# GRIND_LOG — FUN_0000d10c (second poll-site function)

**Status: reference.c only.** Matching-decomp iteration deferred — the
two-base-pointer csel pattern plus 4 save-and-modify blocks with
parity-dependent offsets is too much register-allocation freedom to
reach ≥90% byte-match in a single session.

## What's here

- `func.bin` — raw 196-byte slice, offset 0xd10c..0xd1cf in v1.19
- `func.s`   — objdumped GNU asm, absolute addresses preserved
- `reference.c` — best-effort ground-truth C; semantics inferred from
  the assembly. Several constants (0x30, 0x4c, 0x1F0000, 0x2FFF0FFF,
  0x40000000) remain unnamed pending an AI-Ghidra rename pass.

## Why the deferral

This function is the PHY-side prologue of a frequency-change handshake.
Compared to FUN_0000d328 (the first lift we did — clean linear PHY-poke
sequence):

| axis | d328 (done) | d10c (this one) |
|---|---|---|
| instructions | 26 | 49 |
| base pointers used | 1 | 2 (ch_base + sec_table) |
| csel / conditional moves | 0 | 1 (picks sec_table by ch > 1) |
| indexed addressing with shift | 0 | 4+ (`[x3, x6, LSL #0]` etc.) |
| offset arithmetic tricks | offset add once | ubfiz + mul + add chains |

GCC has too many equally-valid ways to arrange `csel` plus multi-base
address generation. Without ARMCC, byte-match would plateau at ~70%
after naive iteration. With objdiff + AI-Ghidra naming + a dedicated
afternoon, a good effort would push to 85-90%.

## Best next step for this file

1. AI-Ghidra rename pass (Hermes-2-Pro, GhidrAssist agentic mode) on
   the constants. Likely auto-names some via tool-call.
2. Compile reference.c with `-Os` and count matching insts vs func.s
   line-by-line — baseline score.
3. Iterate with `restrict`-qualified ptrs, `__builtin_expect` hints,
   or inline-asm for the csel.

**Productive for now: move on.** We have poll site 12-15 covered (via
d328) and poll site 11 semantically documented. When UART arrives, the
equivalent C source exists for the high-value sites — that's what
actually matters.