# USB negative fault-injection Release matrix

Date: 2026-07-30

## Candidate and target identity

- Debug S-record SHA-256:
  `2E2FFFD6B4CA0A03F9DBF488BDD57437B258686A31692F475E7923949004FB11`
- Release S-record SHA-256:
  `F7B807A61336996DBD8686C04E1FEA6881D0907653A0B3F48DDBFCD9BDAFF56B`
- Final A/B full 4 MiB flash SHA-256:
  `DF4945DD3B20F1779A7CB8D1093B9870EE89132FF904D003612E85C0E5E3D309`
- Controller A: assembly `1751136`, J-Link `69664082`
- Controller B: assembly `1751219`, J-Link `69660123`
- Controller A SD: SanDisk/WD, MID `0x03`, OEM `SD`, product `SS08G`,
  revision `8.0`, serial `2540634244`, manufactured `2024-05`, raw CID
  `035344535330384780976F0084018559`
- Controller B SD: SanDisk/WD, MID `0x03`, OEM `SD`, product `SS08G`,
  revision `8.0`, serial `2540634245`, manufactured `2024-05`, raw CID
  `035344535330384780976F0085018507`
- Both post-deploy captures reported protocol status `6`, CID valid `1`,
  representative-sector-read status `0`, raw HPT media state `5`, media
  status `0`, and system errors `0`. The raw media was open and the chart
  cache was complete; the representative-sector flag had not been asserted
  in the early post-reboot capture.
- USB specimen: `USB04_32G`, serial `071C49DE246A1F97`

## Guard contract

The target exposes seven one-shot qualification cases. A case can execute only
when the exact arm word `0x55464941`, a known command, and a nonzero remaining
count coexist. Consumption decrements the count and clears the arm word.
Telemetry records command, remaining count, observations, and last status.
Production behavior is unchanged when the arm word is absent.

Static gates prove the guard, cases, fatal/compatibility classifications,
post-START-STOP compatibility refresh, checksum failure, and remount failure.
The USB transaction inventory and both canonical builds passed.

## Matrix

Each case ran on Controller A using the 8,388,864-byte image workflow and on
Controller B using the 225-byte PID workflow through the same durability
function.

| Injected case | Required result | A | B |
| --- | --- | --- | --- |
| SYNCHRONIZE CACHE timeout | fatal; no compatibility or VBUS cycle | PASS | PASS |
| SYNCHRONIZE CACHE malformed sense | fatal; no compatibility or VBUS cycle | PASS | PASS |
| SYNCHRONIZE CACHE Medium Error | fatal; no compatibility or VBUS cycle | PASS | PASS |
| START STOP ILLEGAL REQUEST | compatibility; 10-second drain; fresh verified session | PASS | PASS |
| START STOP timeout | fatal before VBUS removal | PASS | PASS |
| Post-remount checksum mismatch | failed durability; never successful | PASS | PASS |
| Forced remount failure | failed durability; later mounted recovery | PASS | PASS |

Every case was observed exactly once with remaining count zero. Fatal sync
cases retained a clear compatibility flag and zero power cycles. The lifecycle
compatibility case incremented the count, power-cycled once, advanced media
generation, remounted at acceptance mask `15`, and verified the entire file.
Timeout, checksum, and remount cases reported failed durability. Every final
case capture showed mounted recovery and zero controller system errors.

## Corrective finding

The first Controller A START STOP ILLEGAL REQUEST run found that
`compatibilityRequired` was sampled before START STOP executed. The operation
still crossed the fresh-session barrier, but a sync-capable drive rejecting
START STOP would not receive the extended drain. The implementation now
refreshes compatibility after START STOP. Static checks were extended, both
canonical builds reran, the corrected Release image was deployed B first then
A, and the lifecycle case passed on both.

## Independent media closeout

The Pi identified `/dev/sdb1` as `USB04_32G`, serial
`071C49DE246A1F97`. Unmounted `fsck.vfat -n -v` passed:
`21 files, 2648/1893477 clusters`. Read-only inspection found no `.tmp`,
`.part`, or temporary-named file. The update image remained exactly
8,388,864 bytes with SHA-256
`B08A810CDA1C63FF0CDE7F3C88627D35F372F68A0D5B46A24DC2A6EFABC10062`.
The volume was unmounted after inspection.

## Result

PASS. Unknown-drive negative behavior is bounded and command-class based:
only valid ILLEGAL REQUEST selects compatibility; timeout, malformed sense,
non-ILLEGAL sense, lifecycle timeout, checksum mismatch, and remount failure
cannot produce durable success. Both controllers recover without system error.
