = cand
+                        qb = rd(cand + 0x540668, 8)
+                        firptr = struct.unpack('<Q', qb)[0]
+                        break
+                    j = d.find(vt, j + 1)
+                a += CH
+    if firptr is None:
+        print('NO CTX/FIR')
+        return 1
+    print('host %d ctx %#x fir %#x at %.2fs' % (host, ctx, firptr, time.time() - t0), flush=True)
+
+    seized = {host}
+    armed = set()
+    pt(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+    pt(PTRACE_INTERRUPT, host)
+    for _ in range(60):
+        try:
+            pid, st = os.waitpid(host, os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == host:
+            break
+        time.sleep(0.001)
+    pt(PTRACE_POKEUSER, host, DR0_OFF, 0x18052b8bb)
+    pt(PTRACE_POKEUSER, host, DR7_OFF, DR7_VAL)
+    armed.add(host)
+    print('placeholder armed', flush=True)
+
+    def arm_dbg(tid):
+        pass_off=(0x350,)
+        for off in pass_off:
+            r = pt(PTRACE_POKEUSER, tid, off, 0xdeadbeef if off == DR0_OFF else DR7_VAL)
+            v = pt(PTRACE_PEEKUSER, tid, off)
+            print('   dbg poke %#x -> r=%s read=%#x' % (off, 'ok' if r is not None else 'EIO', v or 0), flush=True)
+
+    def arm(tid):
+        pt(PTRACE_POKEUSER, tid, DR0_OFF, firptr + 43 * 8)   # bin43 re (hot word)
+        pt(PTRACE_POKEUSER, tid, DR7_OFF, DR7_VAL)
+        v = pt(PTRACE_PEEKUSER, tid, DR7_OFF)
+        # bit10 of DR7 reads as always-1 (RA1)
+        return v is not None and (v & ~0x400) == (DR7_VAL & ~0x400)
+
+    # stop host briefly to verify arming works at all
+    pt(PTRACE_INTERRUPT, host)
+    for _ in range(50):
+        try:
+            pid, st = os.waitpid(host, os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == host:
+            break
+        time.sleep(0.002)
+    arm_dbg(host)
+    ok = arm(host)
+    print('arm check (stopped):', ok, flush=True)
+    pt(PTRACE_CONT, host, 0, 0)
+
+    if ok:
+        armed.add(host)
+
+    hits = []
+    t_end = time.time() + DUR
+    last_sweep = 0.0
+    while time.time() < t_end:
+        now = time.time()
+        if now - last_sweep > 0.03:
+            last_sweep = now
+            for tid_s in glob.glob(f'/proc/{host}/task/*'):
+                tid = int(os.path.basename(tid_s))
+                if tid not in seized:
+                    if pt(PTRACE_SEIZE, tid, 0, 0) is not None:
+                        seized.add(tid)
+                    if tid not in armed:
+                        pt(PTRACE_INTERRUPT, tid)
+                        for _ in range(40):
+                            try:
+                                pid, st = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+                            except ChildProcessError:
+                                break
+                            if pid == tid:
+                                break
+                            time.sleep(0.001)
+                        if arm(tid):
+                            armed.add(tid)
+                        try:
+                            pt(PTRACE_CONT, tid, 0, 0)
+                        except OSError:
+                            pass
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == 0:
+            time.sleep(0.0005)
+            continue
+        sig = status >> 8
+        if os.WIFEXITED(status) or os.WIFSIGNALED(status):
+            continue
+        if os.WIFSTOPPED(pid) and sig == signal.SIGTRAP:
+            regs = UserRegs()
+            if pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs)) is None:
+                continue
+            rec = dict(rip=regs.rip, rsp=regs.rsp, tid=pid,
+                       ret=struct.unpack('<Q', rd(regs.rsp, 8) or b'\0' * 8)[0])
+            hits.append(rec)
+            if len(hits) <= 15:
+                print('WATCH HIT rip=%#x ret=%#x' % (rec['rip'], rec['ret']), flush=True)
+            # pass trap: clear DR6 (poke 0xffff0ff0), single-step, continue
+            pt(PTRACE_POKEUSER, pid, DR0_OFF + 48, 0xFFFF0FF0)  # reset DR6
+            regs.eflags |= 0x100
+            pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+            pt(PTRACE_SINGLESTEP, pid, 0, 0)
+            try:
+                os.waitpid(pid, os.WUNTRACED)
+            except ChildProcessError:
+                pass
+            pt(PTRACE_CONT, pid, 0, 0)
+        elif os.WIFSTOPPED(pid):
+            pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
+
+    print('total watch hits:', len(hits))
+    import json
+    json.dump(hits, open('/tmp/opencode/fnwatch/hits.json', 'w'), indent=1, default=str)
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    os.makedirs('/tmp/opencode/fnwatch', exist_ok=True)
+    sys.exit(main())

scripts/fnwatch4.py

@@ -0,0 +1,235 @@
+#!/usr/bin/env python3
+"""fnwatch4.py — 4 hardware watchpoints simultaneously:
+  DR0/DR1: dwords of the FIR pointer slot ctx+0x540668 (catches loader of ptr)
+  DR2    : kernel word bin43.re
+  DR3    : scratch word bin43
+RW=read/write (traps readers AND writers), LEN=4B."""
+import ctypes
+import glob
+import hashlib
+import json
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+DUR = float(os.environ.get('WATCH_DUR', '20'))
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_SETREGS = 13
+PTRACE_PEEKUSER = 3
+PTRACE_POKEUSER = 6
+PTRACE_SEIZE = 0x4206
+PTRACE_INTERRUPT = 0x4207
+PTRACE_O_TRACECLONE = 2
+
+DR_BASE = 0x350          # u_debugreg[0]
+DR6_OFF = DR_BASE + 48   # 0x388 - wait: idx6=+48 -> that IS DR6 slot? no:
+# u_debugreg[0..7]: DR0@+0, DR1@+8, DR2@+16, DR3@+24, DR4@+32, DR5@+40,
+#                   DR6@+48, DR7@+56
+DR7_OFF = DR_BASE + 56
+DR7_VAL = 0xFFFF000F     # L0-3 enabled, all RW=11, all LEN=11 (4B)
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    return None if r == -1 else r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
+                   "rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
+    rpp = '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    wav = rpp.replace('.rpp', '.wav')
+    wt0 = os.path.getmtime(wav) if os.path.exists(wav) else 0
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', rpp],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    def rd(a, n):
+        try:
+            return os.pread(fd, n, a)
+        except OSError:
+            return None
+
+    ctx = firptr = scrptr = None
+    vt = struct.pack('<Q', 0x1824AC210)
+    while time.time() - t0 < 25 and firptr is None:
+        for line in open(f'/proc/{host}/maps'):
+            parts = line.split()
+            if 'rw' not in parts[1]:
+                continue
+            lo, hi = (int(x, 16) for x in parts[0].split('-'))
+            CH = 16 * 1024 * 1024
+            a = lo
+            while a < hi and firptr is None:
+                d = rd(a, min(CH + 4096, hi - a))
+                if not d:
+                    break
+                j = d.find(vt)
+                while j >= 0:
+                    cand = a + j
+                    sb = rd(cand + 0x540870, 4)
+                    if sb and struct.unpack('<f', sb)[0] > 100:
+                        ctx = cand
+                        firptr = struct.unpack('<Q', rd(cand + 0x540668, 8))[0]
+                        scrptr = struct.unpack('<Q', rd(cand + 0x540628, 8))[0] or firptr
+                        break
+                    j = d.find(vt, j + 1)
+                a += CH
+    if firptr is None:
+        print('NO CTX')
+        return 1
+    print('host %d ctx %#x fir %#x scr %#x at %.2fs' %
+          (host, ctx, firptr, scrptr, time.time() - t0), flush=True)
+
+    seized = {host}
+    armed = set()
+    pt(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+
+    def arm(tid):
+        okall = True
+        ovf = struct.unpack('<Q', rd(ctx + 0x5406f8, 8))[0]
+        trk = struct.unpack('<Q', rd(ctx + 0x540768, 8))[0]
+        rax = struct.unpack('<Q', rd(ctx + 0x5407f8, 8))[0]
+        targets = [(DR_BASE + 0, ovf + 8192),
+                   (DR_BASE + 8, trk + 43 * 4),
+                   (DR_BASE + 16, rax + 43 * 4),
+                   (DR_BASE + 24, ctx + 0x2404dc)]
+        for off, addr in targets:
+            pt(PTRACE_POKEUSER, tid, off, addr)
+            v = pt(PTRACE_PEEKUSER, tid, off)
+            if v != addr:
+                okall = False
+        pt(PTRACE_POKEUSER, tid, DR7_OFF, DR7_VAL)
+        return okall
+
+    pt(PTRACE_INTERRUPT, host)
+    for _ in range(60):
+        try:
+            pid, st = os.waitpid(host, os.WUNTRACED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == host:
+            break
+        time.sleep(0.001)
+    ok = arm(host)
+    print('arm(host)=%s' % ok, flush=True)
+    pt(PTRACE_CONT, host, 0, 0)
+    if ok:
+        armed.add(host)
+
+    hits = []
+    t_end = time.time() + DUR
+    last_sweep = 0.0
+    while time.time() < t_end:
+        now = time.time()
+        if now - last_sweep > 0.03:
+            last_sweep = now
+            for tid_s in glob.glob(f'/proc/{host}/task/*'):
+                tid = int(os.path.basename(tid_s))
+                if tid not in seized:
+                    if pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE) is not None:
+                        seized.add(tid)
+                    pt(PTRACE_INTERRUPT, tid)
+                    for _ in range(40):
+                        try:
+                            wpid, _st = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+                        except ChildProcessError:
+                            break
+                        if wpid == tid:
+                            break
+                        time.sleep(0.001)
+                    if arm(tid):
+                        armed.add(tid)
+                    try:
+                        pt(PTRACE_CONT, tid, 0, 0)
+                    except OSError:
+                        pass
+        try:
+            pid, status = os.waitpid(-1, os.WSTOPPED | os.WNOHANG)
+        except ChildProcessError:
+            break
+        if pid == 0:
+            time.sleep(0.0005)
+            continue
+        sig = status >> 8
+        if os.WIFEXITED(status) or os.WIFSIGNALED(status):
+            continue
+        if os.WIFSTOPPED(pid) and sig == signal.SIGTRAP:
+            regs = UserRegs()
+            if pt(PTRACE_GETREGS, pid, 0, ctypes.addressof(regs)) is None:
+                continue
+            dr6v = pt(PTRACE_PEEKUSER, pid, DR_BASE + 48)
+            rec = dict(rip=regs.rip, rsp=regs.rsp, tid=pid,
+                       dr6=dr6v,
+                       ret=struct.unpack('<Q', rd(regs.rsp, 8) or b'\0' * 8)[0])
+            hits.append(rec)
+            if len(hits) <= 20:
+                print('HIT rip=%#x ret=%#x dr6=%#x'
+                      % (rec['rip'], rec['ret'], dr6v or 0), flush=True)
+            # clear DR6 and single-step past
+            pt(PTRACE_POKEUSER, pid, DR_BASE + 48, 0xFFFF0FF0)
+            regs.eflags |= 0x100
+            pt(PTRACE_SETREGS, pid, 0, ctypes.addressof(regs))
+            pt(PTRACE_SINGLESTEP, pid, 0, 0)
+            try:
+                os.waitpid(pid, os.WUNTRACED)
+            except ChildProcessError:
+                pass
+            pt(PTRACE_CONT, pid, 0, 0)
+        elif os.WIFSTOPPED(pid):
+            pt(PTRACE_CONT, pid, 0, sig if 0 < sig < 32 else 0)
+
+        if not hasattr(main, '_wv') and os.path.exists(wav) and os.path.getmtime(wav) > wt0:
+            main._wv = True
+            print('wav fresh at %.2fs' % (time.time() - t0), flush=True)
+    if not hasattr(main, '_wv'):
+        main._wv = False
+    fresh = main._wv
+    print('hits=%d render_fresh=%s armed=%d/%d' % (len(hits), fresh, len(armed), len(seized)))
+    json.dump(hits[:200], open('/tmp/opencode/fnwatch/hits4.json', 'w'),
+              indent=1, default=str)
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    os.makedirs('/tmp/opencode/fnwatch', exist_ok=True)
+    sys.exit(main())

scripts/hotips.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""hotips.py — sample thread RIPs aggressively during the render burst to find
+which module code actually executes (the real DSP path)."""
+import collections
+import glob
+import os
+import subprocess
+import sys
+import time
+
+MOD_LO, MOD_HI = 0x180001000, 0x181baa000
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    print('host', host, 'at %.3fs' % (time.time() - t0))
+    ips = collections.Counter()
+    t_end = time.time() + float(os.environ.get('HOT_DUR', '6'))
+    n_ok = n_fail = 0
+    while time.time() < t_end:
+        for tid_s in glob.glob(f'/proc/{host}/task/*'):
+            try:
+                parts = open(f'{tid_s}/syscall').read().split()
+                ip = int(parts[-1], 16)
+                n_ok += 1
+                if MOD_LO <= ip < MOD_HI:
+                    ips[ip] += 1
+            except Exception:
+                n_fail += 1
+    proc.kill()
+    print('samples ok=%d fail=%d, in-module=%d' % (n_ok, n_fail, sum(ips.values())))
+    # bucket to 64-byte lines, aggregate by function-ish regions
+    agg = collections.Counter()
+    for ip, c in ips.items():
+        agg[(ip >> 6) << 6] += c
+    for addr, c in agg.most_common(40):
+        print('%#x %d' % (addr, c))
+
+
+if __name__ == '__main__':
+    main()

scripts/ilt_resolve.py

@@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+"""ilt_resolve.py — resolve ILT dispatch stubs of soothe_mem.bin (raw dump, base 0x180000000).
+
+Stub pattern (7+7+4 bytes):
+    48 63 05 rel32      mov  eax, [rip+rel32]     ; slot index (runtime-fixed after reloc)
+    4c 8d 15 rel32      lea  r10, [rip+rel32]     ; pointer table base
+    41 ff 24 d2         jmp  qword ptr [r10+rax*8]
+
+Resolution (all offline from the dump, post-relocation values):
+    idx_addr = stub + 7  + rel32_a
+    tbl_addr = stub + 14 + rel32_b
+    impl     = u64[tbl_addr + idx * 8]
+
+Usage: ilt_resolve.py [VA ...]        (default: FIR-loop + main-loop stub set)
+"""
+import struct
+import sys
+
+BASE = 0x180000000
+BIN = '/home/m/re-tools/soothe_mem.bin'
+_data = open(BIN, 'rb').read()
+
+
+def rd(va, n):
+    off = va - BASE
+    return _data[off:off + n]
+
+
+def u32(va):
+    return struct.unpack('<I', rd(va, 4))[0]
+
+
+def u64(va):
+    return struct.unpack('<Q', rd(va, 8))[0]
+
+
+def resolve_stub(va):
+    """Return dict describing the ILT stub at va, or None if pattern mismatch."""
+    b = rd(va, 18)
+    if len(b) < 18 or b[0] != 0x48 or b[1] != 0x63 or b[2] != 0x05:
+        return None
+    rel_a = struct.unpack_from('<i', b, 3)[0]
+    if b[7] != 0x4C or b[8] != 0x8D or b[9] != 0x15:
+        return None
+    rel_b = struct.unpack_from('<i', b, 10)[0]
+    idx_addr = va + 7 + rel_a
+    tbl_addr = va + 14 + rel_b
+    idx = u32(idx_addr)
+    impl = u64(tbl_addr + idx * 8)
+    return dict(stub=va, idx_addr=idx_addr, idx=idx,
+                tbl_addr=tbl_addr, impl=impl)
+
+
+DEFAULT_STUBS = [
+    # FIR-build loop 52b550..52b8bb
+    0x180002210,  # copy scratch->FIR ?
+    0x180002180,  # complex-op A/C (float)
+    0x180001bb0,  # complex-op A/C (double)
+    0x180001a90,  # complex-op B/D (float)
+    0x1800019d0,  # complex-op B/D (double)
+    0x180001880,  # paired-scalar op 1 (flag branch)
+    0x180001ca0,  # paired-scalar op 2 (flag branch)
+    0x180001df0,  # final op (float)
+    0x180001f70,  # final op (double)
+    # import thunks of 535a70 dispatcher
+    0x180140a10,
+    0x180140a70,
+    # main-loop transforms referenced by BLOCKMAP
+    0x180002030, 0x180001d30, 0x180002270, 0x1800022a0,
+    0x180001970, 0x180001a60, 0x180001850, 0x180002000,
+    0x180001c40, 0x180001fa0, 0x180001940, 0x180001f10,
+    0x180001c70, 0x180001d60, 0x1800019a0, 0x180001a00,
+]
+
+
+def main():
+    args = [int(a, 16) if not a.startswith('0x') else int(a, 0)
+            for a in sys.argv[1:]] or DEFAULT_STUBS
+    print(f'{"stub":>12} {"idx@":>12} {"idx":>4} {"table":>12} {"impl":>12}')
+    rows = []
+    for va in args:
+        r = resolve_stub(va)
+        if r is None:
+            print(f'{va:#12x}  PATTERN MISMATCH')
+            continue
+        rows.append(r)
+        print(f'{r["stub"]:#12x} {r["idx_addr"]:#12x} {r["idx"]:4d} '
+              f'{r["tbl_addr"]:#12x} {r["impl"]:#12x}')
+    return rows
+
+
+if __name__ == '__main__':
+    main()

scripts/perfbp.py

@@ -0,0 +1,217 @@
+#!/usr/bin/env python3
+"""perfbp.py — hardware data-breakpoint via perf_event_open (no ptrace).
+Watches READS of the live FIR kernel word across all host threads during
+offline render; collects sampler IPs -> the consumer."""
+import ctypes
+import glob
+import mmap
+import os
+import struct
+import subprocess
+import sys
+import time
+
+PERF_TYPE_BREAKPOINT = 5
+PERF_SAMPLE_IP = 1 << 0
+HW_BREAKPOINT_R = 2
+PERF_RECORD_SAMPLE = 9
+SYS_perf_event_open = 298
+IOCTL_ENABLE = 0x2400  # PERF_EVENT_IOC_ENABLE
+IOC_FLAG_GROUP = 0
+
+
+class PerfAttr(ctypes.Structure):
+    _fields_ = [
+        ('type', ctypes.c_uint32),
+        ('size', ctypes.c_uint32),
+        ('config', ctypes.uint64 if hasattr(ctypes, 'uint64') else ctypes.c_uint64),
+        ('sample_period', ctypes.c_uint64),
+        ('sample_type', ctypes.c_uint64),
+        ('read_format', ctypes.c_uint64),
+        ('flags', ctypes.c_uint64),        # bitfield packed: disabled=bit0 ...
+        ('wakeup_events', ctypes.c_uint32),
+        ('bp_type', ctypes.c_uint32),
+        ('bp_addr', ctypes.c_uint64),
+        ('bp_len', ctypes.c_uint64),
+    ]
+
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def perf_open(tid, addr):
+    a = PerfAttr()
+    a.type = PERF_TYPE_BREAKPOINT
+    a.size = ctypes.sizeof(a)
+    a.config = 0
+    a.sample_period = 1
+    a.sample_type = PERF_SAMPLE_IP
+    a.read_format = 0
+    a.flags = 1 | (1 << 5)            # disabled=1, exclude_kernel=1
+    a.wakeup_events = 1
+    a.bp_type = HW_BREAKPOINT_R
+    a.bp_addr = addr
+    a.bp_len = 4
+    libc.syscall.restype = ctypes.c_long
+    r = libc.syscall(ctypes.c_long(SYS_perf_event_open), ctypes.byref(a),
+                     ctypes.c_int(tid), ctypes.c_int(-1), ctypes.c_uint(-1),
+                     ctypes.c_void_p(0))
+    if r == -1:
+        e = ctypes.get_errno()
+        return None, e
+    return r, 0
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
+                   "rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
+    wav = '/home/m/soothe-bt/dual_b1q_0.5.wav'
+    wt0 = os.path.getmtime(wav) if os.path.exists(wav) else 0
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    def rd(a, n):
+        try:
+            return os.pread(fd, n, a)
+        except OSError:
+            return None
+
+    # wait for instance
+    ctx = firptr = None
+    vt = struct.pack('<Q', 0x1824AC210)
+    while time.time() - t0 < 25 and firptr is None:
+        for line in open(f'/proc/{host}/maps'):
+            parts = line.split()
+            if 'rw' not in parts[1]:
+                continue
+            lo, hi = (int(x, 16) for x in parts[0].split('-'))
+            CH = 16 * 1024 * 1024
+            a = lo
+            while a < hi and firptr is None:
+                d = rd(a, min(CH + 4096, hi - a))
+                if not d:
+                    break
+                j = d.find(vt)
+                while j >= 0:
+                    cand = a + j
+                    sb = rd(cand + 0x540870, 4)
+                    if sb and struct.unpack('<f', sb)[0] > 100:
+                        ctx = cand
+                        firptr = struct.unpack('<Q', rd(cand + 0x540668, 8))[0]
+                        break
+                    j = d.find(vt, j + 1)
+                a += CH
+            if firptr:
+                break
+    print('host %d ctx %#x fir %#x at %.2fs'
+          % (host, ctx or 0, firptr or 0, time.time() - t0), flush=True)
+    if not firptr:
+        return 1
+    watch = firptr + 43 * 8   # bin43 re word
+
+    # attach to all current threads; remember to attach newborns too
+    events = {}
+    errs = {}
+
+    def attach(tid):
+        fde, e = perf_open(tid, watch)
+        if fde is None or fde < 0:
+            errs[e] = errs.get(e, 0) + 1
+            return None
+        events[fde] = tid
+        libc.mmap.restype = ctypes.c_void_p
+        m = libc.mmap(None, 2 * 4096, 1 | 2, 2, fde, 0)  # PROT_R|W, MAP_PRIVATE
+        if m in (None, ctypes.c_void_p(-1).value):
+            return None
+        bufs[fde] = (m, (ctypes.c_char * (2 * 4096)).from_address(m))
+        libc.ioctl.argtypes = [ctypes.c_int] * 3 + [ctypes.c_void_p]
+        libc.ioctl(fde, IOCTL_ENABLE, 0)
+        return fde
+
+    bufs = {}
+    # pick top-CPU thread only (minimise BP resource demand)
+    import time as _t
+    def tcpu(tid):
+        try:
+            f = open(f'/proc/{host}/task/{tid}/stat').read().split()
+            return int(f[13]) + int(f[14])
+        except Exception:
+            return -1
+    tids = [int(os.path.basename(p)) for p in glob.glob(f'/proc/{host}/task/*')]
+    c0 = {t: tcpu(t) for t in tids}
+    _t.sleep(0.4)
+    deltas = sorted(((tcpu(t) - c0.get(t, 0), t) for t in tids), reverse=True)
+    target = deltas[0][1] if deltas else host
+    print('target tid=%d cpuΔ=%s all=%s' % (target, deltas[0], deltas[:6]), flush=True)
+    fde = attach(target)
+    n_ok = 1 if fde is not None else 0
+    print('attached %d fds; errno hist=%s' % (n_ok, errs), flush=True)
+
+    # let render run; drain buffers periodically
+    ips = {}
+    DUR = float(os.environ.get('BP_DUR', '12'))
+    t_end = time.time() + DUR
+    fresh_t = None
+    DATA = 4096
+    while time.time() < t_end:
+        time.sleep(0.05)
+        if fresh_t is None and os.path.exists(wav) and os.path.getmtime(wav) > wt0:
+            fresh_t = time.time() - t0
+            print('wav fresh at %.2fs' % fresh_t, flush=True)
+        for fde, (m, arr) in list(bufs.items()):
+            head, tail = struct.unpack_from('<QQ', bytes(arr[:16]), 0)
+            n = head - tail
+            if n == 0:
+                continue
+            blob = bytes(arr[4096:8192])
+            p = tail % DATA
+            consumed = 0
+            while consumed < n:
+                if p + 8 > DATA:
+                    p = 0
+                typ, misc, recsz = struct.unpack_from('<IHH', blob, p)
+                if recsz < 8:
+                    break
+                rec = blob[p:p + recsz]
+                if typ == PERF_RECORD_SAMPLE and recsz >= 16:
+                    ip = struct.unpack_from('<Q', rec, 8)[0]
+                    if 0x180001000 <= ip < 0x181baa000:
+                        key = ip >> 4 << 4
+                        ips[key] = ips.get(key, 0) + 1
+                adv = max(recsz, 8)
+                consumed += adv
+                p = (p + adv) % DATA
+            struct.pack_into('<Q', arr, 8, head)
+    print('distinct ips:', len(ips), 'total:', sum(ips.values()))
+    for a_, c in sorted(ips.items(), key=lambda x: -x[1])[:20]:
+        print('%#x %d' % (a_, c))
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    main()

scripts/qseries.py

@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+"""qseries.py — run rendersnap across dual_b1q_*.rpp configs, extract steady
+scratch/FIR at bins 43/171 into one table vs the real cuts from NOTES 22x."""
+import glob
+import os
+import subprocess
+import sys
+
+import numpy as np
+
+QS = ['0.1', '0.2', '0.3', '0.5', '0.7', '1.0', '1.5', '2.0', '3.0', '5.0', '10.0']
+REAL = {  # from NOTES_LEVEL 22x table: cut@500, cut@2000
+    '0.1': (10.32, 15.33), '0.5': (10.32, 11.82), '1.0': (10.32, 10.78),
+    '3.0': (10.29, 10.32), '10': (9.94, 10.25),
+}
+RES2000 = {'0.1': 0.216, '0.5': 0.839, '1.0': 1.353, '3.0': 1.880, '10': 1.988}
+
+
+def steady_scratch(tag):
+    fs = sorted(glob.glob(f'/tmp/opencode/rendersnap/phase*.npz'))
+    best = None
+    for f in fs[::-1]:
+        z = np.load(f)
+        sc = z['0x540628']
+        if abs(sc[43]) > 1e-6 and abs(sc[171] - sc[43]) > 1e-6 or (abs(sc[43]) > 1e-6):
+            best = (sc[43], sc[171])
+            if abs(sc[171] - sc[43]) > 1e-4:
+                break
+    return best
+
+
+def main():
+    rows = []
+    for q in QS:
+        rpp = f'/home/m/soothe-bt/dual_b1q_{q}.rpp'
+        if not os.path.exists(rpp):
+            continue
+        subprocess.run(
+            ['timeout', '100', 'python3', '/home/m/re-tools/scripts/rendersnap.py',
+             rpp], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        st = steady_scratch(q)
+        if not st:
+            print(q, 'NO DATA')
+            continue
+        s43, s171 = st
+        f43 = -20 * np.log10(np.exp(0.984 * s43))
+        f171 = -20 * np.log10(np.exp(0.984 * s171))
+        rc = REAL.get(q.rstrip('.0') if q.endswith('.0') else q)
+        row = dict(q=q, scr43=round(s43, 4), scr171=round(s171, 4),
+                   fir43=round(f43, 2), fir171=round(f171, 2),
+                   x18_43=round(f43 * 1.805, 2), x18_171=round(f171 * 1.805, 2))
+        if rc:
+            row['real43'], row['real171'] = rc
+            row['ratio'] = round(rc[0] / f43, 3), round(rc[1] / f171, 3)
+        if q in RES2000:
+            row['res2000'] = RES2000[q]
+        rows.append(row)
+        print(row, flush=True)
+    np.save('/tmp/opencode/qseries.npy', rows, allow_pickle=True)
+
+
+if __name__ == '__main__':
+    main()

scripts/rendersnap.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""rendersnap.py — SIGSTOP-sampling of the plugin state DURING offline render
+(-renderproject): processing is back-to-back, so random stops land inside the
+DSP with high probability. Saves every snapshot where FIR != complex identity.
+"""
+import os
+import signal
+import struct
+import hashlib
+import subprocess
+import sys
+import time
+
+import numpy as np
+
+SLOTS = [0x540548, 0x540550, 0x540598, 0x540628, 0x540668, 0x540678, 0x540688,
+         0x540698, 0x5406a8, 0x5406b8, 0x5406c8, 0x5406d8, 0x5406e8, 0x5406f8,
+         0x540708, 0x540718, 0x540728, 0x540738, 0x540748, 0x540758,
+         0x540768, 0x540778, 0x540788, 0x540798, 0x5407a8, 0x5407b8,
+         0x5407c8, 0x5407d8, 0x5407e8, 0x5407f8, 0x540808, 0x540818,
+         0x540828, 0x540838, 0x540848]
+NARR = 8194
+OUT = '/tmp/opencode/rendersnap'
+
+
+def find_host():
+    import glob
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    rpp = sys.argv[1] if len(sys.argv) > 1 else '/home/m/soothe-bt/dual_b1q_0.5.rpp'
+    nattempts = int(sys.argv[2]) if len(sys.argv) > 2 else 300
+    os.makedirs(OUT, exist_ok=True)
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; sleep 1", shell=True)
+    wav = rpp.replace('.rpp', '.wav')
+    if os.path.exists(wav):
+        os.remove(wav)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', rpp],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.001)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.3fs' % (host, time.time() - t0), flush=True)
+
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    def rd(a, n):
+        try:
+            return os.pread(fd, n, a)
+        except OSError:
+            return None
+
+    ctx = None
+    vt = struct.pack('<Q', 0x1824AC210)
+    m48 = struct.pack('<I', 0x473b8000)
+
+    def scan_ctx():
+        for line in open(f'/proc/{host}/maps'):
+            parts = line.split()
+            if 'rw' not in parts[1]:
+                continue
+            lo, hi = (int(x, 16) for x in parts[0].split('-'))
+            CH = 16 * 1024 * 1024
+            a = lo
+            while a < hi:
+                d = rd(a, min(CH + 4096, hi - a))
+                if not d:
+                    break
+                j = d.find(vt)
+                while j >= 0:
+                    cand = a + j
+                    sb = rd(cand + 0x540870, 4)
+                    if sb and struct.unpack('<f', sb)[0] > 100:
+                        return cand
+                    j = d.find(vt, j + 1)
+                j = d.find(m48)
+                while j >= 0:
+                    cand = a + j - 0x24
+                    sb = rd(cand + 0x540870, 4)
+                    if sb and struct.unpack('<f', sb)[0] > 100:
+                        return cand
+                    j = d.find(m48, j + 1)
+                a += CH
+        return None
+
+    # find-loop: stop-scan-resume until instance exists (render lasts ~0.5s)
+    while ctx is None and time.time() - t0 < 25:
+        try:
+            os.kill(host, signal.SIGSTOP)
+        except ProcessLookupError:
+            break
+        try:
+            ctx = scan_ctx()
+        finally:
+            if ctx is None:
+                try:
+                    os.kill(host, signal.SIGCONT)
+                except ProcessLookupError:
+                    break
+        if ctx is None:
+            time.sleep(0.004)
+    print('ctx %#x' % ctx if ctx else 'NO CTX', flush=True)
+    if not ctx:
+        return 1
+    print('ctx %#x' % ctx if ctx else 'NO CTX', flush=True)
+    if not ctx:
+        return 1
+
+    hits = saved = 0
+    rng = np.random.default_rng(3)
+    prev_sig = None
+    phases = []
+    while True:
+        try:
+            os.kill(host, signal.SIGSTOP)
+        except ProcessLookupError:
+            break
+        try:
+            pb = rd(ctx + 0x540668, 8)
+            if not pb:
+                continue
+            p = struct.unpack('<Q', pb)[0]
+            fb = rd(p, NARR * 4)
+            if not fb:
+                continue
+            arr = np.frombuffer(fb[:2049 * 8], dtype='<f4').astype(np.float32)
+            sig = arr.tobytes()[:4096]
+            rb = rd(struct.unpack('<Q', rd(ctx + 0x5407f8, 8))[0], 2049 * 4)
+            rsig = rb[:512] if rb else b''
+            key = hashlib.md5(sig + rsig).digest()
+            if key != prev_sig:
+                prev_sig = key
+                mag = np.hypot(arr[0::2], arr[1::2])
+                rv = np.frombuffer(rb, dtype='<f4') if rb else None
+                phase = dict(t=round(time.time() - t0, 3),
+                             firMax=float(np.abs(arr[1:2049]).max()),
+                             fir43=float(mag[43]), fir171=float(mag[171]),
+                             r43=float(rv[43]) if rv is not None else -1,
+                             r171=float(rv[171]) if rv is not None else -1)
+                phases.append(phase)
+                store = {}
+                for off in SLOTS:
+                    q = rd(ctx + off, 8)
+                    if not q:
+                        continue
+                    ptr = struct.unpack('<Q', q)[0]
+                    if ptr < 0x10000:
+                        continue
+                    ab = rd(ptr, NARR * 4)
+                    if ab:
+                        store[hex(off)] = np.frombuffer(ab, dtype='<f4').astype(np.float32)
+                fn = f'{OUT}/phase{saved:03d}.npz'
+                np.savez_compressed(fn, **store)
+                saved += 1
+                print('PHASE %s -> %s' % (phase, fn), flush=True)
+                if saved >= 24:
+                    break
+        finally:
+            try:
+                os.kill(host, signal.SIGCONT)
+            except ProcessLookupError:
+                pass
+        time.sleep(float(rng.uniform(0.001, 0.01)))
+        try:
+            os.kill(host, 0)
+        except ProcessLookupError:
+            print('host exited at %.2fs' % (time.time() - t0), flush=True)
+            break
+    print('phases=%d' % saved)
+    os.close(fd)
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())