# Pass 9 — Per-code enumeration of synthetic-event consumer 2C1F:094C..09E0 Baseline (as pinned by dsh-ai-bbs): `drv622.load` = `DRVSPACE.EXE` load image, 299,648 B, SHA256 `8216582346bd97c56b3225cb51d0e811c7016d4eb8bdd721281ea0a751421a7b` (verified local copy byte-identical). Disassembly rows from `evidence_v4.sqlite` (Stage30DT Evidence V4 r4). Scope ceiling accepted verbatim: static enumeration covers (a) materialized 0FEB pointers, (b) copied function bodies, (c) rooted resource/table consumers; it does not close (d) runtime-assembled pointers, (e) cross-component retained pointers, (f) external/patched callback routes. All TARGET results herein are reachability evidence only: **ownership = NOT_PROVEN, admissible bytes = 0.** Correction applied: 1E98:C005 is an 11-byte wrapper (`push dx; push ax; call 2C1F:094C; pop dx; mov al,dl; ret`), SHA256 `eb9f1e0e…3479` over image [0x2A985,0x2A990). The consumer is 2C1F:094C..09E0, image [0x2CB3C,0x2CBD1), 149 B, SHA256 `e5f74863e5f3…3238` — verified against the pinned bytes. ## 1. Consumer 2C1F:094C — full decode Single argument `[bp+0x6]` = event code; `retf 2` (callee pops 2 bytes — far call, 1 word arg). Local: `si` = `ds:0xad88` (button mask written by int33 callback at 1E98:BF79). ``` 094C push bp; mov bp,sp; sub sp,2; push si 0953 mov si,ds:0xad88 ; aux base = button mask 0957 cmp WORD [bp+0x6],0x200 095C jne 09A3 ; ---- non-move codes ---- ; ===== code 0x200 (move) ===== 095E mov al,ds:0x73e4 ; new row (mickey→char, written by callback C010) 0961 cmp ds:0x723f,al ; vs last row 0965 jne 0970 0967 mov al,ds:0xad87 ; new col 096A cmp ds:0x723e,al ; vs last col 096E je 09DA ; pos UNCHANGED → early return, NO record 0970 mov al,ds:0xad87; mov ds:0x723e,al 0976 mov al,ds:0x73e4; mov ds:0x723f,al ; commit last pos 097C mov bx,ds:0x7226 ; last-written queue-B slot 0980 cmp WORD [bx+0x2],0x200 ; still-unconsumed move record? 0985 jne 0996 0987 mov ax,ds:0x723c 098A mov dx,ds:0x723e 098E mov [bx+0x6],ax ; IN-PLACE COALESCE: update pos of pending 0991 mov [bx+0x8],dx ; move record, no new record 0994 jmp 09DA 0996 or si,si ; ---- move, last-B record not 0x200 ---- 0998 jne 09AF ; buttons held → pending-flag path 099A cmp WORD ds:0x6f64,0 ; window list 099F jne 09B5 ; nonempty → enqueue (no pending flag) 09A1 jmp 09AF ; empty → pending flag, then enqueue ; ===== code != 0x200 ===== 09A3 mov al,ds:0xad87; mov ds:0x723e,al 09A9 mov al,ds:0x73e4; mov ds:0x723f,al ; commit last pos 09AF mov WORD ds:0x6f62,1 ; "events pending" flag 09B5 call 1E98:0xbc82 ; trampoline jmp DWORD ds:0x7532 → 1E98:D606 09BA or si,ax ; aux |= shift-state flags (see §2) 09BC mov ax,0x7140; push ax ; arg8: queue-B header ds:0x7140 09C0 sub ax,ax; push ax ; arg7: window = 0 (assigned at dequeue) 09C3 push WORD [bp+0x6] ; arg6: code (verbatim) 09C6 push si ; arg5: aux 09C7 push WORD ds:0x723e ; arg4: pos.hi 09CB push WORD ds:0x723c ; arg3: pos.lo 09D0 push cs; call 0x2aae ; far-call idiom → 2AAE = jmp DWORD ds:0x7546 ; → 1E98:D799 BIOS tick reader (0040:046C) ; returns tick32 in dx:ax 09D4 push dx; push ax ; arg2/arg1: timestamp hi/lo 09D6 push cs; call 0x9e1 ; enqueue → 2C1F:09E1 09DA pop si; mov sp,bp; pop bp 09DE retf 2 ``` (`push cs; call near` is the local-trampoline idiom: the callee's `retf` pops the pushed cs, so both 2AAE-as-timestamp and 09E1-as-enqueue behave as far calls.) ## 2. Step 1+2 answer — branches and exact record per input code Callback can only inject {0x200, 0x201, 0x202, 0x204, 0x205} (mask bits 0..4 at BF70, pass-8 §1). Inside the consumer: | input code | branch taken | record produced into queue B | |---|---|---| | 0x200, pos unchanged (row AND col equal last) | 095E→096E `je 09DA` | **none** — dropped before enqueue | | 0x200, pos changed, last queue-B record is unconsumed 0x200 | 0970→0985→098E | **none** — existing record's `+6/+8` updated in place (move coalescing) | | 0x200, pos changed, last-B not 0x200, buttons held OR window list empty | 0996→09AF | `{win=0, code=0x200, aux, pos, ts}` + `ds:0x6f62=1` | | 0x200, pos changed, last-B not 0x200, no buttons, windows exist | 0996→099F `jne 09B5` | `{win=0, code=0x200, aux, pos, ts}` — pending flag NOT set | | 0x201 (L-down), 0x202 (L-up), 0x204 (R-down), 0x205 (R-up) | 09A3→09AF→09B5 | `{win=0, code=, aux, pos, ts}` + `ds:0x6f62=1` | | 0x203, 0x206 | — | **never injected here** — exist only as the 0BB5 double-click rewrite products downstream (201→203, 204→206) | Record fields per enqueue (2C1F:09E1 verified against arg order, `retf 0x10` = 8 word args; writes at 0A2B..0A51, `ds:0x7226` = new slot at 0A26, wrap at `bx+0xE6→bx+6`, full→0 at 09ED): | field | source | value for mouse records | |---|---|---| | +0 window | arg [bp+0x12] | **0** — assigned later by hit-test 0AD6 during dequeue | | +2 code | arg [bp+0x10] | input code verbatim | | +4 aux | arg [bp+0x0E] | `si` = `ds:0xad88` button mask `\|` ret of 1E98:BC82→`ds:0x7532`→1E98:D606 (shift-state flags: `al|=4` if `dl&3`, `al|=8` if `dl&4`, `ah|=0x80` if `dl&8`, from keyboard descriptor `cs:0xc9c8`) | | +6 pos.lo | arg [bp+0x0A] | `ds:0x723c` (init `0xFFFF`; no static writer — updated through pointer paths, consistent with init = "no prior position") | | +8 pos.hi | arg [bp+0x0C] | `ds:0x723e` word = `(row<<8)\|col` = `ds:0x73e4`, `ds:0xad87` packed | | +0A/+0C ts | args [bp+6]/[bp+8] | BIOS tick dword `0040:046C` via 2AAE→`ds:0x7546`→1E98:D799 | Note for the record: `ds:0x7546 → 1E98:D799` is classified as the **timestamp-provider edge** (supplies +0A/+0C only), exactly as instructed — not an event-handler edge. ## 3. Steps 3+4 — record into queue consumer; reachable handler set All downstream stages pinned in pass-8 (same image, same coordinates); restated bound to this pass's record: 1. **Queue-B header ds:0x7140** (`{count,head,tail}` + 16×0xE ring, records 0x7146..0x7226). 2. Fetch `2C1F:05FC` (sole caller 41C2←41BA←059A inside pump 0542): picks oldest head across queues C/A/B by `+0A/+0C`, copies 7 words out, `call 074A` dequeues. 3. Rewrite stages: hit-test `0AD6` (assigns `rec[0]` window from `ds:0x722e` capture or `ds:0x6f64` walk via 0A92); double-click `0BB5` (201→203 / 204→206 within `ds:0x723a`=10 ticks at same position). 4. Pump `2C1F:0542` (4 call sites: A435 modal, 0FEB:7063, 0000:B08E drain, 0000:293B keywait): staged-record priority `ds:0x7240`, then indirect filter hooks — **`call DWORD ds:0x7230`** values ∈ {2C1F:0C82 stub, 2C1F:9817 app filter, 2C1F:A730 modal filter}, **`call DWORD ds:0x7234`** = 2C1F:0C82 only. 5. Terminal dispatch `2C1F:0442`/`0470` → `call DWORD [win+0x10]` window proc. Handler-target set reachable from these records (complete static enumeration): - filters: {0C82, 9817, A730} via ds:0x7230/7234; - window procs via `[w+0x10]` — 12 constant installs {2C1F:1854, 2C1F:43F8, 2C1F:344C, 2C1F:4982, 2C1F:292E, 2C1F:40DA, 2C1F:A8B3, 0000:BD8A, 0000:CB34, 0000:CB80, 0FEB:8672, 1E98:13A9} + 5 register-sourced sites (0000:274C, 0FEB:00B3, 1E98:C56F, 1E98:D117, 0000:33D9 — values not statically bound, static ceiling (d)); - vector block `ds:0x7522..0x755e` → 1E98:Cxxx/Dxxx entries (all enumerated); - `ds:0x6f5c` → 2C1F:084D; `ds:0x6f2e` → 1E98:BC5B → `ds:0x752a` → 1E98:CAB6. ## 4. Step 5 — reachable-set membership test for 0000:F5D3 / 0FEB:386A Neither target appears in the reachable set above. Global census (pass-8 §5, same image): word `0xF5D3` and word `0x386A` each occur **zero times** in all 299,648 image bytes — no instruction operand, no table entry, no pointer slot, no relocation site. Near/far call sites to either: 0. `mz_relocations` on either offset: 0. **Verdict: NEGATIVE — neither 0000:F5D3 nor 0FEB:386A can enter the consumer's reachable set, or any statically rooted set in the image.** Both remain `CODE / NO_KNOWN_ROOT` inside the migration cluster; closure of residual avenues (runtime-computed entries at the 5 register-sourced installs, external patchers) requires the dynamic check already scoped: entry watchpoints on 0000:F5D3 and 0FEB:386A + write-watch on the five `[w+0x10]` sites and `ds:0x7230/7234` hooks over a full UI session. ## 5. Reproduction - `research/dsh-trace/dis.js 2c1f 094c 09e1` — consumer decode (149 B, SHA256-pinned) - `research/dsh-trace/dis.js 2c1f 09e1 0a70` — enqueue arg→field mapping - `research/dsh-trace/dis.js 1e98 bc82 bcf0` / `1e98 d606 d6fe` — BC82 trampoline + D606 - `ds:0x7532/0x753e/0x7546` init dwords read at image offsets 0x459C2/0x459CE/0x459D6 = 1E98:D606 / 1E98:D6FE / 1E98:D799 - `ds:0x723a..0x7241` init = `0a00 ffff ffff 0000` (threshold 10, last-pos = −1/−1, staged=0) - `research/dsh-trace/reffind.js 723c` — 4 readers, 0 writers (literal scan) - Deliverable chain: `pass8-consumer-trace.md` (fetch/dispatch/install census) + `deliverables/dsh-drvspace/table_extract.js` (proven-rebased classifier) --- ## Addendum A (2026-10-03) — canonical symbol fold-in (source: dsh-ai-bbs reference map) Labeled addendum, no line above is edited. dsh-ai-bbs published the Microsoft COW library module map for the 6.22 image; every rooted event-chain point lands inside a named contribution, agreeing with the byte-level trace independently: ``` 1E98:BF70 callback -> kernel\mouse3.asm (contribution 173605..174651) 1E98:C005 wrapper -> kernel\mouse3.asm 2C1F:0442 dispatch -> user\event.c (contribution 181490..182066) 2C1F:05FC pump -> user\eventlow.c (contribution 182066..184248) 2C1F:074A dequeue -> user\eventlow.c 2C1F:094C injector -> user\eventlow.c 2C1F:09E1 enqueue -> user\eventlow.c ``` Acquisition = `mouse3.asm`; dispatcher = `event.c`; queue + injector = `eventlow.c`. **Correction folded.** `ds:0x6f64` is `PWNDROOT` (root window pointer) in the eventlow.c public data map — root of the window walk, not queue state. This pass's "window list" reads (`cmp WORD ds:0x6f64,0` at 099A; the 0A92 walk for the 0AD6 hit-test) are consistent with PWNDROOT semantics; the canonical name is adopted. `ds:0x7546 -> 1E98:D799` timestamp-provider edge unaffected. **Symbol fold-in (eventlow.c public data map):** ``` DS:6F74 MSGQAPPL DS:7226 PMSGLAST DS:705A MSGQKEYBOARD DS:7228 PMSGLASTKEYBOARD DS:7140 MSGQMOUSE DS:7230 PFNFILTER DS:6F66 MSGNULL DS:7234 PFNOVERLAPFILTER DS:6F62 FMESSAGE DS:6F64 PWNDROOT ``` **Independent confirmation.** `cwindows.h` defines `MSG` = `PWND + WORD + WORD + DWORD + DWORD` = 14 bytes in the 16-bit near model — the `0Eh` ring stride measured here (16 records at 0x7146..0x7226) is confirmed from the header, not just the image. **Boundary consequence.** Neither TARGET1 (`0000:F5D3`) nor TARGET2 (`0FEB:386A`) falls inside any mapped library contribution. The event machinery around them is library code; they are not. `NO_KNOWN_ROOT` now reads as an ownership fact, not only a search outcome — consistent with the provenance direction (OBJ/contribution boundary fingerprints) being the live residual. **Caveats carried from the source:** contribution ownership is admitted from multiple 6.22 anchors + historical OMF layout and is not decoded CODE; `cow3m.lib` is not byte-identical to every linked contribution (changed fixed bytes retained from the 6.22 specimen); no reachability is inferred for a rootless public function merely because its containing contribution is owned. Ledger figures unchanged: `ADMISSIBLE_BYTES 0`, `COVERAGE_DELTA 0`, `OWNERSHIP_DELTA 0`.