nx_virtio_dma_probe.nx

nx_virtio_dma_probe.nx -- BISECT the virtio descriptor-DMA chain by calling the device model DIRECTLY, with no emulated CPU anywhere in the path. WHY IT EXISTS: two independent toolchains (nx_drv_proto_emit + nx_virtio_hs_emit, two different specs, two different images) both drive the sovereign emu to EXACTLY `VIO ACK DRV FEAT OK VQ` and then die at the first DESC-stage check. That isolates the defect to what they SHARE -- the QueueNotify -> nx_virtio_notify_dma -> QueueDescPeek chain -- but it does NOT say which half: (a) the DEVICE MODEL's DMA walk is broken, or (b) the device model is fine and the SIM's store32 dispatch never delivers the driver's descriptor writes / never routes the notify. Reading the source could not separate those two, and I was wrong twice guessing, so this measures. ******BUILD THE INSTRUMENT BEFORE FORMING THE HYPOTHESIS -- the cheapest experiment that could REFUTE runs first, and a bisection is cheaper than either fix. This probe exercises ONLY leg (a). If DESCPEEK comes back correct here, the device model is exonerated and the defect is in the sim's dispatch; if it comes back wrong, the defect is here. Either way the next step is named by the RESULT rather than chosen by taste. Geometry is taken from the REAL consumer (nx_bootcap): base 0x80000000, size 65536, ring page 0x80001000 (QueuePFN 0x80001), data buffer 0x80003000 -- a probe on different geometry than the subject measures a different system. exit 0 = device-model DMA WORKS (defect is downstream) | 1 = device-model DMA is the defect | 2 = the probe could not observe (its own negative control failed -- trust nothing) license_tier: ORIGINAL. Read-only. No hw writes (Rule 26).