# FriiDump Candidate21 Xbox DMI CDB boundary correction

## Candidate20 live evidence

Candidate20 successfully established the Linux GDR-8050L Xbox game view twice
using direct SG_IO and the proven Windows state-machine order.

Observed on the USB `HL-DT-ST DVD-ROM GDR8050L 0012` target:

- entry video-view capacity: `6992` sectors;
- first final game-view capacity: `3431264` sectors;
- second final game-view capacity: `3431264` sectors;
- XBE title: `Red Faction® II`;
- XBE GameRegion: `0x00000001` (`North America`);
- game lead-in marker reached;
- GAME-XDVDFS output growth confirmed;
- controlled partial bytes: `482115584`;
- partial SHA-256:
  `5ffb1a61e0bfa6109ecaeb3bad23f0e17e27ccfbb311c489fe03e6dbbb687a89`;
- STOP UNIT: PASS.

Evidence SHA-256:

`f82ceb50ca7e41d3a9c962557b2dadb47276c767da756721bb9e4337572742d2`

## Remaining failure

The media ID was empty even though the known disc identity is `TQ00501A`.

The portable helper built READ DVD STRUCTURE as:

```c
mmc.cmd[11] = format;
```

Byte 11 is the Control field. Standard READ DVD STRUCTURE places Format in CDB
byte 7. The copied Windows `GetMediaID()` request already uses:

```c
sptd.Cdb[7] = 0x04;
```

Therefore Candidate20's DMI request did not match the proven Windows request.

## Candidate21 correction

Candidate21 changes the portable command to:

```c
mmc.cmd[6] = layer;
mmc.cmd[7] = format;
mmc.cmd[8] = allocation_length_msb;
mmc.cmd[9] = allocation_length_lsb;
mmc.cmdlen = 12;
```

CDB byte 11 remains zero.

It also emits persistent capture evidence:

```text
[XBOX-DVD-STRUCTURE] format=0x00 name=PFI cdb_format_byte=7 result=PASS
[XBOX-DVD-STRUCTURE] format=0x04 name=DMI cdb_format_byte=7 result=PASS
```

## Sticky descrambling interpretation

Candidate20's step 9 MODE SELECT(6) returned `05/81/00` on both handshakes.
This remains visible as a transport failure. It is not accepted as proof of
success. Instead, the authoritative proof is the subsequent 3,431,264-sector
READ CAPACITY together with readable XDVDFS data. No command is removed,
reordered, hidden, or retried through RecoveryKick.

## Scope

Candidate21 changes neither the successful SG_IO challenge sequence nor the
Windows state-machine order. It adds no RecoveryKick, generic media-auth kick,
or synthetic LBA-zero recovery reads.