# Pass 8 — Consumer-side trace of DRVSPACE.EXE event machinery
## Forward trace rooted at 1E98:C005 / injector 2C1F:094C, plus full caller census for TARGET1 (0000:F5D3) and TARGET2 (0FEB:386A)

Baseline: `evidence_v4.sqlite` (Stage30DT Evidence V4 r4), `DRVSPACE.EXE` 315408 B, load image 299648 B.
All addresses are segment:offset in the canonical load layout; DS offsets refer to DGROUP (runtime DS = 0x3E49, established at 1E98:BF74 `mov ax,0x3e49`). Image offset = seg*16+off; DS:x → image 0x3E490+x. DGROUP image data ends at DS:0xADF0; DS ≥ 0xADF0 is BSS.

---

## 1. Injection chain (verification of the established part)

Mouse driver install — 1E98:BCC3..BCE6:
```
1E98:BCC5  CD33        int 0x33                  ; detect
1E98:BCD8  B8981E      mov ax,0x1e98
1E98:BCDB  8EC0        mov es,ax
1E98:BCDD  BA70BF      mov dx,0xbf70             ; handler = 1E98:BF70
1E98:BCE0  B91F00      mov cx,0x1f               ; mask: move,L-down,L-up,R-down,R-up
1E98:BCE3  B80C00      mov ax,0xc
1E98:BCE6  CD33        int 0x33                  ; Set User Event Subroutine
```
1E98:BF70..C004 = `mouse_event_callback_bf70` (retf). Verified: `mov ds:0xad88,bx` (BF79, button mask), `call 0xc010` mickey→char (C010: `mul ds:0xacfa`, `div ds:0xad0c` → `ds:0xad87`; dx → `ds:0x73e4`), then five `test al,bit / mov ax,code / call 0xc005` blocks:
```
bit0 → 0x200 (BFB9..BFC0)   bit1 → 0x201 (BFC3..BFCA)   bit2 → 0x202 (BFCD..BFD4)
bit3 → 0x204 (BFD7..BFDE)   bit4 → 0x205 (BFE1..BFE8)
```
Wrapper 1E98:C005..C00F — verified exactly as reported: `push dx; push ax; call far 2C1F:094C; pop dx; mov al,dl; ret`.

### Call-site census for the injector

Scanning all 92,247 instruction rows for near `E8/E9 rel16`, far `9A ptr32`, and every 2/4-byte pointer materialization in the full 299648-byte load image:

| target | result |
|---|---|
| 1E98:C005 | 5 near calls, all inside BF70 callback: BFC0, BFCA, BFD4, BFDE, BFE8. No far pointer to 1E98:C005 exists anywhere in the image (`05 C0 98 1E` absent; word `05C0` absent). |
| 2C1F:094C | **exactly one** call instruction in the whole image: `1E98:C007 9A4C091F2C call 0x2c1f:0x94c`. No data-side far pointer (`4C 09 1F 2C` appears only inside that instruction at image 0x2A988). |

**Code census reaching 094C:** only {0x200, 0x201, 0x202, 0x204, 0x205}, only via C005, only from the int-33 callback. No keyboard or other code ever reaches 094C.

### Other producers into the same ring system (direct `call 0x9e1` sites — complete: 039A, 03BC, 08B3, 09D7, 0CB2)

| producer | via | queue | codes |
|---|---|---|---|
| 2C1F:094C (mouse injector) | C005←BF70←int33 | B @ ds:0x7140 | 0x200/201/202/204/205 |
| 2C1F:0368 ("synthetic release") | called once at 2C1F:A297, inside modal teardown (guarded by `ds:0x722e≠0`) | B | posts **0x205 then 0x202** back-to-back (0373..03BC), bypassing the callback; updates position globals first via `call 1e98:0xbc82` |
| 2C1F:084D `runtime_callback_084d` | reached only via `call DWORD PTR ds:0x6f5c` at 2C1F:0930, inside `runtime_callback_08ce`; `ds:0x6f5c` is **initialized data = 2C1F:084D** (image 0x453EC: `4D 08 1F 2C`), never rewritten in code | A @ ds:0x705a | key codes 0x101/0x102/0x385; coalesces 0x385 into last queue-A record via ds:0x7228 |
| 2C1F:0C89 `runtime_callback_0c89` | vector slot ds:0x6f3c (init data `89 0C 1F 2C`); invoked by keyboard cooperation layer: `1E98:CF2D call DWORD PTR [bx+0x8]` in `tsr_keyboard_cooperation_callback_cf17` (on AH==2) | A | synthetic **0x102 with aux=0x1B (ESC)** (0C93..0CB2) |

The vector table at ds:0x6F34..6F42 is initialized data (image 0x453C4): `{2C1F:08CE, 2C1F:0CB6, 2C1F:0C89, 1E98:BC8A}` registered at 1E98:BC3A..BC42 (`mov bx,0x6f34; …; call DWORD PTR ds:0x7526` → 1E98:CCCE stores table into the keyboard driver descriptor `cs:0xc9c8`). Entries are invoked as `[bx]`=08CE (key event), `[bx+4]`=0CB6 (queue-status probe — 0CB6 checks queue-A depth and whether last record aux==0x112 F1), `[bx+8]`=0C89 (inject ESC).

---

## 2. Ring/queue structure (from initialized image data, image 0x453BE+)

Three queues, each `{count, head, tail}` header + 16 records × 0xE bytes; empty head = sentinel 0x6F66:

| queue | header | head init | tail init | record extent | role |
|---|---|---|---|---|---|
| C | ds:0x6F74 | 0x6F66 | 0x6F7A | 6F7A..705A | timer/armed pseudo-queue (no in-image producer; see 33A8) |
| A | ds:0x705A | 0x6F66 | 0x7060 | 7060..7140 | keyboard events |
| B | ds:0x7140 | 0x6F66 | 0x7146 | 7146..7226 | mouse events |

- Sentinel record ds:0x6F66 (0xE bytes): timestamp field = `FF FF FF 7F` = 0x7FFFFFFF (proven sentinel: 2C1F:06EB `cmp [bx+0xa],0xffff / cmp [bx+0xc],0x7fff`).
- `ds:0x7226` = last-written queue-B slot (move coalescing); `ds:0x7228` = last-written queue-A slot (0x385 coalescing); `ds:0x722A` = focus window; `ds:0x722E` = capture/modal window; `ds:0x7230/7234` = event-filter hooks (init 2C1F:0C82 = the `ret-0` stub); `ds:0x723A` = 0x000A (double-click tick threshold); `ds:0x723C/723E/723F` = last position; `ds:0x7240` = staged-record flag (record at ds:0xB092, BSS); `ds:0x7244` = 0xFFFE ("timer queue disabled").

Record layout (0xE bytes, proven by enqueue 09E1 field writes at 0A2B..0A51):
`+0` window ptr (filled at dequeue) `| +2` event code `| +4` aux (mouse: button mask|edge flags; kbd: key code) `| +6/+8` position (col/row pair) `| +0A/+0C` 32-bit tick from `2C1F:2AAE` (= `jmp DWORD ds:0x7546` → `1E98:D799`, which cli/reads the BIOS tick dword at `0040:046C` and returns it in dx:ax).

Enqueue `2C1F:09E1`: `[bx]` count++, head=tail if count was 0, tail += 0xE, wrap tail at `bx+0xE6 → bx+6` (09FF..0A20), writes 7 words, `ds:0x7226 = slot` (0A26), returns 1 (0 on count==0x10 full). `call 0x4508/0x450a` = lock/unlock (interrupt mask).
Dequeue `2C1F:074A`: takes header ptr; if `head==ds:0x7226` invalidate `ds:0x7226=0x6f66`; `count--`; count→0 resets `head=0x6f66`; else `head+=0xE` wrap at `bx+0xE6`.

---

## 3. Dequeue / dispatch path

### 3.1 Fetch: `2C1F:05FC` "read raw event" (only caller: 41C2 inside thunk `2C1F:41BA`; 41BA called once from 059A inside `2C1F:0542`)

05FC selects the queue whose head record has the smallest timestamp at +0A/+0C:
- `[bp-4]` = queue-C head = `ds:0x6f76`, or sentinel 0x6F66 when `ds:0x7244==0xFFFE && ds:0x7238==0` (0604..061A)
- `[bp-6]` = queue-A head `ds:0x705c`; `[bp-2]` = queue-B head `ds:0x7142` (061D..0626)
- Timestamp compares at 062F..0657 / 06A9..06BF pick the oldest nonempty head; the chosen record is copied 7 words to caller buffer `[bp+6]` (0666..0675 / 06C1..06D0 / 06FB..0707), then `call 0x74a` dequeues that queue (067B / 06D6 / 070D).
- code==0x385 special-case (0687): aux merged into `ds:0x72ba` via `call 0x41b4`, loop repeats (0691..06A6).
- Queue-C path first calls `2C1F:33A8` (0717): timer-armed check — if `ds:0x73ea` armed code set and tick ≥ `ds:0x73e6/8` deadline, fabricates record `{window=73ea, code=0x1118}` (33C5..33CD). 33A8 called *only* here → code 0x1118 = "armed timer fired".
- **Mouse-queue records then pass two rewrite stages** (06D9..06E3):
  - `2C1F:0AD6` hit-test: if `ds:0x6f64` (window list) empty → `rec[0]=0` (0B00); else `ds:0x722e` capture window wins (0B0E), else `call 0xa92` walks window list `[si+0x16]` hit-testing `[si+4..7]` bounds with flag `0x8000` (0A92..0ACA). On hit: `rec[0]=window` (0B6B), position made window-relative (0B6D..0B79), rec byte +4 gets `0x20` if x outside `[di+8..0xA]`, `0x40` if y outside `[di+9..0xB]` (0B7F..0B9D).
  - `2C1F:0BB5` double-click synth: if position unchanged since last (vs ds:0xACFE/AD00) and code==0x201 and `rec.ts − ds:0x72bc/e < ds:0x723a(10)` → **code := 0x203** (0C1C); same for 0x204 → **0x206** (0C61). Otherwise stores ts into the 0x72bc/0x72c0 pairs.

### 3.2 Outer pump: `2C1F:0542` "get_message" — exactly 4 call sites

| site | context |
|---|---|
| `2C1F:A435` | **SDM modal event pump**, function `2C1F:A125` (called only from `2C1F:67F0`, inside `invoke_sdm_dialog_template`/`construct_sdm_dialog_window` machinery). Saves window-list/modal/focus globals (A130..A14E), loops A42F..A55C, restores at A23B..A2C6. |
| `0FEB:7063` | minimal loop inside function `0FEB:7046` (just below `ui_state_callback_01` 0FEB:6E26): `call 0x2c1f:0x542; if ax → call 0x2c1f:0x442` — pure dispatch (705F..707B). |
| `0000:B08E` | drain loop inside function `0000:AFA7` (`execute_size_command` neighborhood): pumps events into BSS record ds:0xC41A during a long operation; code 0x102 or 0x200 terminates/stages, others re-staged via `call 0x2c1f:0x302` (stage_event → ds:0xB092 + flag 0x7240). |
| `0000:293B` | key-wait loop inside function `0000:280C`: `call 0x542` into `[bp-0x220]`; consumes code 0x102 with aux ∈ {0x0D Enter, 0x1B Esc, 0x172}; on other codes → `call 0x2c1f:0x442` (29D0). |

Inside 0542 (0547..05F9): optional `call 1e98:0xbc57` (mouse poll → `[ds:0x6f2e]` = 1E98:BC5B → `[ds:0x752a]` = 1E98:CAB6) when `ds:0x6f46`; staged-record priority (ds:0x7240 → copy ds:0xB092 record); for staged codes ≤0x102 (`cmp ds:0xb094,0x102; ja` at 0578..0586) `rec[0]` is preset to the focus window `ds:0x722a` (0588..058D); **filter hooks**: unless code==0x100E (05A8), `call DWORD PTR ds:0x7230` then `call DWORD PTR ds:0x7234`, each nonzero → retry loop 0547 (05AF..05C1); then if all queues empty → return via "events pending" flag ds:0x6f62.

### 3.3 Filter hook ds:0x7230 — the app-level preprocessor

Installed/restored by `2C1F:0DC8` (arg!=0 → `2C1F:9817`; arg==0 && was-installed → stub `2C1F:0C82`; also switched to `2C1F:A730` inside the modal loop at A221/A400..A406, restored A24B). **`2C1F:9817` = application event filter** (9817..9ED9): reads record directly (si=rec):
- `ds:0x722e≠0` → pass-through return 0 (9822..982B).
- code 0x204 or 0x206 (right button/dblclick) && `!(ds:0xcbf0 & 2)` → `call 0x8c62` (context menu popup) then return 0-consume (985C..9874).
- codes 0x200..0x203 && `ds:0x7242≠0` → `call 0x97b2` hit-target resolve; 0x201/0x203 → menu-tracking activation (98B0+).
- code 0x1118 → menu accelerator dispatch `ds:0x732e` switch → 0x9006/0x8ed8/0x302 (9B2B..9BBE).
- code 0x101 && `ds:0x7332==0x112 && rec+4==0x112` && `ds:0x7326!=0xffff` → F1 help path (9BC8..).
- code==0 && `ds:0x7244!=0xfffe` → timer-submenu housekeeping via 0x86ad/0x513 (9B75..9BAA).

### 3.4 Terminal dispatch: `2C1F:0442` / `2C1F:0470`

```
2C1F:044A  mov si,[bp+6]         ; record
2C1F:044D  mov di,[si]           ; rec[0] = hit window (or 0)
2C1F:0453  push di
2C1F:0454  push word [si+2]      ; code
2C1F:0457  push word [si+4]      ; aux
2C1F:045A  push word [si+8]      ; pos hi
2C1F:045D  push word [si+6]      ; pos lo
2C1F:0460  call DWORD PTR [di+0x10]   ; window proc
```
`2C1F:0470` (`call_window_message_callback`) is the same primitive with explicit args: `call DWORD PTR [bx+0x10]` (bx = window at [bp+0xe]). Window procs are far pointers stored at `[w+0x10]/[w+0x12]`; every in-image install site is enumerated:

| store site | proc installed |
|---|---|
| 2C1F:6C01/6C06 | 2C1F:1854 `installed_window_callback_2c1f_1854` |
| 2C1F:6AE6 | 2C1F:43F8 `installed_window_callback_2c1f_43f8` |
| 2C1F:6CE6 | 2C1F:344C `installed_window_callback_2c1f_344c` |
| 2C1F:6D5F | 2C1F:4982 `installed_window_callback_2c1f_4982` |
| 2C1F:6DD0 | 2C1F:292E `installed_window_callback_2c1f_292e` |
| 2C1F:6EAB | 2C1F:40DA `installed_window_callback_2c1f_40da` |
| 2C1F:69FD | 2C1F:A8B3 `installed_window_callback_2c1f_a8b3` |
| 0000:BEDA/BEDF | 0000:BD8A `dialog_control_callback_0000_bd8a` (seg 0000) |
| 0000:CCCE / 0000:CCE3 | 0000:CB34 / 0000:CB80 |
| 0FEB:880B | 0FEB:8672 |
| 1E98:154D | 1E98:13A9 |
| register-sourced (`mov [x+0x10],ax/cx`): 0000:274C, 0FEB:00B3, 1E98:C56F, 1E98:D117, 0000:33D9 — values computed elsewhere; see §5 caveat |

### 3.5 Code → handler routing (modal pump 2C1F:A125, event at [bp-0x1e], code=[bp-0x1c]=rec+2)

| code | routing |
|---|---|
| 0 | ignored (A43C) |
| 0x100E | `push rec+4; call 0x17cc` (A442..A44E) — async completion/timer cookie |
| 0x200..0x209 with rec[0]==0 | `rec[0]=si` (current window), rec+4 byte `|=0x60` (A466..A47D) |
| 0x102 && rec+4==0x112 && `ds:0xb090==0` | `call 0xae9a` — help trigger (A481..A49D) |
| 0x201 && `ds:0xc406` set && hit window not in dialog subtree | `call 0470(bx, msg=0x372, 0,0,0)` (A4A0..A4DC) — "click-outside" notify |
| 0x102 (residual) | accelerator `call 0xac7a(rec+4)` twice; if unhandled → `0470(si,0x102,rec+4,rec+8,rec+6)` (A4E1..A534) or `0442` (A4FF) |
| default | `call 0x442` → `[rec[0]+0x10]` window proc with (win, code, aux, pos_hi, pos_lo) (A536..A53C) |

So codes 0x200..0x206 are delivered **verbatim** as window message codes to the hit-tested window's proc; 0x203/0x206 exist only as the 0BB5 rewrite products.

---

## 4. One level deeper — what 0x201 causes

Concrete destination `installed_window_callback_2c1f_1854` (proc switch on `[bp+0xc]`): `0x0F→1930, 0x200→1A6F, 0x201→19F0, 0x202→1BD8, 0x203→19F0, 0x1118→1B60, default→return 0`.

`0x201` handler at 2C1F:19F0:
```
19F0  mov WORD ds:0x72dc,1        ; mouse-grab/armed flag
19F9  call 0x41f                  ; (focus/grab maintenance)
19FC  rec+6-derived column → ds:0xad4c; rank vs sub-geometry → ds:0xad4a ∈ {0,1,2,3}
1A46  push [si+0x14]              ; child/control window
1A49  push [bp-0xc]; push ds:0xad4a; push si-derived; push 0
1A5A  call 0x470                  ; forwards msg 0x9 ("button pressed") to child proc
```
i.e., 0x201 = left-button-press → mark grab, sub-control hit-rank → notify child window via `call_window_message_callback` msg 9. (The 0x200 case at 1A6F tracks hover/leave via `ds:0x72dc`/`ds:0xad48`; 0x202 at 1BD8 is release/commit.) Equivalent compare-chains exist in procs 2C1F:344C (36DC/36E4/36EC), 2C1F:4982 (507E..5096, 4BA4), 2C1F:2391 (23CC, 2832..2851), and `sdm_modal_event_callback` 74CC (74E8/74F0/74F8 for 0x206/0x200/0x202) — all message-level handlers of the same code family.

---

## 5. KEY QUESTION — reachability of TARGET1 / TARGET2

### Targets (bytes from `semantic_spans`, both flagged `CODE / NO_KNOWN_ROOT`, both `residual_islands` members: image 0xF5D3..0xF615 and 0x1371A..0x13788)

**TARGET1 `0000:F5D3..F614` (66 B)** — byte-exact decode:
```
F5D3 push bp; mov bp,sp; sub sp,2
F5D9 mov ax,[bp+8]; mov [bp-2],ax          ; save arg2 base
F5DF jmp F5F0
F5E1 mov al,[bx]; mov bx,[bp+6]; cmp [bx],al; jne F5F8
F5EA inc [bp+8]; inc [bp+6]
F5F0 mov bx,[bp+8]; cmp byte [bx],0; jne F5E1   ; while *s2: compare
F5F8 mov bx,[bp+8]; mov al,[bx]; mov bx,[bp+6]; cmp [bx],al; jne F609
F604 mov ax,0xFFFF; jmp F60F                 ; equal → FFFF
F609 mov ax,[bp+8]; sub ax,[bp-2]            ; else first-diff index
F60F mov sp,bp; pop bp; retf 4
```
Two near-pointer string args, retf 4 — exactly the reported strcmp-like signature.

**TARGET2 `0FEB:386A..38D7` (110 B)** — byte-exact decode:
```
386A push bp; mov bp,sp; sub sp,4; mov word [bp-2],0
3875 mov bx,[bp+8]; mov byte [bx],0          ; *buf=0
387B push [bp+6]; call 2C1F:BCBC; pop bx     ; _getenv(name) — BCBC iterates env table ds:0x75d7, '=' compare at BCEE
3884 or ax,ax; je 38B8                       ; not found → ret 0
3888 mov bx,ax; cmp byte [bx],0; je 38B8
388F cmp byte [bx],0x2A; jne 3899            ; '*'
3894 mov byte [bx],0; jmp 38B3               ; leading '*' → empty buf, flag=1
3899 cmp byte [bx+1],0x3A; jne 38B8          ; require value[1]==':' (X: drive form)
389F push bx; push [bp+8]; call 2C1F:BB54    ; crt__strcpy
38AA push [bp+8]; call 2C1F:C27A             ; crt__strupr
38B3 mov word [bp-2],1
38B8 push 0x3B; push [bp+8]; call 2C1F:C18A  ; crt__strchr(buf,';')
38C6 or ax,ax; je 38CF; mov bx,ax; mov byte [bx],0  ; truncate at ';'
38CF mov ax,[bp-2]; mov sp,bp; pop bp; retf 4
```

### Caller census — the decisive evidence

Across all 92,247 instruction rows and all 299,648 image bytes:

| channel | TARGET1 0000:F5D3 | TARGET2 0FEB:386A |
|---|---|---|
| near `E8` call / `E9` jmp in own segment | 0 | 0 |
| far `9A` call anywhere | 0 | 0 |
| any instruction byte occurrence of word 0xF5D3 / 0x386A (immediates, displacements) | 0 | 0 |
| far-pointer materialization `D3 F5 00 00` / `6A 38 EB 0F` in all represented+opaque image bytes | 0 | 0 |
| bare offset words `D3 F5` / `6A 38` anywhere in the image (jump tables, near-ptr slots) | **0** | **0** |
| `mz_relocations` entries with `offset` = 0xF5D3 / 0x386A | 0 | 0 |
| `functions` / `research_findings` xref entries for the targets | none | none |

The word value 0xF5D3 does not appear even once in the entire load image; likewise 0x386A. **No instruction, no table, no pointer slot, and no relocation references either target.** The established `[w+0x10]` window-proc install constants (§3.4) are all non-target. The event-path indirect-call globals are fully enumerated and non-target: `ds:0x6f5c`=2C1F:084D; `ds:0x7230` takes only the values 2C1F:0C82 (stub, init + 0E0C store), 2C1F:9817 (app filter, store at 0DF2 `mov WORD ds:0x7230,0x9817` with seg word `ds:0x7232=0x2c1f` at 0DF8), and 2C1F:A730 (modal-loop filter, A221/A400..A406); `ds:0x7234`=2C1F:0C82; the `ds:0x7522..0x755e` vector block → 1E98:Cxxx/Dxxx entries; `ds:0x6f2e`=1E98:BC5B.

### Verdict

**NEGATIVE — no rooted consumer path to TARGET1 or TARGET2 exists.** This is stronger than "no path through the event machinery": there is no path *from anywhere* — the static caller census is empty over every representable channel (direct near/far calls, immediate materialization, data pointers, relocation slots). Both routines sit physically inside the migration/CONFIG.SYS-rewrite code cluster (T1 between the function ending at 0000:F5D2 and the called-from-migration-callbacks function at 0000:F615; T2 immediately after `prepare_config_sys_migration_rewrite` 0FEB:3731) — consistent with ownerless install-time helpers — but even there, nothing calls them.

Residual (honest) avenues that static analysis cannot exclude:
1. **Runtime-computed entry**: an indirect `call [reg+disp]`/`call dword [mem]`/`retf` whose target is constructed arithmetically (not stored as a literal). Four register-sourced `[w+0x10]` installs (0000:274C, 0FEB:00B3, 1E98:C56F, 1E98:D117, 0000:33D9) plus the `ds:0x752x`/`ds:0x6f5c` vectors are the plausible carriers; all enumerated *values* are non-target, and no code computes 0xF5D3/0x386A from a base+offset either (no instruction contains either constant, so any such computation would have to synthesize the value from unrelated arithmetic — no evidence of that).
2. **External/patched callers** — out of scope per the contract's own caveat ("does not exclude external or patched runtime callers").

The deciding runtime check: entry watchpoints on 0000:F5D3 and 0FEB:386A across a full UI session (all menus + mouse + keyboard + the migration states that host the neighboring code). The audited sidecar already reports **0 target hits** across 5 runs (18 direct-entry union, 10 producer-site union), consistent with — but not proving — dormancy. A definitive dynamic closure would additionally log every write to the five register-sourced `[w+0x10]` sites and the `ds:0x7230/0x7234` hooks to prove no runtime-installed proc equals the targets.

---

## 6. Evidence — reproduction

All queries/tools run against `evidence_v4.sqlite`; Node.js used for byte scans (no python3 on this machine). Disasm text = `text_dictionary` join on `objdump_text_id`.

```sql
-- A. range disassembly used for every citation above
SELECT i.segment, i.ip, hex(i.bytes), t.text
FROM instructions i JOIN text_dictionary t ON t.id=i.objdump_text_id
WHERE i.segment=? AND i.ip BETWEEN ? AND ? ORDER BY i.ip;

-- B. target span bytes + semantic status
SELECT id, space, printf('%X',start), printf('%X',end), semantic_type,
       reachability, hex(bytes) FROM semantic_spans
WHERE id IN ('principal_semantic:0001','principal_semantic:0002');
--  -> principal_semantic:0001 CS0000 F5D3 F614 CODE NO_KNOWN_ROOT 66 bytes
--  -> principal_semantic:0002 CS0FEB 386A 38D7 CODE NO_KNOWN_ROOT 110 bytes

-- C. residual membership
SELECT * FROM residual_islands;   -- rows 62931..62997 (=0xF5D3..0xF615) and 79642..79752 (=0x1371A..0x13788)

-- D. relocations at exact target offsets (returned 0 rows)
SELECT image_offset, offset, segment FROM mz_relocations
WHERE offset=0xF5D3 OR offset=0x386A;

-- E. initialized globals (callback vectors, queue headers)
SELECT image_start, hex(bytes) FROM reconstruction_layout
WHERE image_start=0x453BE;   -- covers DS:0x6F2E..0x7575
```

Node scans (scripts under `/workspace/research/dsh-trace/`):
- `callers.js SEG IP` — enumerates every `E8`/`E9` rel16 (target=(ip+3+rel)&0xFFFF, same segment) and `9A off:seg` in all 92,247 rows.
- `reffind.js HEXOFF` — finds any instruction whose byte string contains the 2-byte LE value (catches `mov/push imm`, displacements).
- `dataptr.js` — searches every `semantic_spans.bytes` blob for `D3F5`, `6A38`, `D3F5 0000`, `6A38 EB0F`, and lists `mz_relocations` near the target ranges.
- `fullscan.js` — rebuilds the entire 299,648-byte image from `reconstruction_layout` and scans for the same patterns (covers opaque/preserved bytes too). Result: zero hits for every pattern.
- `cmps.js HEXVAL` — instruction census of a given imm16 in operand text (used for the code-value dispatch surface: 0x200..0x206, 0x100..0x102, 0x385, 0x100E, 0x372, 0x1118).

Call-site tables (verbatim outputs):
- `node callers.js 1E98 C005` → {BFC0,BFCA,BFD4,BFDE,BFE8} only.
- `node callers.js 2C1F 094C` → {1E98:C007} only.
- `node callers.js 2C1F 09E1` → {039A,03BC,08B3,09D7,0CB2}; `074A` → {067B,06D6,070D,081B,083A,0CF8}; `05FC` → {41C2}; `0542` → {0000:293B, 0000:B08E, 0FEB:7063, 2C1F:A435}; `0AD6` → {06DD}; `0BB5` → {06E3}.
- `node callers.js 0000 F5D3` → ∅ ; `node callers.js 0FEB 386A` → ∅.