DF-5555 / run.2.log
===== baseline (stock usb_make_raw_desc() classification) =====
DF-5555 structural table check — usb_template_audio.c
======================================================
== interface numbering walk (usb_template.c:307-314,379) ==
iface#0 alt0 class=1 sub=1 proto=0 iInterface=1
HIT audio_raw_desc_0 bLength=10 type=0x24 subtype=0x01 in iface 0: CDC-CM patch byte[4] (bcdADC hi) delta=+0 (zero delta)
HIT audio_raw_desc_9 bLength=10 type=0x24 subtype=0x06 in iface 0: CDC-UNION patch byte[3]+byte[4] (bUnitID/bSourceID) delta=+0 (zero delta)
HIT audio_raw_desc_10 bLength=10 type=0x24 subtype=0x06 in iface 0: CDC-UNION patch byte[3]+byte[4] (bUnitID/bSourceID) delta=+0 (zero delta)
HIT audio_raw_desc_11 bLength=10 type=0x24 subtype=0x06 in iface 0: CDC-UNION patch byte[3]+byte[4] (bUnitID/bSourceID) delta=+0 (zero delta)
HIT audio_raw_desc_12 bLength=10 type=0x24 subtype=0x06 in iface 0: CDC-UNION patch byte[3]+byte[4] (bUnitID/bSourceID) delta=+0 (zero delta)
HIT audio_raw_desc_13 bLength=10 type=0x24 subtype=0x06 in iface 0: CDC-UNION patch byte[3]+byte[4] (bUnitID/bSourceID) delta=+0 (zero delta)
HIT audio_raw_desc_14 bLength=10 type=0x24 subtype=0x06 in iface 0: CDC-UNION patch byte[3]+byte[4] (bUnitID/bSourceID) delta=+0 (zero delta)
iface#1 alt0 class=1 sub=2 proto=0 iInterface=3
iface#1 alt1 class=1 sub=2 proto=0 iInterface=3 (alt)
HIT audio_raw_desc_20 bLength= 7 type=0x24 subtype=0x01 in iface 1: CDC-CM patch byte[4] (bDelay) delta=+1 <-- REAL DELTA
iface#2 alt0 class=1 sub=2 proto=0 iInterface=2
iface#2 alt1 class=1 sub=2 proto=0 iInterface=2 (alt)
HIT audio_raw_desc_30 bLength= 7 type=0x24 subtype=0x01 in iface 2: CDC-CM patch byte[4] (bDelay) delta=+2 <-- REAL DELTA
== (1) generated-vs-authored byte diff (usb_make_raw_desc replay) ==
MISFIRE <iface ppRawDesc>[16] bLength= 7 type=0x24 subtype=0x01 in iface 1: byte[4] (bDelay) 0x03 -> 0x04 <-- CORRUPTED
MISFIRE <iface ppRawDesc>[19] bLength= 7 type=0x24 subtype=0x01 in iface 2: byte[4] (bDelay) 0x01 -> 0x03 <-- CORRUPTED
-> census: 9 descriptor(s) satisfy the CDC predicate; 2 in nonzero interfaces (real deltas); byte diff: 2 descriptor(s) patched, 2 byte(s) with nonzero delta (CORRUPTED)
== structural invariants ==
PASS S1 audio_raw_desc_0: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_1: bLength(0x0c) == sizeof(table) (12) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_2: bLength(0x0c) == sizeof(table) (12) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_3: bLength(0x0c) == sizeof(table) (12) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_4: bLength(0x0c) == sizeof(table) (12) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_5: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_6: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_7: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_8: bLength(0x09) == sizeof(table) (9) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_9: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_10: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_11: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_12: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_13: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_14: bLength(0x0a) == sizeof(table) (10) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_15: bLength(0x0f) == sizeof(table) (15) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_20: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_21: bLength(0x0b) == sizeof(table) (11) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_22: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_30: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_31: bLength(0x0b) == sizeof(table) (11) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S1 audio_raw_desc_32: bLength(0x07) == sizeof(table) (7) — usb_make_raw_desc memcpy of raw[0] bytes stays in-bounds
PASS S2 audio_raw_iface_0_desc: NULL terminator at slot 16 of 17 — no interior hole
PASS S2 audio_raw_iface_1_desc: NULL terminator at slot 2 of 3 — no interior hole
PASS S2 audio_raw_ep_1_desc: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 audio_raw_iface_2_desc: NULL terminator at slot 2 of 3 — no interior hole
PASS S2 audio_raw_ep_2_desc: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 audio_iface_1_ep: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 audio_iface_2_ep: NULL terminator at slot 1 of 2 — no interior hole
PASS S2 audio_interfaces: NULL terminator at slot 5 of 6 — no interior hole
PASS S2 audio_configs: NULL terminator at slot 1 of 2 — no interior hole
PASS S3 usb_string_lang_en: bLength=4 type=0x03 bData=2 bytes (even) — self-sized by USB_MAKE_STRING_DESC
PASS S3 string_audio_mixer: bLength=32 type=0x03 bData=30 bytes (even) — self-sized by USB_MAKE_STRING_DESC
PASS S3 string_audio_record: bLength=34 type=0x03 bData=32 bytes (even) — self-sized by USB_MAKE_STRING_DESC
PASS S3 string_audio_playback: bLength=38 type=0x03 bData=36 bytes (even) — self-sized by USB_MAKE_STRING_DESC
PASS S3 string_audio_product: bLength=36 type=0x03 bData=34 bytes (even) — self-sized by USB_MAKE_STRING_DESC
PASS S4 audio_get_string_desc(0x0409, idx): non-NULL exactly for 0..4, NULL for 5..255 (bound check audio.c:392)
PASS S4 non-0x0409 lang_id -> NULL for all non-zero indexes (audio.c:389-391)
PASS S4 index 0 returns LANG table regardless of lang_id (USB-spec correct, audio.c:386-388)
PASS S5 usb_template_audio.getVendorDesc == NULL — the core's usb_temp_get_vendor_desc() short-circuits to NULL for every stalled EP0 request (usb_template.c:1050-1060); no vendor/HID descriptor contract exists to violate
PASS S5 getStringDesc wired to audio_get_string_desc (usb_template.c:1086-1109)
PASS S5 device string indexes in-range of the string table (iProduct=4 <= INDEX_AUDIO_MAX-1, iMfr/iSer 0)
PASS S6 numbering walk yields 3 interfaces (bNumInterface = bInterfaceNumber+1 = 3, usb_template.c:404)
PASS S6 AudioStreaming (subclass 2) interfaces are #1,#2 — AC header baInterfaceNr must be {1,2}
PASS S6 AC header bInCollection(2) == number of AS interfaces (2) — audio_raw_desc_0[7]
PASS S6 AC header baInterfaceNr == {1,2} — the core never renumbers these bytes, so they must match the walk (audio_raw_desc_0[8..9])
PASS S6 AC header wTotalLength(0x00a9 = 169) == sum of the 16 AC-interface CS_INTERFACE lengths (169)
PASS S7 audio_isoc_mps: FULL/HIGH nonzero (0xc8/0xc8) and in-bounds of mps[USB_SPEED_MAX]; LOW/VARIABLE/SUPER -> 0 -> core fails closed with USB_ERR_INVAL (usb_template.c:221-229)
PASS S7 audio_isoc_interval: FULL=1 (1:1), HIGH=4 (1:8) — in-bounds of bInterval[USB_SPEED_MAX]
PASS S8 AC-interface audio graph: every bSourceID/mixer/selector pin resolves to a defined unit/terminal ID (0 unresolved)
======================================================
ALL STRUCTURAL CHECKS PASSED (file is clean on S1-S8; the CORRUPTED lines above are DF-5555: bDelay 3->4 (iface 1, audio_raw_desc_20) and 1->3 (iface 2, audio_raw_desc_30) are real nonzero deltas; seven iface-0 misfires add 0)
===== fix-logic check (CDC patch gated on CDC interface classes) =====
MISFIRE lines under FIX_CLASSGATE: 0 (expected 0)