Session 33 — 2026-03-29d
| Field | Value |
|---|---|
| Date | 2026-03-29 |
| Phase | 03b — TWRP (ebc-probe testing) |
| Duration | ~30 min |
ebc-probe — Abandoned
Cross-compiled ebc-probe.c with aarch64-linux-gnu-gcc -static. Two attempts, both caused kernel panic → 900E EDL dump mode:
- Attempt 1: All phases (ioctl 0x7000–0x7024 with zeroed buffers) → kernel panic → 900E
- Attempt 2: Phase 1 only (ioctl probe with zeroed buffers, no mmap) → kernel panic → 900E
Device recovered to TWRP automatically both times. The EBC driver’s ioctl handler does not tolerate probing with zeroed/dummy buffers when SurfaceFlinger/HWC is not running. ebc-probe cannot be used in TWRP. Running it requires a full Android boot.
sysfs Readout — Safe
Reading /sys/devices/sepdc/* is safe in TWRP (no crash):
| Attribute | Value |
|---|---|
| panel_init | ok |
| waveform_version | onyx waveform sg |
| wf_status | 99 (idle) |
| epdc_active_luts | [0x0][0x0][0x0][0x1] — 1 active LUT |
| update_disable | 0 (updates enabled) |
| frame counter | 245:243 |
Decision
Skip ioctl probing entirely — go straight to kernel NOP patch. Apply patch-kernel-waveform-transform.py to extract kernel, NOP the BL 0x427a8c at 0x41d410, repack boot.img, flash via TWRP, test A2 visually.