α-21 (heap-persist HEVC controls past IOC_QUEUE): hash unchanged.
-> Kernel does copy at S_EXT_CTRLS time, not deferred. Mechanism 3 dead.
α-22 (log error_idx after S_EXT_CTRLS): error_idx = count - 1 in BOTH
the working device-init batch AND the broken per-frame batch. Not
a failure indicator in this kernel version. Mechanism 5 dead.
Backend reverted to iter15 stable state c1d4bb53... All 5-codec
anchors preserved.
Remaining mechanisms (untested):
1. request_fd mismatch (unlikely; strace shows consistent fd)
2. REINIT clears controls between S_EXT_CTRLS and QUEUE (LEADING)
4. ctrl_hdl mismatch (libva submits to one, rkvdec reads from another)
iter17's empirical finding still stands as the campaign's strongest
narrowing: rkvdec sees zero SPS for libva, correct for kdirect. The
mechanism is between S_EXT_CTRLS submission and ctx->ctrl_hdl->p_cur
read, specific to libva's invocation pattern.
iter19 candidate (α-23): test mechanism 2 by disabling
media_request_reinit() in libva's RequestSyncSurface. If hashes
change, REINIT timing is the bug. Alternative (mechanism 4): kernel
printk that dumps &ctx->ctrl_hdl + per-request handler pointer,
comparing libva vs kdirect.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
