Ours' GPU never drained the D3D driver's system command buffer past the first
11-dword indirect buffer, so DRAW_INDX / reg-0x57C-arm packets never executed
and draws stayed 0 (the long-hunted render gate; see UPDATE-18). Runtime tracing
(temporary, removed) showed the guest submits 6 INDIRECT_BUFFER packets at boot
(CP_RB_WPTR 22→37) but ours executed exactly ONE IB and then spun 15.7M packets
inside it. Three coupled command-processor bugs, all corrected to match canary:
1. `sync_with_mmio` applied the primary CP_RB_WPTR to whichever ring was active,
including an executing indirect buffer — `37 % 11 = 3` clobbered the IB's
write pointer so its read pointer looped 0→2→5→0 forever and never popped
back to the primary ring. CP_RB_WPTR governs ONLY the primary ring; while an
IB executes, the primary is the bottom of the IB stack. Canary executes each
IB through a separate `RingBuffer reader_` (command_processor.cc), so the
primary write pointer is structurally inapplicable to an IB.
2. Indirect buffers were treated as circular rings: read wrapped at `size_dwords`
(`11 % 11 = 0`) and never reached the fixed write pointer, so even without the
clobber the IB could not terminate. An IB is a fixed *linear* sub-stream; add
`RingBufferView.indirect` and drain `[0, ib_size)` monotonically, then pop.
3. `is_ready` only checked the active ring, so an IB that now correctly exhausts
would never get `execute_one` called again to pop back to the primary ring
(whose WPTR may have advanced). Check the whole IB stack.
Also: the ring was sized `1 << size_log2` bytes (1024 dwords) vs canary's
`1 << (size_log2 + 3)` (8192 dwords) — an 8× undersize that desynced WPTR-wrap
math from the guest. Fixed in `GpuSystem::initialize_ring_buffer` (and the
dead bookkeeping copy in `vd_initialize_ring_buffer`).
Cascade (deterministic; threaded-default backend, byte-identical across runs):
reg 0x57C now written, IB jumps 1→12, packets 15.7M→9,825, and the splash
renders — draws 0→78, shaders 0→3, render_targets 0→2, swaps 2→3 — stable at
50M / 200M / 1B. Boot then reaches a new downstream gate (draws plateau at 78,
interrupts keep climbing → engine alive, not deadlocked).
golden `sylpheed_n50m.json` re-baselined (draws 78). `cargo test --workspace`
green (674; +2 ring_view regression tests). vd_swap's synthetic-swap
short-circuit is now redundant but left untouched (cascade works without
changing it); cleaning it up is a separate follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
034ec8b47f