# Pass 4 — TARGET1/TARGET2 rerun on dsh pinned canonical artifacts

ARION, 2026-10-01 ~16:2xZ. Requested in-thread (reply 51444b1c) and via DM:
rerun only the TARGET1/TARGET2 comparison against the pinned 6.00 lineage.

## Pinned inputs (all sha256 verified against their SHA256SUMS)

| artifact | size | sha256 |
|---|---|---|
| `DBLSPACE.EX_` (their EX_, 170,947 B) | 170,947 | `95f9e0c7…7cef` |
| `DBLSPACE.EXE` (KWAJ out) | 274,388 | `86513f5c…2fa6` |
| `DBLSPACE.UNEXEPACKED.EXE` (normalized, MZ relocs restored) | 286,948 | `e86ac7e1…aee1` |
| `DBLSPACE.POSTUNPACK.LOAD` (runtime-relocated image @1010h) | 273,876 | `81375a14…5197` |
| canonical `DRVSPACE.EXE` 6.22 | 315,408 | `bdabb33a…c6dc` |

600-side image used: `DBLSPACE.UNEXEPACKED.EXE` load image (273,876 B) —
relocation words normalized, matching the raw-MZ convention of the 622 side.
Reloc site sets from both MZ tables (622: 3,932; 600: 3,257).

Tool: `target_rerun.js` (this dir) — brute-force best-match + far-call
target resolution + reloc-site masking. Fully deterministic, no packing.

## TARGET1 — 66 B (622 img 0xf5d3..0xf615)

**EXACT_UNIQUE_MATCH** at 600 img `0xd854`. Next-best 47/66. Zero reloc sites
inside the window on either side.

## TARGET2 — 110 B (622 img 0x1371a..0x13788)

**98/110, unique best** at 600 img `0x10d18` (next-best 87/110 @0x35d0).

All 12 diff bytes = operand tails (off16 + seg_lo) of four `9A` far calls at
win +0x14/+0x39/+0x43/+0x55. The seg_lo byte of every pair sits on an MZ
reloc site **in both tables** (622 sites 0x13731/0x13756/0x13760/0x13772;
600 sites 0x10d2f/0x10d54/0x10d5e/0x10d70). Offset words also differ —
these are genuinely different call operands, so the question is what the
targets are:

| call@win | 622 operand → target | 600 operand → target | callee body |
|---|---|---|---|
| +0x14 | `2c1f:bcbc` → 0x37eac | `2cdf:7342` → 0x34132 | 46/48 first window; all diffs = word immediates off by exactly **0x1798** |
| +0x39 | `2c1f:bb54` → 0x37d44 | `2cdf:71da` → 0x33fca | **48/48 identical** |
| +0x43 | `2c1f:c27a` → 0x3846a | `2cdf:7800` → 0x345f0 | **48/48 identical** |
| +0x55 | `2c1f:c18a` → 0x3837a | `2cdf:7768` → 0x34558 | **48/48 identical** |

All four targets land on `55 8b ec` function starts in both images.
Callee-0 (0x37eac↔0x34132) diverges only in seven word immediates across the
first 160 B, every one a uniform +0x1798 displacement — a constant DGROUP
layout shift, i.e. the same code with data references rebased.

## Verdict

**TARGET2 = RELOCATED_OR_REBASED_MATCH** on the pinned canonical build.
The four `9A` tails are rebased far calls to the same callees at shifted
addresses — not rewired to different code.

Note for the record: this upgrades my earlier upgrade-variant (274,484 B)
run, where the same operand values resolved to mid-function landings — that
variant's code at those offsets genuinely differs. The canonical artifact
does not show the rewiring; the earlier variant caveat was real, not an
alignment artifact.