{
  "release": "r11.1",
  "scope": "Test recipes; not full conformance coverage",
  "sources": {
    "amd": {
      "title": "AMD 48882-PUB 3.11, April 2026",
      "url": "https://docs.amd.com/api/khub/documents/2oKZlc87KNCKiT3B~xJjHg/content"
    },
    "arm": {
      "title": "Arm IHI 0070 H.a, 6 March 2026",
      "url": "https://developer.arm.com/documentation/ihi0070/ha"
    },
    "detection": {
      "title": "AMD PG054 3.3 · Error Detection (PCIe implementation guidance)",
      "url": "https://docs.amd.com/r/en-US/pg054-7series-pcie/Error-Detection"
    },
    "intel": {
      "title": "Intel 710 Series datasheet 4.1 · PCIe request boundaries and limits",
      "url": "https://cdrdv2-public.intel.com/332464/332464_710_Series_Datasheet_v_4_1.pdf"
    },
    "tracking": {
      "title": "AMD PG054 · Tracking Non-Posted Requests and Inbound Completions",
      "url": "https://docs.amd.com/r/en-US/pg054-7series-pcie/Tracking-Non-Posted-Requests-and-Inbound-Completions"
    },
    "timeout": {
      "title": "AMD PG054 · Completion Timeouts",
      "url": "https://docs.amd.com/r/en-US/pg054-7series-pcie/Completion-Timeouts"
    },
    "abort": {
      "title": "AMD PG054 · Completer Abort",
      "url": "https://docs.amd.com/r/en-US/pg054-7series-pcie/Completer-Abort"
    },
    "pasid": {
      "title": "PCI-SIG FAQ · PCIe 3.1 §6.20 PASID on Completions",
      "url": "https://pcisig.com/section-620-pasid-permitted-completion-refer-section-620-%E2%80%93-lines-8-13-page-628-pcie-31"
    },
    "faq": {
      "title": "PCI-SIG PCIe 3.0 FAQ · permitted error classifications",
      "url": "https://pcisig.com/faq?keys=3.0"
    }
  },
  "cases": [
    {
      "id": "edge-amd-01",
      "architecture": "AMD",
      "area": "DTE",
      "title": "Reserved DTE bit",
      "inject": "Set a known reserved bit with its validity conditions active.",
      "observe": "ILLEGAL_DEV_TABLE_ENTRY; ordinary translation must not copy bytes.",
      "recover": "Restore the field, publish, invalidate cached DTE state and synchronize.",
      "locator": "§2.5.2 / Table 43",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable: DTE bit 2",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-02",
      "architecture": "AMD",
      "area": "DTE",
      "title": "Reserved IoCtl / IntCtl",
      "inject": "IoCtl=11b, or a reserved interrupt-control encoding under its valid controls.",
      "observe": "ILLEGAL_DEV_TABLE_ENTRY; classify by the active field, not simply by where the word is stored.",
      "recover": "Repair the field and invalidate the relevant configuration cache.",
      "locator": "Table 7 / Table 43",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "IoCtl executable; IntCtl reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-03",
      "architecture": "AMD",
      "area": "DTE",
      "title": "Reserved IntTabLen",
      "inject": "Use 11xxb with applicable interrupt controls active.",
      "observe": "Illegal DTE encoding, distinct from an IRTE index beyond a valid table.",
      "recover": "Restore a supported length and validate the actual allocation.",
      "locator": "Table 7 / Table 43",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-04",
      "architecture": "AMD",
      "area": "DTE",
      "title": "Reserved paging Mode",
      "inject": "Mode=111b with V=1 and TV=1.",
      "observe": "IO_PAGE_FAULT under Table 44; do not classify every reserved DTE encoding as ILLEGAL_DEV_TABLE_ENTRY.",
      "recover": "Use a supported mode/root and invalidate cached context.",
      "locator": "§2.5.3 / Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-05",
      "architecture": "AMD",
      "area": "DTE",
      "title": "V=0 and TV=0 are different",
      "inject": "Compare an ordinary untranslated request with ATS, then TV=0 when a walk is required.",
      "observe": "V=0 can bypass ordinary DMA; ATS with V=0 is invalid. TV=0 can fault a required untranslated walk.",
      "recover": "Verify request type before choosing an expected event.",
      "locator": "§2.1 / Tables 44, 51",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable controls",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-06",
      "architecture": "AMD",
      "area": "DTE",
      "title": "DeviceID beyond table size",
      "inject": "Request a device entry outside the programmed table extent.",
      "observe": "IO_PAGE_FAULT with response depending on memory, ATS or command context.",
      "recover": "Validate device ownership, table size and segmentation; do not mask DeviceID into another device.",
      "locator": "Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-07",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Host PR=0 / guest P=0",
      "inject": "Clear presence on the data leaf.",
      "observe": "No bytes from the rejected segment. AT=00 may log IO_PAGE_FAULT; ATS returns insufficient permission without that ordinary DMA event.",
      "recover": "Restore only owned backing, publish, invalidate and observe completion before retry.",
      "locator": "Tables 16, 44 / §2.2.7",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-08",
      "architecture": "AMD",
      "area": "Translation",
      "title": "PR=0 with other bits set",
      "inject": "Set a reserved field in the same absent host entry.",
      "observe": "Presence determines that this is not a valid page descriptor; do not blindly validate it as PR=1.",
      "recover": "Test the absent and present forms separately to isolate the reserved-bit check.",
      "locator": "Tables 16–18",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-09",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Read / write permission matrix",
      "inject": "Toggle guest R/W, host IR/IW and DTE IR/IW independently.",
      "observe": "Read succeeds on a write-protected mapping; denied access copies no bytes. Effective permission includes the traversed parents.",
      "recover": "Restore only intended permissions; do not let PRI upgrade an unrelated restriction.",
      "locator": "§2.2.7 / Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable leaf/DTE cases; parent tests in suite",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-10",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Present PTE reserved bit",
      "inject": "Set host leaf bit 52 in the v1 fixture, or bit 13 in a 2 MiB guest leaf.",
      "observe": "IO_PAGE_FAULT; unlike a hardware table-read failure.",
      "recover": "Repair the exact format/size-dependent field and invalidate.",
      "locator": "Table 44 / guest leaf formats",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-11",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Invalid NextLevel / skipped address bits",
      "inject": "Use a non-descending next level, exceed capability, or set address bits for a skipped level.",
      "observe": "IO_PAGE_FAULT; a skipped level does not accept any index.",
      "recover": "Fix the walk structure and supported depth.",
      "locator": "§2.2.3 / Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "NextLevel executable; skip checks in DMA lab",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-12",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Invalid leaf size / frame alignment",
      "inject": "Use a leaf size inconsistent with its level or a nonaligned frame.",
      "observe": "Fault for an invalid descriptor; normal byte offsets remain legal.",
      "recover": "Align the frame for its leaf and verify the full mapped extent.",
      "locator": "Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Alignment controls and model tests",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-13",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Address width / canonicality",
      "inject": "Set bits above the selected host-root width or use a noncanonical guest address.",
      "observe": "IO_PAGE_FAULT for the applicable walk.",
      "recover": "Correct the request/configuration; never truncate it into another mapping.",
      "locator": "Table 44 / §2.2.6",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Guest canonicality executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-14",
      "architecture": "AMD",
      "area": "Translation",
      "title": "PASID / GCR3 limits",
      "inject": "Use invalid GCR3 V, an unmapped PASID, or exceed the architectural PASmax limit.",
      "observe": "Missing/invalid guest lookup can fault. The UI GLX-capacity guard is a separate software rejection, not an emulated PASmax event.",
      "recover": "Validate capability and allocation independently; prevent context aliases.",
      "locator": "§2.2.6 / Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "GCR3 executable; PASmax reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-15",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Nested metadata failure",
      "inject": "Remove a host mapping for a guest page-table page.",
      "observe": "Table-fetch translation fails before data DMA; retain stage and fetch address evidence.",
      "recover": "Repair the metadata mapping and its cache state, not just the final payload page.",
      "locator": "§2.2.6.8",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-16",
      "architecture": "AMD",
      "area": "Translation",
      "title": "Execute / privilege denial",
      "inject": "Issue an instruction fetch through NX or a user request against supervisor-only mappings with applicable features active.",
      "observe": "Protection failure; request attributes and enabled capabilities affect the diagnosis.",
      "recover": "Validate Exe/PMR, guest protection controls and every relevant permission.",
      "locator": "§2.2.6.1–2 / Table 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference; not a full execute/privilege emulator",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-17",
      "architecture": "AMD",
      "area": "Reporting",
      "title": "SA / SE suppression",
      "inject": "Set SA for memory page faults or exercise SE suppression of repeated failures.",
      "observe": "Access can fail without a new event. SA does not suppress interrupt/command faults. Absence of a record is not evidence of success.",
      "recover": "Check suppression and log enable/overflow before judging the test outcome.",
      "locator": "Table 7 / §2.5",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "SA executable; SE reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-18",
      "architecture": "AMD",
      "area": "Hardware",
      "title": "Device-table backing failure",
      "inject": "Inject abort, poison or another specified hardware failure on a DTE fetch.",
      "observe": "DEV_TAB_HARDWARE_ERROR, not an illegal DTE-format error.",
      "recover": "Preserve hardware evidence and repair backing/accessibility before retry.",
      "locator": "§2.5.4 / Table 45",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Synthetic injection",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-19",
      "architecture": "AMD",
      "area": "Hardware",
      "title": "Page-table backing / A-D update failure",
      "inject": "Inject a hardware failure during a page-table access or applicable atomic A/D update.",
      "observe": "PAGE_TAB_HARDWARE_ERROR; an inaccessible table is different from a readable PR=0 entry.",
      "recover": "Repair memory/lifetime/coherency and inspect affected access type.",
      "locator": "§2.5.5 / Table 46",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Synthetic fetch injection; A/D reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-20",
      "architecture": "AMD",
      "area": "Command",
      "title": "Unknown opcode / reserved bit",
      "inject": "Queue opcode 0, or set a reserved bit of an ordinary command.",
      "observe": "ILLEGAL_COMMAND_ERROR halts command processing. Other IOMMU activity is not automatically halted.",
      "recover": "Observe CmdBufRun=0, disable, repair command/backing/pointers, then enable.",
      "locator": "§2.4 / §2.5.6",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-21",
      "architecture": "AMD",
      "area": "Command",
      "title": "Unsupported optional command",
      "inject": "Disable IotlbSup, PreFSup, PPR support/enables, IASup or vIOMMU capability/enables, then issue the affected command.",
      "observe": "Illegal command for the unsupported/disabled operation; avoid pretending optional commands always exist.",
      "recover": "Use capability-driven command selection or restore the required configuration.",
      "locator": "§2.4 / Table 48",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable capability switches",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-22",
      "architecture": "AMD",
      "area": "Command",
      "title": "Command-fetch backing failure",
      "inject": "Inject command read abort/poison.",
      "observe": "COMMAND_HARDWARE_ERROR halts command processing.",
      "recover": "Use the event’s command address; hardware Head may already have advanced due to prefetch. Repair while stopped.",
      "locator": "§2.4 / §2.5.7",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Synthetic injection",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-23",
      "architecture": "AMD",
      "area": "Command",
      "title": "Peripheral invalidation timeout",
      "inject": "Withhold a device invalidation response.",
      "observe": "IOTLB_INV_TIMEOUT; completion/page reuse remains unsafe. Do not infer the two command-halt errors or invent an acknowledgment.",
      "recover": "Keep affected DMA blocked and follow device/platform recovery policy.",
      "locator": "§2.5.8 / §2.4.11",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable outstanding-response fixture",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-24",
      "architecture": "AMD",
      "area": "Command",
      "title": "Completion before required invalidation",
      "inject": "Queue a wait while omitting a required IOMMU or device invalidation.",
      "observe": "The wait may complete correctly while the software reuse protocol remains wrong.",
      "recover": "Test cache state and observed completion, not only Head=Tail.",
      "locator": "§2.4.1 / §2.4.11",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Existing command-sequence lab",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-25",
      "architecture": "AMD",
      "area": "PRI",
      "title": "Incoming PRI disabled",
      "inject": "Send PRI while required global/per-device PRI support or enable is absent.",
      "observe": "INVALID_PPR_REQUEST, RX=0 for the specified conditions; not a successful PPR entry.",
      "recover": "Check device capabilities, global enables, DTE.PPR and the original request.",
      "locator": "Table 52 / §2.5.10",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "PPRLogEn=0 executable; other gates reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-26",
      "architecture": "AMD",
      "area": "PRI",
      "title": "Invalid PPR response context",
      "inject": "Issue COMPLETE_PPR_REQUEST GN=1 without guest translation, or issue it with PPR globally disabled.",
      "observe": "GN/context case: INVALID_PPR_REQUEST, RX=1. Disabled PPR command: illegal command / halt.",
      "recover": "Repair response context and enable state; do not confuse RX=0 and RX=1.",
      "locator": "Table 52 / §2.5.10",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-27",
      "architecture": "AMD",
      "area": "PRI",
      "title": "Wrong CompletionTag / group",
      "inject": "Use a tag that does not match the software work item.",
      "observe": "Software protocol failure; §2.4.7 states that the IOMMU does not validate CompletionTag contents. Do not assert an automatic INVALID_PPR_REQUEST.",
      "recover": "Match original DeviceID, applicable PASID and group before submission.",
      "locator": "§2.4.7",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference; existing mock work-item guard",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-28",
      "architecture": "AMD",
      "area": "Interrupt",
      "title": "Bad IRTE or interrupt request",
      "inject": "Out-of-range index, reserved IRTE fields/type, RemapEn=0, or disallowed interrupt attributes/PASID.",
      "observe": "IO_PAGE_FAULT in the interrupt-remapping context; its flags differ from a memory fault.",
      "recover": "Repair the correct interrupt entry/policy and invalidate its cache; memory PTE repair is unrelated.",
      "locator": "Tables 19–22, 44",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Index/enable in main lab; other formats reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-29",
      "architecture": "AMD",
      "area": "Request",
      "title": "Prohibited memory / ATS request",
      "inject": "Pretranslated request with I=0 or V=0; forbidden port-I/O, interrupt-space or system-management access; malformed request controls.",
      "observe": "INVALID_DEVICE_REQUEST for the listed context, with the specified target/master abort response.",
      "recover": "Validate request class, device controls and address-space policy.",
      "locator": "Tables 50–51, 64",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "V=0 and I=0 ATS executable; wider matrix reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-30",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Command producer catches unread Head",
      "inject": "Try to publish more commands than free slots.",
      "observe": "Software must prevent overwrite. AMD has no CmdBufOverflow W1C status bit.",
      "recover": "Wait for free space or apply software backpressure; do not fabricate a hardware overflow event.",
      "locator": "§2.4",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable queue-full guard",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-31",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Event / PPR / GA overflow",
      "inject": "Fill all usable slots, then attempt one more hardware-produced record.",
      "observe": "Incoming record is lost; unread records remain. Family-specific overflow status prevents further logging until recovery.",
      "recover": "Preserve/drain, observe Run=0, disable, repair allocation/pointers, clear overflow W1C, enable.",
      "locator": "§2.5.1 / §2.6.2 / §2.7.4",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable A/B-selected and GA fixtures",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-32",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Head passes Tail / wrong pointer owner",
      "inject": "Software consumes beyond available log records, writes hardware-owned Tail, or writes command Head while running.",
      "observe": "Software misuse; numeric pointer order alone is not an architectural error detector. Some invalid register operations are undefined.",
      "recover": "Use modular occupancy plus ownership; reject the unsafe software operation before writing MMIO.",
      "locator": "§2.4–2.7 / pointer register definitions",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable guard; no invented hardware fault",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-33",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Normal wrap / empty / full",
      "inject": "Wrap Head and Tail through zero while preserving occupancy.",
      "observe": "Head may numerically exceed Tail and still be valid. Equal Head/Tail means empty in the selected AMD convention.",
      "recover": "Test entry-byte alignment, one reserved slot, FIFO order and bounds.",
      "locator": "§2.4–2.7",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable wrap preset",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-34",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Restart ordering / W1C independence",
      "inject": "Try enable before repair, modify while Run=1, or acknowledge notification without fixing the cause.",
      "observe": "Notification clear, pointer consume, repair and restart are separate transitions.",
      "recover": "Assert the actual stop, disable, repair, W1C and enable sequence; retry DMA separately.",
      "locator": "§2.4 / §2.5.1 / §2.6.2 / §2.7.4",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-35",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Disabled / inaccessible event reporting",
      "inject": "Disable logging, fill it, or inject failure on the log’s backing writes.",
      "observe": "The original failure can occur without a durable event-log entry. Hardware event registers may preserve specified failures.",
      "recover": "Check log state and hardware event registers; preserve the first available evidence.",
      "locator": "§2.5.16.2",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Disabled/overflow executable; write-abort registers reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-36",
      "architecture": "AMD",
      "area": "Buffers",
      "title": "Dual log / early overflow / auto-response",
      "inject": "Exercise active-bank selection, capability-gated autoswap, early thresholds and PPR auto-response/Stop markers.",
      "observe": "Behaviour depends on supported features and chosen enable mode; do not treat the two banks as independent engines.",
      "recover": "Test per-bank overflow, active-bank status and work-item loss/response handling.",
      "locator": "§2.5.17 / §2.6.1 / §2.6.4",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Selected-bank fixtures; autoswap/auto-response reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-37",
      "architecture": "AMD",
      "area": "GA",
      "title": "Lost GA notification with pending vector",
      "inject": "Overflow GA while an interrupt targets a non-running guest.",
      "observe": "GA record can be lost while the guest APIC backing page still retains the pending interrupt. GALOverflow alone does not generate a fresh GA interrupt.",
      "recover": "Reconcile backing state; draining the GA log is not guest ISR/EOI.",
      "locator": "§2.7 / Status bit 9",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable pending-state/overflow fixture",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-38",
      "architecture": "AMD",
      "area": "Optional",
      "title": "Guest event pair error",
      "inject": "Set reserved bits in supported INSERT_GUEST_EVENT.",
      "observe": "GUEST_EVENT_FAULT plus companion payload; two slots in command and event paths.",
      "recover": "Preserve pairing across wrap and repair the injection command.",
      "locator": "§2.4.9 / §2.5.12",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable semantic pair",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-39",
      "architecture": "AMD",
      "area": "Optional",
      "title": "Virtualized-IOMMU backing failure",
      "inject": "Inject a private-memory access error for a virtual context.",
      "observe": "VIOMMU_HARDWARE_ERROR with feature-specific source/type evidence; virtual processing may halt.",
      "recover": "Repair that context and its enable/run lifecycle; use RESET_VMMIO where applicable.",
      "locator": "§2.5.13 / §2.4.10",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Command effect executable; hardware failure reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-40",
      "architecture": "AMD",
      "area": "Optional",
      "title": "SNP RMP protection versus hardware failure",
      "inject": "Separate RMP check rejection from an RMP memory-access failure.",
      "observe": "RMP_PAGE_FAULT versus RMP_HARDWARE_ERROR; neither is a generic absent PTE.",
      "recover": "Inspect RMP-specific fields and ownership/lifetime, with the platform recovery procedure.",
      "locator": "§2.5.14–15",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference; no SNP/RMP emulator",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-41",
      "architecture": "AMD",
      "area": "Reporting",
      "title": "Multiple simultaneous errors",
      "inject": "Inject more than one violation with cache/fetch state controlled.",
      "observe": "The spec may permit one of several detected events. Do not assert an invented total priority order.",
      "recover": "Use isolated injections first; record allowed outcomes for combined cases.",
      "locator": "§2.5.16.1",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-42",
      "architecture": "AMD",
      "area": "Reporting",
      "title": "Counter reaches zero",
      "inject": "Enable an event counter and let it wrap to zero.",
      "observe": "EVENT_COUNTER_ZERO (0xA): informational, not a page fault.",
      "recover": "Consume the record and evaluate measurement policy without unnecessary engine restart.",
      "locator": "§2.5.11 / Figure 66 / Table 68",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-43",
      "architecture": "AMD",
      "area": "DTE / 3.11",
      "title": "Conditional CXL field",
      "inject": "Set CXLMemAttr[6:4] while I=0, support/enable is absent, or the non-secure SEV-TIO DTE forbids it.",
      "observe": "These are conditional fields, not universally reserved bits, and must be zero here; this fixture reports ILLEGAL_DEV_TABLE_ENTRY (Table 43).",
      "recover": "Restore required-zero fields or select a supported profile; validate Table 79 combinations separately.",
      "locator": "Table 7 / §2.13",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Missing support executable; CXL completion matrix reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-44",
      "architecture": "AMD",
      "area": "DTE / 3.11",
      "title": "Secure ATS capability and SNP profile",
      "inject": "Set SATS without support, or select an incompatible SNP/SnpPageMode0Sup/Mode combination.",
      "observe": "Ordinary unsupported SATS is an illegal DTE. SNP mode restrictions distinguish illegal DTE and RMP faults; use §2.12.2.4 capability conditions.",
      "recover": "Restore the complete supported profile, including the §2.12.2.4 capability conditions.",
      "locator": "Table 7 / §2.12.2.4",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Unsupported SATS executable; SNP reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-45",
      "architecture": "AMD",
      "area": "Isolation / 3.11",
      "title": "GIoV DomainID reuse",
      "inject": "Assign the same DomainID to devices with GIoV=1.",
      "observe": "Violates the unique-DomainID software requirement. Do not invent a dedicated hardware fault for this software configuration error.",
      "recover": "Allocate separate DomainIDs, invalidate affected state and verify cross-device isolation.",
      "locator": "Table 7 / §2.2.9",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-46",
      "architecture": "AMD",
      "area": "Virtualization / 3.11",
      "title": "Host-only command in guest buffer",
      "inject": "Issue a command outside the five guest-supported types, including INSERT_GUEST_EVENT or RESET_VMMIO.",
      "observe": "Reject the unsupported guest operation; the explicitly host-only examples generate ILLEGAL_COMMAND_ERROR.",
      "recover": "Use host command context where required and follow the affected guest error lifecycle.",
      "locator": "§§2.4.9–10, 2.10.7",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference; workbench command queue is host context",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-47",
      "architecture": "AMD",
      "area": "Virtualization / 3.11",
      "title": "Reset without VF reconfiguration",
      "inject": "Issue RESET_VMMIO then attempt guest operation before appropriate VF controls are reprogrammed.",
      "observe": "A command reset alone is not a completed guest recovery protocol.",
      "recover": "Reprogram Guest VF Control registers, then follow guest enable/run and ownership rules.",
      "locator": "§2.4.10",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Executable reconfiguration-required state",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-48",
      "architecture": "AMD",
      "area": "Virtualization / 3.11",
      "title": "Wrong guest PRI destination",
      "inject": "Change DTE.vIMUEn in the specified vIOMMU case while sending guest GVA PRI.",
      "observe": "vIMUEn=1 selects guest PPR; 0 selects host PPR. Looking only at the other log can falsely suggest the request vanished.",
      "recover": "Check active guest/host context, proper destination and response ownership.",
      "locator": "§2.10.6",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-49",
      "architecture": "AMD",
      "area": "Interrupt / 3.11",
      "title": "Outdated IRTE cacheability assumption",
      "inject": "Modify GALogIntr or GAPPIDis and expect stale cached copies solely because older documentation omitted them.",
      "observe": "These fields are identified as non-cached in §2.2.5.2. Cacheable fields still need the specified invalidation.",
      "recover": "Preserve required atomic update rules and classify each field correctly.",
      "locator": "§§2.2.5.2, 2.3.2",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-50",
      "architecture": "AMD",
      "area": "Secure events / 3.11",
      "title": "Enhanced invalid-device event decoded as legacy",
      "inject": "Receive a fenced-guest request with the enhanced Type[3] form.",
      "observe": "INVALID_DEVICE_REQUEST remains event code 8 but its enhanced fields differ; legacy PASID/type assumptions lose context.",
      "recover": "Decode the correct feature-dependent format and preserve virtual-buffer/recovery evidence.",
      "locator": "§2.5.9.1 / Figure 63",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-51",
      "architecture": "AMD",
      "area": "Secure events / 3.11",
      "title": "Secure DTE or RMP evidence lost",
      "inject": "Inject a secure DTE fetch or RMP fault and decode using the older record layout.",
      "observe": "The secure fetch S bit and revised RMP fields carry context that the old decoder can miss.",
      "recover": "Select the revision/feature-specific format before interpreting fields; repair the actual backing or ownership fault.",
      "locator": "§§2.5.4, 2.5.14–15",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-52",
      "architecture": "AMD",
      "area": "SEV-TIO / 3.11",
      "title": "Invalid TDI setup or PRI security bits",
      "inject": "Configure a TDI with Mode=0, use unsupported secure-MMIO page sizes, or send PRI with incorrect XT/T encodings.",
      "observe": "Mode=0 is forbidden; secure MMIO RMP coverage is 4 KiB; incorrect PRI encodings produce INVALID_PPR_REQUEST. Do not assign one universal event to all three conditions.",
      "recover": "Use ASP-owned secure configuration, required secure guest PPR backing and the firmware/TDISP protocol.",
      "locator": "§2.14 / firmware spec 58271",
      "source": "amd",
      "scope": "Also in Faults & recovery",
      "existingCoverage": "Reference; no SEV-TIO emulator",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-extra-01",
      "architecture": "AMD",
      "area": "Client identity",
      "title": "PASID enabled but client sends no prefix",
      "inject": "Enable PASID in the device; configure a tagged workload; capture an untagged Memory Request.",
      "observe": "This violates the workload contract, not automatically the IOMMU architecture. With GIoV inactive, the V=1/TV=1 fixture performs host translation.",
      "recover": "Check actual header evidence and endpoint descriptor/context selection. Do not use capability enablement as proof of tagged DMA.",
      "locator": "Table 7; §2.2.9",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-02",
      "architecture": "AMD",
      "area": "Client identity",
      "title": "Implicit PASID 0 under Guest I/O Protection",
      "inject": "Send untagged ordinary DMA with GIoSup and meaningful GIoV enabled.",
      "observe": "The IOMMU supplies effective PASID 0 for guest translation. That is not an observed PASID prefix.",
      "recover": "Test GCR3[0] separately from the intended explicit PASID; include unsupported GIoSup and inactive GV controls.",
      "locator": "Table 7; §2.2.9",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-03",
      "architecture": "AMD",
      "area": "Client identity",
      "title": "Mixed tagged and untagged DMA",
      "inject": "Alternate explicit nonzero PASID and untagged requests from one DeviceID with GIoV enabled.",
      "observe": "Untagged traffic uses default PASID 0. Explicit traffic selects its own context; both may deliberately map to the same guest tables.",
      "recover": "Verify context selection with disjoint owned test mappings before testing intentional sharing.",
      "locator": "§2.2.9",
      "source": "amd",
      "scope": "Test design",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-04",
      "architecture": "AMD",
      "area": "Client identity",
      "title": "PASID field zero in a fault record",
      "inject": "Inspect a fault record containing a zero PASID value without the original request or validity flags.",
      "observe": "Do not conclude that the client sent PASID 0. Some invalid/absent context fields are reported as zero.",
      "recover": "Correlate GN/context flags and the captured request with the exact event format.",
      "locator": "§2.5.3; Table 7",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-05",
      "architecture": "AMD",
      "area": "Client identity",
      "title": "Wrong valid PASID versus out-of-range PASID",
      "inject": "Send another allocated PASID, then one beyond PASmax, then a supported but unallocated context.",
      "observe": "A wrong but valid PASID can translate successfully into the wrong workload context. Range and lookup faults are separate cases.",
      "recover": "Use per-context sentinel mappings and requester ownership evidence; fault-only testing misses wrong-context success.",
      "locator": "§2.2.6; Table 44",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-06",
      "architecture": "AMD",
      "area": "Client identity",
      "title": "PASID prefix with guest translation inactive",
      "inject": "Send a PASID-bearing access while guest translation is unsupported or not enabled for the DeviceID.",
      "observe": "Table 50 lists INVALID_DEVICE_REQUEST; this is not an absent guest PTE.",
      "recover": "Validate support, GTEn, GV and request class before enabling guest translation.",
      "locator": "Tables 5, 24, 50",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-07",
      "architecture": "AMD",
      "area": "DMA type",
      "title": "AT is not inferred from success",
      "inject": "Compare AT=00 payload DMA, AT=01 Translation Request and AT=10 pretranslated access to the same address.",
      "observe": "ATS permission information is not proof of payload movement; a pretranslated access is not evidence of a new guest walk.",
      "recover": "Record AT with the actual header. Pair the test with byte evidence and correct invalidation scope.",
      "locator": "§2.2.7; Tables 44, 50–51",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-08",
      "architecture": "AMD",
      "area": "DMA type",
      "title": "ATS fault has a different observation",
      "inject": "Clear PR on an otherwise valid mapping, then issue ordinary DMA and an ATS Translation Request.",
      "observe": "Table 44 can return ATS R=W=0 without the ordinary IO_PAGE_FAULT log entry. Permissions denial is not equivalent to no ATS response.",
      "recover": "Inspect Translation Completion permission fields, not just event count.",
      "locator": "Table 44",
      "source": "amd",
      "scope": "Test design",
      "lab": "../iommu-lab.html"
    },
    {
      "id": "edge-amd-extra-09",
      "architecture": "AMD",
      "area": "DMA type",
      "title": "Pretranslated request with DTE.I disabled",
      "inject": "Issue a pretranslated access with V=1 but I=0, then compare an ATS request.",
      "observe": "Both use INVALID_DEVICE_REQUEST rules, but Tables 50 and 51 specify different access/translation response context.",
      "recover": "Fix endpoint/IOMMU agreement; do not grant access based on a cached address alone.",
      "locator": "Tables 50–51",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-10",
      "architecture": "AMD",
      "area": "Permissions",
      "title": "Read-only data used to identify direction",
      "inject": "Prepare a known readable but nonwritable page; issue the client operation and inspect both header and bytes.",
      "observe": "A Write should be rejected while Read can succeed. This supports direction diagnosis only after path, mapping and cache state are proven.",
      "recover": "Repeat with opposite permission controls and a positive control; a single failure is ambiguous.",
      "locator": "Table 44",
      "source": "amd",
      "scope": "Test design",
      "lab": "../dma-journey.html"
    },
    {
      "id": "edge-amd-extra-11",
      "architecture": "AMD",
      "area": "Permissions",
      "title": "Execute and privilege bits do not follow PASID enable",
      "inject": "Vary EXE and PMR with their capabilities/controls and guest NX or supervisor permissions.",
      "observe": "NXSup, USSup and PrivAbrtEn affect the allowed behaviour. PASID presence alone does not establish execute or privilege attributes.",
      "recover": "Capture the prefix attributes and validate permissions at all traversed levels.",
      "locator": "§§2.2.6.1–2; Table 44",
      "source": "amd",
      "scope": "Reference recipe",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-extra-12",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "MSI carries a PASID prefix",
      "inject": "Send an interrupt transaction with a PASID, separately from an untagged MSI.",
      "observe": "Table 44 lists an interrupt-context IO_PAGE_FAULT; do not decode it as payload-memory permission failure.",
      "recover": "Repair client interrupt formation; capture address/data and request identity.",
      "locator": "Table 44",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-13",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "Guest I/O Protection must not steal MSI",
      "inject": "Enable GIoV and issue untagged MSI at 0xFEEx_xxxx alongside ordinary untagged DMA.",
      "observe": "MSI still follows interrupt remapping; ordinary DMA can use implicit PASID 0.",
      "recover": "Assert both paths independently; do not run MSI through GCR3[0] in the teaching model.",
      "locator": "§2.2.9",
      "source": "amd",
      "scope": "Interactive classifier",
      "lab": "edge-cases.html#identity-lab"
    },
    {
      "id": "edge-amd-extra-14",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "Read or non-posted write in interrupt space",
      "inject": "Inject Read/non-posted Write into interrupt space rather than a normal posted MSI.",
      "observe": "INVALID_DEVICE_REQUEST under Table 50; a syntactically valid memory operation can target a prohibited request class/address combination.",
      "recover": "Check transaction kind before diagnosing IRTE contents.",
      "locator": "Table 50",
      "source": "amd",
      "scope": "Reference recipe",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-extra-15",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "IRTE index boundary and format stride",
      "inject": "Test the last permitted index, first beyond the table and incorrect entry-size assumptions in 32/128-bit formats.",
      "observe": "An out-of-range IRTE is not an invalid DTE table-length encoding. Decode the selected format before calculating its address.",
      "recover": "Check IntTabLen, capability/enable gates and byte extent without truncating the index.",
      "locator": "§2.2.5; Tables 7, 19–22, 44",
      "source": "amd",
      "scope": "Reference recipe",
      "lab": "engineering.html"
    },
    {
      "id": "edge-amd-extra-16",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "Interrupt table read fails",
      "inject": "Keep the interrupt request and DTE legal; fail the memory fetch of the IRTE.",
      "observe": "This page treats a failed interrupt-remapping-table read as PAGE_TAB_HARDWARE_ERROR with I=1 (Table 60); preserve interrupt context.",
      "recover": "Repair table accessibility; changing RemapEn or a data PTE is not the same repair.",
      "locator": "§2.5.5; Table 46",
      "source": "amd",
      "scope": "Reference recipe",
      "lab": "errors.html"
    },
    {
      "id": "edge-amd-extra-17",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "Unsupported 128-bit/x2APIC mode",
      "inject": "Select a wide interrupt format with its capability or enable prerequisites missing.",
      "observe": "Do not silently reinterpret wide bytes as a legacy entry. Feature gates precede field meaning.",
      "recover": "Use the supported format and selected profile; test unsupported, disabled and enabled states.",
      "locator": "§2.2.5.1–3",
      "source": "amd",
      "scope": "Related semantic lab",
      "lab": "engineering.html"
    },
    {
      "id": "edge-amd-extra-18",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "Stale interrupt mapping after retarget",
      "inject": "Warm an IRTE, change destination/vector in backing memory and issue the interrupt before and after required invalidation.",
      "observe": "Interpret cached versus live fields using the selected format. A memory-TLB invalidation is not an interrupt-table invalidation.",
      "recover": "Publish the entry and perform the applicable interrupt maintenance; preserve old/new destination evidence.",
      "locator": "§2.2.5; §2.4.5",
      "source": "amd",
      "scope": "Related semantic lab",
      "lab": "engineering.html"
    },
    {
      "id": "edge-amd-extra-19",
      "architecture": "AMD",
      "area": "Interrupts",
      "title": "GA log loss versus lost interrupt",
      "inject": "Overflow GA log while the targeted guest is not running, then inspect virtual APIC backing state.",
      "observe": "Lost notification record does not necessarily mean lost pending vector. ISR/EOI and reading a GA log are different operations.",
      "recover": "Reconcile guest interrupt state and log overflow independently before retrying notification.",
      "locator": "§2.7",
      "source": "amd",
      "scope": "Related semantic lab",
      "lab": "../iommu-lab.html"
    },
    {
      "id": "edge-amd-extra-20",
      "architecture": "AMD",
      "area": "Identity isolation",
      "title": "Wrong DeviceID with a valid PASID",
      "inject": "Keep PASID and address unchanged while changing RequesterID to another permitted device context.",
      "observe": "PASID alone does not identify the DTE or prove requester ownership. An allowed translation can still belong to the wrong client.",
      "recover": "Correlate DeviceID, routing/aliases, DomainID and PASID with isolated sentinel pages.",
      "locator": "§§2.1–2.2",
      "source": "amd",
      "scope": "Test design",
      "lab": "guide.html"
    },
    {
      "id": "edge-arm-extra-21",
      "architecture": "Arm",
      "area": "Identity",
      "title": "StreamID range versus STE contents",
      "inject": "Compare out-of-range StreamID, inaccessible STE memory and invalid STE contents with cold configuration caches.",
      "observe": "Distinguish C_BAD_STREAMID, F_STE_FETCH and C_BAD_STE; a table-fetch failure is not a translation permission fault.",
      "recover": "Repair routing, allocation or descriptor as indicated; apply configuration maintenance before retry.",
      "locator": "§§3.3, 7.3",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-22",
      "architecture": "Arm",
      "area": "Identity",
      "title": "Substream validity versus missing CD",
      "inject": "Use a valid stream with an invalid SubstreamID, then an inaccessible or invalid CD.",
      "observe": "Separate C_BAD_SUBSTREAMID, F_CD_FETCH and C_BAD_CD. A PASID-to-SubstreamID relationship depends on the PCIe integration.",
      "recover": "Check CD table extent, STE settings and stream ownership; do not truncate identity into another context.",
      "locator": "§§3.3, 3.9, 7.3",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-23",
      "architecture": "Arm",
      "area": "Translation",
      "title": "Stage-1 metadata needs stage-2 access",
      "inject": "Leave the final data mapping valid but remove stage-2 access to a stage-1 table page.",
      "observe": "Diagnose stage-2 failure on a translation-table access, not final payload access. Preserve stage and input/table address evidence.",
      "recover": "Repair the metadata mapping and invalidate the applicable translation state.",
      "locator": "§§3.3, 7.3",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-24",
      "architecture": "Arm",
      "area": "Translation",
      "title": "Input width is not output width",
      "inject": "Test the first input outside the selected translation regime separately from a descriptor output beyond OAS.",
      "observe": "A translation fault and an address-size fault are not interchangeable. Bypass still has an output-address limit.",
      "recover": "Restore the supported address regime; never silently mask high bits.",
      "locator": "§3.4; §7.3",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-25",
      "architecture": "Arm",
      "area": "Translation",
      "title": "Block bases versus byte offsets",
      "inject": "With the 4 KiB granule, test 4 KiB pages, 2 MiB and 1 GiB blocks; use aligned frames and nonzero request offsets.",
      "observe": "Frame alignment follows block size. The DMA byte address need not be block aligned; an offset is carried into the output.",
      "recover": "Correct the descriptor base/level, retain the legitimate byte offset. Other granules have different geometry.",
      "locator": "§§3.4.2, 3.13; Ch5",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-26",
      "architecture": "Arm",
      "area": "Permissions",
      "title": "Access flag is not read/write permission",
      "inject": "Compare AF=0 with valid AF but denied write, before enabling any supported hardware update facilities.",
      "observe": "F_ACCESS and F_PERMISSION identify different failures. Hardware AF/dirty updates depend on capabilities and controls.",
      "recover": "Use IDR0.HTTU and descriptor controls to choose the oracle; do not automatically grant a denied permission.",
      "locator": "§3.13; §7.3",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-27",
      "architecture": "Arm",
      "area": "Permissions",
      "title": "Restrictions at both stages",
      "inject": "Grant a write at S1 and deny at S2; reverse the stages and compare with Read.",
      "observe": "The final request must satisfy both active stages. Record the failing stage instead of blaming the last leaf displayed.",
      "recover": "Change only the intended owner’s mapping and invalidate the matching scope.",
      "locator": "§§3.3, 3.13",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-28",
      "architecture": "Arm",
      "area": "Stall",
      "title": "Retry before fixing the cause",
      "inject": "Stall on a missing page and issue CMD_RESUME Retry without repair.",
      "observe": "Retry is a new evaluation and can stall again. It must not force termination simply because this is a retry.",
      "recover": "Repair, perform maintenance and synchronize, then resume the new StreamID/STAG.",
      "locator": "§3.12.2; §4.7.1",
      "source": "arm",
      "scope": "Executable regression",
      "lab": "engineering.html#arm",
      "testFile": "tests/iommu-arm.test.mjs",
      "testId": "edge-arm-extra-28"
    },
    {
      "id": "edge-arm-extra-29",
      "architecture": "Arm",
      "area": "Stall",
      "title": "Wrong StreamID with a valid stall tag",
      "inject": "Use the tag of one stalled transaction with another StreamID.",
      "observe": "The pair identifies the transaction. No unrelated stalled transaction may be resumed; the local model rejects this as a software guard.",
      "recover": "Keep the original identity/tag together. Do not interpret the guard as an architectural EVTQ event.",
      "locator": "§3.12.2; §4.7.1",
      "source": "arm",
      "scope": "Executable regression",
      "lab": "engineering.html#arm",
      "testFile": "tests/iommu-arm.test.mjs",
      "testId": "edge-arm-extra-29"
    },
    {
      "id": "edge-arm-extra-30",
      "architecture": "Arm",
      "area": "Stall",
      "title": "Deferred fault changes before EVTQ frees",
      "inject": "Fill EVTQ, stall another transaction, change its missing mapping to a write-denied mapping, then consume an event.",
      "observe": "When queue space returns the transaction is retried; the new record can describe a different fault. A repaired request can succeed instead.",
      "recover": "Diagnose the current record, not the first attempted fault; preserve the entire test history.",
      "locator": "§§3.5.3–4, 3.12.2",
      "source": "arm",
      "scope": "Executable regression",
      "lab": "engineering.html#arm",
      "testFile": "tests/iommu-arm.test.mjs",
      "testId": "edge-arm-extra-30"
    },
    {
      "id": "edge-arm-extra-31",
      "architecture": "Arm",
      "area": "Stall",
      "title": "Terminate versus resume versus PRI response",
      "inject": "Compare a terminated translation, a stalled transaction and a PCIe Page Request Group.",
      "observe": "Terminated requests are not replayed by reading EVTQ. CMD_RESUME addresses a stall; CMD_PRI_RESP responds to a PRI group.",
      "recover": "Use the correct protocol and ensure every retained stall has a resolution path.",
      "locator": "§§3.12, 4.5.2, 4.7.1",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-32",
      "architecture": "Arm",
      "area": "Queues",
      "title": "EVTQ overflow does not freeze future writes",
      "inject": "Lose a terminated event in a full EVTQ, free space but delay OVACKFLG acknowledgement.",
      "observe": "New events can be recorded despite unacknowledged overflow. A second loss cannot produce a new toggle until acknowledgement.",
      "recover": "Consume promptly and copy observed OVFLG into OVACKFLG; preserve lost-evidence status.",
      "locator": "§7.4",
      "source": "arm",
      "scope": "Reference recipe",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-33",
      "architecture": "Arm",
      "area": "Queues",
      "title": "Retained stalls do not cause EVTQ overflow",
      "inject": "Compare full-queue handling of stalled and terminated faults.",
      "observe": "A retained stall event is not a discarded event and does not itself set the overflow condition. Never overwrite unread records.",
      "recover": "Free space and allow retry. Test configuration changes before retry separately.",
      "locator": "§§3.5.3, 7.4",
      "source": "arm",
      "scope": "Executable regression",
      "lab": "engineering.html#arm",
      "testFile": "tests/iommu-arm.test.mjs",
      "testId": "edge-arm-extra-33"
    },
    {
      "id": "edge-arm-extra-34",
      "architecture": "Arm",
      "area": "Queues",
      "title": "PRIQ overflow differs from EVTQ",
      "inject": "Fill PRIQ; compare Last=0, Last=1 and Stop Marker while overflow is active.",
      "observe": "PRIQ overflow inhibits new entries. Last=1 page requests receive an automatic response; Last=0 is discarded. Stop Marker is not a Last response trigger.",
      "recover": "Drain and acknowledge overflow. Validate response PASID/status using PPS/PPAR and validity rules, not a constant success oracle.",
      "locator": "§8.1",
      "source": "arm",
      "scope": "Reference recipe",
      "lab": "arm-smmu.html"
    },
    {
      "id": "edge-arm-extra-35",
      "architecture": "Arm",
      "area": "Queues",
      "title": "Queue memory fault versus MSI fault",
      "inject": "Independently fail event-record memory writes and notification MSI writes.",
      "observe": "Inspect the appropriate GERROR bit. Missing notification does not establish that the queue entry was never written.",
      "recover": "Repair the failing destination and use the specified acknowledgement; inspect queue state independently.",
      "locator": "§§7.2.2, 7.5",
      "source": "arm",
      "scope": "Reference recipe",
      "lab": "arm-smmu.html"
    },
    {
      "id": "edge-arm-extra-36",
      "architecture": "Arm",
      "area": "Commands",
      "title": "Consumption is not completion",
      "inject": "Publish an invalidation and inspect CMDQ_CONS before observing the later CMD_SYNC completion.",
      "observe": "Passing a command entry permits slot reuse but is not a universal proof that all its effects completed.",
      "recover": "Wait for the appropriate synchronization on that queue before relying on maintenance.",
      "locator": "§§4.1.4, 4.7.3, 4.8",
      "source": "arm",
      "scope": "Reference recipe",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-37",
      "architecture": "Arm",
      "area": "Commands",
      "title": "Reserved field detection is conditional",
      "inject": "Test a reserved opcode, an invalid defined parameter and nonzero reserved bits separately.",
      "observe": "CERROR_ILL applies to illegal commands; detection of reserved/undefined nonzero fields can be optional. Memory access abort is CERROR_ABT.",
      "recover": "Preserve the bad command and consumer index; use the chosen implementation detection policy.",
      "locator": "§4.1.3; §7.1",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-38",
      "architecture": "Arm",
      "area": "Commands",
      "title": "GERROR acknowledgement is not AMD W1C",
      "inject": "Halt CMDQ on an illegal command; acknowledge before repair, then retry.",
      "observe": "Acknowledgement alone does not make the command legal. GERROR/GERRORN matching-bit semantics differ from clearing an AMD status bit.",
      "recover": "Repair or follow the specified skip/retry procedure, acknowledge the matching error, then observe progress.",
      "locator": "§7.1; §7.5; Ch6",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-39",
      "architecture": "Arm",
      "area": "Caches",
      "title": "CFGI and TLBI solve different stale state",
      "inject": "Warm STE/CD and translation caches, change one configuration field and one leaf mapping.",
      "observe": "Configuration invalidation and translation invalidation have different targets. One is not a universal substitute for the other.",
      "recover": "Use correct StreamID/SubstreamID and ASID/VMID scopes, with required completion.",
      "locator": "§3.21; §§4.3–4.4",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-40",
      "architecture": "Arm",
      "area": "Queues",
      "title": "Equal indices can mean full",
      "inject": "Wrap producer through the queue while holding consumer fixed.",
      "observe": "Equal indices with opposite wrap bits mean full; matching index and wrap mean empty. AMD’s reserved-slot fixture must not be reused unchanged.",
      "recover": "Use complete pointer state and visibility rules, not integer index comparison.",
      "locator": "§3.5.1–2; §7.4",
      "source": "arm",
      "scope": "Related semantic lab",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-arm-extra-41",
      "architecture": "Arm",
      "area": "Optional",
      "title": "ATS configuration transitions",
      "inject": "Change EATS or translation controls while endpoint translations might still be cached.",
      "observe": "Follow the ATS configuration-change and ATC maintenance sequence for the selected support level. A TLBI alone does not prove endpoint caches are empty.",
      "recover": "Quiesce and synchronize according to the architecture and endpoint protocol; include stale in-flight traffic.",
      "locator": "§§3.9.1–2; §4.5.1",
      "source": "arm",
      "scope": "Reference recipe",
      "lab": "arm-smmu.html"
    },
    {
      "id": "edge-arm-extra-42",
      "architecture": "Arm",
      "area": "Optional",
      "title": "SMMUv3.5 is not a feature bundle",
      "inject": "Select DCMDQ, virtual StreamID translation, dirty-state facilities or protected translation in a capability matrix.",
      "observe": "Gate optional features individually. Test unsupported, supported-disabled and supported-enabled states; do not infer support from H.a document revision.",
      "recover": "Record IDR controls and the exact architecture profile with each result.",
      "locator": "§2.9; §§3.5.7–9, 3.13, 3.25",
      "source": "arm",
      "scope": "Reference recipe",
      "lab": "engineering.html#arm"
    },
    {
      "id": "edge-pcie-extra-43",
      "architecture": "PCIe",
      "area": "Requests",
      "title": "Descriptor crossing versus illegal single request",
      "inject": "Plan a 32-byte descriptor at 0x1ff0. Compare split requests with the unsplit extent.",
      "observe": "A descriptor may span 4 KiB boundaries; each ordinary Memory Request must stay inside one.",
      "recover": "Split before submission; do not report an IOMMU page fault for packet construction.",
      "locator": "PCIe data alignment / request size",
      "source": "intel",
      "scope": "Interactive planner",
      "lab": "edge-cases.html#packet-lab"
    },
    {
      "id": "edge-pcie-extra-44",
      "architecture": "PCIe",
      "area": "Requests",
      "title": "MPS and MRRS are distinct",
      "inject": "Use a 512-byte transfer with MPS=128 and MRRS=512; toggle Write and Read.",
      "observe": "Write payload uses MPS; Read request uses MRRS. The resulting packet counts can differ.",
      "recover": "Use the negotiated/configured limits. The planner does not predict Completion packetization.",
      "locator": "PCIe request size",
      "source": "intel",
      "scope": "Interactive planner",
      "lab": "edge-cases.html#packet-lab"
    },
    {
      "id": "edge-pcie-extra-45",
      "architecture": "PCIe",
      "area": "Requests",
      "title": "Enabled bytes versus DW extent",
      "inject": "Start at 0x1003 and request two contiguous bytes.",
      "observe": "The header uses a DW-aligned address; Length covers two DWs, with first BE=8 and last BE=1.",
      "recover": "Encode byte enables; do not round the requested application data into an extra write.",
      "locator": "§2.2.5 as cited by PG054",
      "source": "detection",
      "scope": "Interactive planner",
      "lab": "edge-cases.html#packet-lab"
    },
    {
      "id": "edge-pcie-extra-46",
      "architecture": "PCIe",
      "area": "Requests",
      "title": "One DW and maximum Length encoding",
      "inject": "Compare a one-byte request with 4096 enabled bytes at 0x1000 using 4096 limits.",
      "observe": "One DW uses LastBE=0; the 1024-DW request uses the zero Length-field encoding. Zero field does not mean empty data.",
      "recover": "Keep decoded length separate from wire field. Zero-length request semantics are outside this planner.",
      "locator": "PCIe Memory Request fields",
      "source": "intel",
      "scope": "Interactive planner",
      "lab": "edge-cases.html#packet-lab"
    },
    {
      "id": "edge-pcie-extra-47",
      "architecture": "PCIe",
      "area": "Completions",
      "title": "One Read can have several Completions",
      "inject": "Receive only part of a Read response, with other tags interleaved.",
      "observe": "Track the original request until all its data arrives; one Completion does not necessarily finish the request.",
      "recover": "Track identity, remaining byte range and receive capacity.",
      "locator": "Tracking Non-Posted Requests",
      "source": "tracking",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-48",
      "architecture": "PCIe",
      "area": "Completions",
      "title": "Timeout followed by a late Completion",
      "inject": "Expire an outstanding Non-Posted request, then deliver its old response.",
      "observe": "Late response must not complete a new request that reused state; PG054 treats it as Unexpected Completion.",
      "recover": "Preserve timeout evidence and manage tag lifetime according to the applicable protocol.",
      "locator": "Completion Timeouts",
      "source": "timeout",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-49",
      "architecture": "PCIe",
      "area": "Completions",
      "title": "Wrong or unsupported Completion shape",
      "inject": "Test successful Cpl without data for a Memory Read and an unmatched locked Completion at an endpoint.",
      "observe": "PCI-SIG permits alternative Malformed/Unexpected classifications in these documented cases; avoid an over-specific oracle.",
      "recover": "Assert rejection and isolation, then use the implementation’s permitted reporting policy.",
      "locator": "PCIe 3.0 FAQ §§2.3.1.1, 2.3.2",
      "source": "faq",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-50",
      "architecture": "PCIe",
      "area": "Completions",
      "title": "Posted writes do not get a normal Completion",
      "inject": "Contrast an ordinary Memory Write with a Read and a failed Non-Posted request.",
      "observe": "A posted write has no request Completion; software cannot infer durable success by waiting for a nonexistent packet.",
      "recover": "Use the device’s completion/ordering protocol. Error reporting is separate from an ordinary Completion.",
      "locator": "Completer Abort; request classes",
      "source": "abort",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-51",
      "architecture": "PCIe",
      "area": "Identity",
      "title": "PASID is not placed on a Completion",
      "inject": "Add a PASID prefix to a Completion in a PCIe 3.1 fixture.",
      "observe": "PCI-SIG §6.20 FAQ excludes this. Do not copy request prefixes mechanically onto responses.",
      "recover": "Keep request identity tracking in requester state; confirm newer-revision rules in the selected Base specification.",
      "locator": "PCIe 3.1 §6.20 FAQ",
      "source": "pasid",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-52",
      "architecture": "PCIe",
      "area": "Errors",
      "title": "Malformed packet versus translation denial",
      "inject": "Mutate a packet Length/BE or address-boundary rule separately from a valid request to an absent mapping.",
      "observe": "Packet checks and IOMMU walk faults belong to different layers; detection requirements can be optional.",
      "recover": "Record which layer actually accepted the request before asserting its error family.",
      "locator": "PG054 Error Detection",
      "source": "detection",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-53",
      "architecture": "PCIe",
      "area": "Resources",
      "title": "Completion receive capacity",
      "inject": "Issue many Read requests without sufficient capacity to receive their responses.",
      "observe": "Requester admission must account for outstanding Completions; request count alone is not a byte-capacity model.",
      "recover": "Throttle issuance and test concurrent tags and response splitting.",
      "locator": "Tracking Non-Posted Requests",
      "source": "tracking",
      "scope": "Reference recipe",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-pcie-extra-54",
      "architecture": "PCIe",
      "area": "Scope",
      "title": "Newer wire modes and optional services",
      "inject": "Plan tests for FLIT mode, IDE, AtomicOps, ACS, SR-IOV and reset/hot-plug races.",
      "observe": "These need the selected Base revision, ECNs and capability profile. The site makes no normative coverage claim for them.",
      "recover": "Add exact normative references and hardware/VIP expectations before turning these into conformance assertions.",
      "locator": "Revision-specific source needed",
      "source": "faq",
      "scope": "Needs Base specification",
      "lab": "../pcie-dma.html"
    },
    {
      "id": "edge-cross-layer-extra-55",
      "architecture": "Cross-layer",
      "area": "Evidence",
      "title": "No event does not prove no traffic",
      "inject": "Repeat denied access with logging disabled, suppressed, full and with a notification failure.",
      "observe": "Record submission, routing, memory and diagnostic evidence separately. Missing logs alone cannot prove that traffic bypassed or traversed translation.",
      "recover": "Restore reporting and rerun a positive control plus a deliberately denied request.",
      "locator": "AMD §2.5.16; Arm §§3.5.3, 7.4",
      "source": "amd",
      "scope": "Test design",
      "lab": "guide.html"
    },
    {
      "id": "edge-cross-layer-extra-56",
      "architecture": "Cross-layer",
      "area": "Lifetime",
      "title": "Warm cache versus repaired backing",
      "inject": "Compare cold, stale-positive and stale-negative translation state around a mapping edit.",
      "observe": "A backing-memory edit alone is not a publication/invalidation/completion sequence. A new request is needed to test recovery.",
      "recover": "Track backing version, invalidation scope, completion and request identity.",
      "locator": "AMD §2.4; Arm §§3.21, 4.3–4.7",
      "source": "amd",
      "scope": "Test design",
      "lab": "../dma-journey.html"
    },
    {
      "id": "edge-cross-layer-extra-57",
      "architecture": "Cross-layer",
      "area": "Partial progress",
      "title": "Later request faults after earlier writes",
      "inject": "Split a descriptor across a boundary; allow the first request and deny the next.",
      "observe": "Do not claim whole-descriptor atomic rollback. Inspect changed and unchanged ranges separately.",
      "recover": "Reconcile partial progress before retrying; repeated writes may be unsafe for device memory.",
      "locator": "AMD §2.1.3.1; Arm §3.12",
      "source": "amd",
      "scope": "Test design",
      "lab": "../iommu-lab.html"
    },
    {
      "id": "edge-cross-layer-extra-58",
      "architecture": "Cross-layer",
      "area": "Identity",
      "title": "Aliases and peer routing",
      "inject": "Compare two requester identities sharing a context with a path that does not traverse the tested translation unit.",
      "observe": "Valid page tables alone do not establish isolation or traversal. Preserve platform routing evidence.",
      "recover": "Verify the actual requester/stream mapping and fabric topology; missing evidence stays inconclusive.",
      "locator": "AMD §2.1; Arm §3.3",
      "source": "amd",
      "scope": "Test design",
      "lab": "guide.html"
    },
    {
      "id": "edge-cross-layer-extra-59",
      "architecture": "Cross-layer",
      "area": "Oracle",
      "title": "Two faults at once",
      "inject": "Combine absent translation, reserved bits and inaccessible metadata, with both warm and cold caches.",
      "observe": "Do not invent a universal first-error priority. Use the relevant architecture priority rules and permitted outcome set.",
      "recover": "Begin with isolated faults, then combine them with explicit preconditions and allowed observations.",
      "locator": "AMD §2.5.16.1; Arm §7.3.23",
      "source": "arm",
      "scope": "Test design",
      "lab": "errors.html"
    },
    {
      "id": "edge-cross-layer-extra-60",
      "architecture": "Cross-layer",
      "area": "Recovery",
      "title": "Acknowledgement is not repair",
      "inject": "Clear notification, consume an event, repair a descriptor and synchronize as separate operations.",
      "observe": "Each action has a different effect. Retiring diagnostic evidence does not replay a terminated transaction or repair memory.",
      "recover": "Preserve the first failure; repair, synchronize and issue/resume through the appropriate protocol.",
      "locator": "AMD §§2.4–2.7; Arm §§3.12, 4.7, 7.5",
      "source": "amd",
      "scope": "Test design",
      "lab": "../dma-journey.html"
    }
  ]
}