xenia-rs/audit-runs/audit-059-handle-disambiguation/ROUND_34_PLAN.md

Round 34 — silph_ui_synth.rs (cluster B sibling) — DEFERRED PLAN

Background

Rounds 23-33 drove γ-cluster #2 down to the actual gate: sub_821741C8 (silph worker-dispatch loop) fires 0× in ours / 471× in canary (tid=6). It's invoked via dynamic vtable slot 9 from sub_821752C0 thunk. The vtable writer is in the audit-050 unreachability island — there's no static caller chain to hook into.

The fix shape is a synth module analogous to silph_synth.rs (rounds 18-21):

• Synthesize a singleton-like object with the right vtable
• Spawn a guest thread at the right entry with this object as r3
• Let the dispatch chain do the rest

Rounds 18-21 took 4 rounds to land cluster A's analog and ended at "workers run live but idle" because of missing foreign-pointer fields. Cluster B will face similar challenges.

Sub-round breakdown (estimated 5-8 rounds)

34.α — Probe canary's dispatcher singleton (1 round)

Capture canary's runtime state at sub_821741C8 entry:

• r3 = 0xBCA44C00 (canary tid=6's dispatcher singleton)
• Dump r3..r3+0x80 to identify all fields
• Note vtable address at [r3+0]

WINEDEBUG=-all wine xenia_canary.exe --mute=true --audit_handle_lifecycle=true \
  --audit_jit_prolog_pc=0x821741C8 --audit_jit_prolog_r3_bytes=128 \
  --audit_jit_prolog_mem_dump=<vtable_va_from_r3+0> \
  ...

34.β — Probe full vtable layout (1 round)

Read the vtable bytes statically from the PE (canary's [r3+0] IS a static XEX VA — same trick as round 21):

• Read 32-64 slots from PE at file offset = vtable VA - 0x82000000
• Confirm slot 9 = sub_821C7CB8 and vtable+0x24 thunk to sub_821741C8
• Look at all other slots — do any reference deep guest code that needs more init?

Cross-reference each slot's DB reach. If a slot is the dispatcher's own method body, it'll be called from within the chain — needs to exist.

34.γ — Skeleton synth + thread spawn (1 round)

Create crates/xenia-kernel/src/silph_ui_synth.rs mirroring silph_synth.rs structure:

pub fn spawn_silph_ui_dispatcher(state: &mut KernelState, mem: &GuestMemory, scheduler: &mut Scheduler) -> Result<u32, &'static str> {
    if state.silph_ui_synth_done { return Ok(state.silph_ui_synth_ctx); }
    
    // Allocate ~0x100-0x200 bytes for the dispatcher singleton
    let ctx = state.heap_alloc(0x200, 16)?;
    mem.write_zeros(ctx, 0x200);
    
    // Install static-XEX vtable at [+0]
    mem.write_u32(ctx + 0x00, VTABLE_VA);  // discovered in 34.β
    
    // Other init fields from 34.α dump
    // ...
    
    // Spawn dispatcher thread at sub_821748F0 with r3=ctx
    scheduler.spawn(SpawnParams{
        entry: 0x821748F0,
        start_context: ctx,
        create_suspended: false,
        ...
    })?;
    
    state.silph_ui_synth_done = true;
    state.silph_ui_synth_ctx = ctx;
    Ok(ctx)
}

Hook point: first reach of sub_821CB030 in the existing silph factory chain (the call site that should normally trigger this dispatcher's creation in canary).

Add 3-mode env gate: XENIA_SILPH_UI_SYNTH={unset|=suspend|=1}.

34.δ — Run + diagnose first crash (1 round)

Almost certainly crashes on a NULL deref of one of the singleton's fields. Use round 19's pattern:

• Probe at thread entry + early BB heads
• Identify the offset that's accessed
• Compare to canary's value at that offset

34.ε..η — Iterate on field fills (2-4 rounds)

Each crash identifies one more required field. Fill it. Re-run. Continue until workers idle (verdict D analog).

34.θ — Producer-side seeding (1 round)

Even with the dispatcher running, work-items may not flow. Per round 32 it's pool 3 that's starved (271 fires in canary). The producers are sub_821CBEA8 / sub_821D24A0 / sub_821CD458 — they may need their own bootstrap. Probe what triggers them in canary.

Verification at each stage

After every commit:

• cargo test --release --workspace — 765/765 must pass
• XENIA_CACHE_PERSIST=1 XENIA_SILPH_UI_SYNTH=1 ./target/release/xenia-rs exec <ISO> -n 50000000 --trace-handles-focus=0x1218,0x1224,0x12a4,0x12ac
• Check:
  • No crash
  • sub_821741C8 fires
  • sub_82450b68 r4=3 fires increase
  • Handle 0x1224 / 0x1218 transition out of NO_SIGNALS_DESPITE_WAITS
  • Eventually: VdSwap > 1, draws > 0

Risk register

• High: dispatcher singleton may require many more fields than the analog WorkerCtx (rounds 18-21 needed 8 KEVENTs + ring + descriptors + index table; UI dispatcher likely has similar scope)
• High: foreign-arena pointers in canary's heap (similar to round 19's [+0x28/+0x2C/+0x30]) may need their own synthesis
• Medium: cluster B's worker may itself spawn threads which need contexts which need... cascading scope
• Low: workspace tests breaking (probe infrastructure is solid)
• Low: existing iterate-2BE work regressing (it's on a separate branch)

Off-ramps

If we hit a wall at any sub-round, the off-ramps are:

1. Land the infrastructure as opt-in (rounds 18-21 pattern) and ship cluster A + cluster B both as opt-in env vars
2. Drop cluster B entirely and PR the iterate-2BE work to master (production-ready architectural fix)
3. Pivot to lockstep diff of inflate function (round 30 hypothesis (i)) if cluster B keeps producing crash-fix layers

Branch plan

New branch: iterate-2BF/silph-ui-synth off iterate-2BF/synthetic-silph-spawn HEAD 40f208e. Each sub-round = 1 commit. All commits opt-in via env var; default behavior unchanged.

When ready to execute

Dispatch with the prompt at the round-33 agent's recommendation, starting at sub-round 34.α.