The Block → Schema Cross-Reference

This page is the definitive join between the ADDR lane ("where things are" — the SoC address-map blocks) and the CSR lane ("what the registers are" — the per-block register schemas). For every block in the Cayman address map, it answers: which CSR schema describes its registers? And the reverse: which blocks does a given schema instantiate? It also reconciles the byte-grounded Cayman map against the v5 Maverick binding database, and gives an exact coverage tally (unplaced schemas, unschema'd blocks, multi-instance shared IP).

All figures below were re-derived this session by directly parsing the shipped RTL-generated artifacts (the flat YAML, the json_xref side-car, the on-disk csrs/ JSON tree, and the Maverick pkl JSON mirror). Every count is anchored to a node, a schema file, or a re-run count. Confidence tags are HIGH/MED/LOW × OBSERVED/INFERRED/CARRIED.

Scope. Cayman is NC-v3 and byte-grounded (OBSERVED). Maverick is v5; its bindings are read from the shipped pkl mirror but the per-gen reading over them is INFERRED. Per-gen applicability cells are CARRIED from the gen survey.

Related pages: SoC master map · unified SoC memory map · pkl address-map DB · pkl TPB subtree · CSR schemas: tpb · tpb_xt_local_reg · notific-queue.

1. The three artifacts and the join model

The block→schema relationship is carried three independent ways across the corpus. This page joins all three.

• (A) is primary. The inline json: key is present on a subset of leaves; its absence means no CSR schema (pure memory / reserved stub / pure container — see §5b).
• (B) is an independent cross-check. The side-car is regenerated by the same arch-regs toolchain but keyed by lowercased name and stripped of base/size. It agrees with (A) byte-exactly (§2).
• (C) is the v5 reconciliation source. Each non-root pkl record carries a json: field pointing at an absolute RTL build path (e.g. …/src/csrs/tpb/tpb_xt_local_reg.json); the basename is the stable cross-SoC join key.

JOIN KEY = the schema-file basename (e.g. tpb_xt_local_reg.json). A block is identified by its top-level family — the leading alpha group before the first numeric instance index (TPB, TOP_SP, PEB_APB_IO, APB_SE, …). The same physical IP is instantiated many times across families; the basename collapses those instances to one schema identity.

GOTCHA — do not pickle.load the v5 DB. al_address_map_db.pkl is 207 MiB and is not a flat list of safe primitives. Use pickletools or stream the shipped al_address_map_db.json mirror (490 MiB) with a chunked regex over the "json": field — never pickle.load. All Maverick figures here came from a streaming pass over the mirror.

2. Cayman inline ↔ side-car reconciliation [HIGH/OBSERVED]

Both Cayman artifacts were re-parsed this session.

Cross-check result (re-run this session):

• 19,012 == 19,012 bindings.
• set(xref schemas) == set(flat schemas) → True (identical 76-element set).
• per-schema count(flat) == count(xref) for all 76 → 0 mismatches.

The side-car is a faithful, independently-generated projection of the inline binding. Either may be used as the bind oracle; only the flat YAML additionally carries base/size. The json_xref file is 19,022 lines = 19,012 bindings + 10 header lines (OBSERVED).

3. The block → schema table (the major blocks) [HIGH/OBSERVED]

For each major address-map block: a representative bound leaf with its byte-exact absolute base and size, the schema it binds, the on-disk schema size (evidence that the schema file is real), the total bound-leaf count across all instances, and the per-gen applicability (CARRIED). Bases/sizes are byte-exact from the flat YAML; schema sizes are stat of the on-disk file. Escaped \| in cells.

3a. Engine windows — the Q7/SP control cores (bound directly on the engine plane)

NOTE. tpb_xt_local_reg.json is one schema bound 84× across 4 families (PREPROC ×4 / TPB ×40 / TOP_SP ×20 / PEB_SP ×20) — the canonical shared-IP case (§6). All four bind the same basename; the PEB_SP base carries bit-53 (0x20000000000000) as the privileged alias of TOP_SP. This is the IP the customop ABI depends on.

3b. TPB engine host CSRs (APB_IO / PEB control plane)

3c. DMA / UDMA (APB_SE "SDMA" plane)

3d. HBM (DRAM is pure memory; the controller is on the PEB AMZN plane)

3e. PCIe / d2d / fabric (PEB plane; the d2d set is GEN-SPECIFIC)

3f. INTC / SPROT / security (PEB privileged plane)

3g. FIS / notification / RAS / trace / apex

NB on blank bases. A blank / "(PEB)" base means the schema's instances live on the PEB privileged plane (PEB_APB_IO* nodes) whose absolute bases carry bit-53 (0x20000000000000); a representative absolute base is given where a clean USER-plane leaf exists. The full per-schema family breakdown — including the PEB-plane families — is the §6 reverse index. The §3 table is the major blocks; §6 is exhaustive for all 76.

4. Cayman-YAML ↔ Maverick-pkl reconciliation [HIGH/OBSERVED]

Both DBs carry a per-leaf schema binding. The reconciliation is done on schema-file basename (Cayman uses curated csrs/<sub>/<unit>.json; the pkl points at absolute RTL …/Registers/*.json paths — basename is the stable join key).

4a. Three-way partition of the 76 Cayman schemas [HIGH/OBSERVED]

The 44 shared (re-derived this session as set(cayman) ∩ set(maverick)):

a2i_model, a2j_model, amzn_remapper, cce, cxela500, ddr_csr_apb, dfx_model, dw_apb_i2c,
dwc_hbmphy_top, erg_ecc_model, erg_parity_model, erg_parity_model_noinit, fis_control,
gpio, hbm_cfg, hbm_scbr, i2c_config, intc_4grp_msix_unit, intc_4grp_no_msix_unit,
misc_model, notific_10_queue, notific_1_queue, nsm, otp, papb_bcast, pll_model, pvt,
qos_host_visible, qos_pmu, qos_prot, ring_io_bot, ring_io_top, spis_model, tdma_model,
tpb_arr_seq_cluster_host_visible, tpb_arr_seq_top_host_visible, tpb_arr_seq_top_protected,
tpb_ham, tpb_sbuf_cluster, tpb_sbuf_pool_act, tpb_xt_local_reg, user_remapper, xtensa_nx,
xtensa_q7

This is exactly the frozen-IP set: the Q7/SP control core (tpb_xt_local_reg), the security CAM trust boundary (amzn_remapper / user_remapper), the QoS/NSM enforcement (qos_* / nsm), the INTC errtrig primitive (intc_4grp_*), the RAS regfiles (erg_*), the CoreSight trace cell (cxela500), and the Xtensa debug blocks. A Cayman binding here describes the same IP on Maverick (numbers may scale, but the schema name does not).

The 32 Cayman-only basenames (re-derived set(cayman) − set(maverick)):

apbblk, cme, d2d_ctrl_axi_cfg, d2d_ctrl_core_cfg, d2d_mpcs_cfg, d2d_xsr_cfg, dre, hbm_hpr,
hbm_xbar_cfg, intc_1grp_msix_unit, iofabric_model, misc_ram_model, mrvl_mpcs_x16,
mrvl_xsr_phy, mrvl_xsr_pram, pcie5_x8_dwc_pcie_ctl, pcie_appaxi_model, pcie_appcore_model,
pcie_phy_model, pcie_user, pmdt_cctm, rdm_model, sfabric_model, sfabric_urb, snps_ctrl,
top_sp_ram, tpb, udma_gen, udma_gen_ex, udma_m2s, udma_s2m, urb

Most of these 32 are RENAMED-but-same-block (§4c), not deleted IP — the pkl re-IP'd or re-homed the schema while keeping the hardware function.

4b. Spot-verified: the *_LOCAL_REG node binds the same schema on both [HIGH/OBSERVED]

Same basename, same 0x10000 size — the strongest YAML↔pkl binding agreement (the frozen Q7-control IP the customop ABI depends on). Confirmed this session: the pkl mirror contains …/src/csrs/tpb/tpb_xt_local_reg.json in its json: field.

4c. The RENAMED-but-same-block mappings [HIGH/OBSERVED]

Verified this session by matching the node-name pattern across both DBs and confirming the target basename appears in the pkl mirror.

These are the same hardware function with a GEN-SPECIFIC schema (re-IP'd / re-homed). The pkl deliberately carries its own 320 bindings rather than reuse the Cayman 76 because of exactly these re-IPs.

4d. The EVT_SEM reconciliation — a real divergence [HIGH/OBSERVED]

CORRECTION / QUIRK. In Cayman, the TPB event-semaphore aperture is decomposed into sub-windows — verified per TPB instance:

leaf	base (TPB_0)	size
TPB_0_EVT_SEM (container)	0x2802700000	0x100000
…_EVT_SEM_EVENT	0x2802700000	0x400
…_EVT_SEM_SEMAPHORE_READ	0x2802701000	0x400
…_EVT_SEM_SEMAPHORE_SET	0x2802701400	0x400
…_EVT_SEM_SEMAPHORE_INC	0x2802701800	0x400
…_EVT_SEM_SEMAPHORE_DEC	0x2802701C00	0x400
(+ EVENT_RESERVED0/1 padding)

None of these carries a json: field (rg 'EVT_SEM' … \| rg -c 'json:' = 0). The schema csrs/tpb/tpb_events_semaphores_axi.json (6,017 bytes) exists on disk but binds nothing in the Cayman flat map — it is an ORPHAN (§5a).

The Maverick pkl, by contrast, binds TPB_EVT_SEM.json directly (confirmed: the mirror's json: field contains …/address_map/TPB_EVT_SEM.json). Same op-windowed primitive, different binding completeness: Cayman leaves the op layout implicit (decode it from the address arithmetic and the CSR-16 page); Maverick attaches the schema.

4e. What the pkl adds with no Cayman counterpart (276 pkl-only basenames)

The pkl's 320 − 44 = 276 surplus is dominated by raw RTL RAS/log regfiles that the curated Cayman csrs/ view collapses, plus Maverick-NEW IP. Top pkl-only by binding count (streamed this session):

These are Maverick-added / finer-grained RTL leaves, not Cayman gaps. Notably, ap_intc_grp_ctrl.json is bound 15,504× in Maverick yet binds nothing in Cayman — its schema ships in the Cayman csrs/ap_intc/ pool but is never instantiated (see §5a). [binding counts HIGH/OBSERVED; "Maverick-gen" reading MED/INFERRED]

5. Coverage analysis [HIGH/OBSERVED]

5a. Unplaced schemas — on disk but with no binding block (the 9 orphans)

The Cayman csrs/ tree holds 85 JSON schemas across 29 subdirs; only 76 are referenced by any flat-YAML node. The 9 UNREFERENCED (re-derived set(on_disk) − set(referenced), with on-disk byte size as evidence):

The 4 ap_intc_* + intc_1grp_no_msix are schemas for IP that ships in the shared csrs/ pool but is used only on a later gen (Maverick decentralized INTC). tpb_events_semaphores_axi is a genuine Cayman binding gap: the schema is real, the data aperture is real, but the generator did not attach the bind. [orphan set HIGH/OBSERVED; "used on later gen" reading MED/INFERRED]

5b. Unschema'd blocks — nodes with no json: (15,846 of 34,858) [HIGH/OBSERVED]

These are not undocumented CSR regions. Classified by leaf shape, they fall into legitimate schema-free classes:

• Pure memory — Q7/NX IRAM/DRAM (PREPROC_Q7_CORE*_IRAM/DRAM, POOL_IRAM, NX_IRAM/DRAM), STATE_BUF / STATE_BUF_SCRATCH_RAM / PSUM_BUF / DGE_MEMORY, TOP_SP_RAM_POPULATED, the HBM_0..3 DRAM band. Register-less RAM/DRAM windows.
• Reserved stubs — TPB_POOL_RESERVED*, PREPROC_RESERVED_CC*, TPB_RESERVED_SBUF, generic RESERVED_* / EVENT_RESERVED* placeholders.
• Pure containers — the top-level windows (TPB_0, TOP_SP_0, HBM_0, APB_SE_0, PREPROC_0) and intermediate aggregators whose size spans their children; the json: attaches to descendants, not the container.
• Decomposed-but-unbound — the EVT_SEM op sub-windows (§4d) — the one class that arguably should bind tpb_events_semaphores_axi but does not.

Top unschema'd families (container/reserved/memory levels): PEB_APB_IO ~6,030 · PEB_APB_IO_BCAST ~4,592 · APB_IO ~1,970 · APB_SE ~1,420 · TPB ~864 · TOP_SP ~400 · PEB_SP ~400 · PREPROC ~76. No "undocumented CSR" class was found among the 15,846.

5c. Multi-instance schemas — shared IP describing N families [HIGH/OBSERVED]

44 of the 76 schemas bind nodes in >1 top-level family (re-derived this session as {schema : len(families) > 1}). The widest fan-outs:

The shared-IP schemas (udma_*, intc_*, qos_*, *_remapper, erg_*, cxela500, tpb_xt_local_reg) are each instantiated dozens-to-hundreds of times. The 1-family schemas are the apex peripherals (gpio, pll, pvt, otp, ring_io_*, i2c, dfx, misc, iofabric, sfabric) — each bound only on PEB_APB_IO.

5d. The headline coverage answer

• Of the 76 schemas the flat YAML references: all 76 have ≥1 binding block (0 referenced-but-unbound — trivially true since "referenced" == "bound").
• Of the 85 schemas on disk: 76 placed, 9 unplaced (§5a).
• Of the pkl's 320 schemas: every one binds ≥1 node (the pkl has no orphans — its schema list is derived from the bindings).
• 0 referenced-but-missing-on-disk (verified set(referenced) − set(on_disk) = ∅).

6. The reverse index — schema → blocks it describes [HIGH/OBSERVED]

Every one of the 76 Cayman-referenced schemas, the top-level family/families it binds (with per-family instance count, re-derived this session), and the total bound-node count. Format: <total> <schema> [family × count, …]. The leading counts sum to 19,012.

   12  apbblk/apbblk.json                          PEB_APB_IO x12
  288  d2d/d2d_ctrl_axi_cfg.json                   PEB_APB_IO_BCAST x256, PEB_APB_IO x32
  288  d2d/d2d_ctrl_core_cfg.json                  PEB_APB_IO_BCAST x256, PEB_APB_IO x32
  288  d2d/d2d_mpcs_cfg.json                       PEB_APB_IO_BCAST x256, PEB_APB_IO x32
  144  d2d/d2d_xsr_cfg.json                        PEB_APB_IO_BCAST x128, PEB_APB_IO x16
  288  d2d/mrvl_mpcs_x16.json                      PEB_APB_IO_BCAST x256, PEB_APB_IO x32
  144  d2d/mrvl_xsr_phy.json                       PEB_APB_IO_BCAST x128, PEB_APB_IO x16
  144  d2d/mrvl_xsr_pram.json                      PEB_APB_IO_BCAST x128, PEB_APB_IO x16
  288  d2d/snps_ctrl.json                          PEB_APB_IO_BCAST x256, PEB_APB_IO x32
    4  dfx/a2i_model.json                          PEB_APB_IO x4
    2  dfx/a2j_model.json                          PEB_APB_IO x2
    2  dfx/dfx_model.json                          PEB_APB_IO x2
 1318  ela500/cxela500.json                        PEB_APB_IO x576, APB_IO x294, APB_SE x256, PEB_APB_IO_BCAST x192
  320  erg/erg_ecc_model.json                      PEB_APB_IO x192, PEB_APB_IO_BCAST x128
 1134  erg/erg_parity_model.json                   PEB_APB_IO x942, PEB_APB_IO_BCAST x192
 1246  erg/erg_parity_model_noinit.json            PEB_APB_IO_BCAST x1088, PEB_APB_IO x158
  582  fis/fis_control.json                        PEB_APB_IO_BCAST x320, PEB_APB_IO x262
  464  fis/papb_bcast.json                         PEB_APB_IO x232, APB_SE x128, APB_IO x104
   16  gpio/gpio.json                              PEB_APB_IO x16
   64  hbm/ddr_csr_apb.json                        PEB_APB_IO x64
    4  hbm/dwc_hbmphy_top.json                     PEB_APB_IO x4
    4  hbm/hbm_cfg.json                            PEB_APB_IO x4
   64  hbm/hbm_hpr.json                            PEB_APB_IO x64
   64  hbm/hbm_scbr.json                           PEB_APB_IO x64
    4  hbm/hbm_xbar_cfg.json                       PEB_APB_IO x4
    2  i2c/dw_apb_i2c.json                         PEB_APB_IO x2
    2  i2c/i2c_config.json                         PEB_APB_IO x2
    4  intc/intc_1grp_msix_unit.json               APB_IO x2, PEB_APB_IO x2
  858  intc/intc_4grp_msix_unit.json               PEB_APB_IO x430, APB_SE x256, APB_IO x172
 1070  intc/intc_4grp_no_msix_unit.json            PEB_APB_IO_BCAST x640, PEB_APB_IO x430
    2  iofabric/iofabric_model.json                PEB_APB_IO x2
    2  misc/misc_model.json                        PEB_APB_IO x2
    4  misc/misc_ram_model.json                    APB_IO x2, PEB_APB_IO x2
  332  notific/notific_10_queue.json               PEB_APB_IO x166, APB_SE x128, APB_IO x38
  962  notific/notific_1_queue.json                PEB_APB_IO x428, PEB_APB_IO_BCAST x320, APB_SE x128, APB_IO x86
  218  pcie/pcie5_x8_dwc_pcie_ctl.json             PEB_APB_IO_BCAST x192, PEB_APB_IO x26
  218  pcie/pcie_appaxi_model.json                 PEB_APB_IO_BCAST x192, PEB_APB_IO x26
  218  pcie/pcie_appcore_model.json                PEB_APB_IO_BCAST x192, PEB_APB_IO x26
  436  pcie/pcie_phy_model.json                    PEB_APB_IO_BCAST x384, PEB_APB_IO x52
  190  pcie/pcie_user.json                         PEB_APB_IO_BCAST x160, PEB_APB_IO x26, APB_IO x4
   10  pll/pll_model.json                          PEB_APB_IO x10
    2  pmdtu/pmdt_cctm.json                        PEB_APB_IO x2
    4  pvt/pvt.json                                PEB_APB_IO x4
    4  rdm/rdm_model.json                          APB_IO x2, PEB_APB_IO x2
    2  ring/otp.json                               PEB_APB_IO x2
    2  ring/ring_io_bot.json                       PEB_APB_IO x2
    2  ring/ring_io_top.json                       PEB_APB_IO x2
  132  sdma/cce.json                               PEB_APB_IO x132
  132  sdma/cme.json                               PEB_APB_IO x132
  132  sdma/dre.json                               PEB_APB_IO x132
  264  sdma/tdma_model.json                        PEB_APB_IO x132, APB_SE x128, APB_IO x4
  280  sdma/udma_gen.json                          PEB_APB_IO x140, APB_SE x136, APB_IO x4
  280  sdma/udma_gen_ex.json                       PEB_APB_IO x140, APB_SE x136, APB_IO x4
  280  sdma/udma_m2s.json                          PEB_APB_IO x140, APB_SE x136, APB_IO x4
  280  sdma/udma_s2m.json                          PEB_APB_IO x140, APB_SE x136, APB_IO x4
    4  sfabric/sfabric_model.json                  PEB_APB_IO x4
    4  spis/spis_model.json                        PEB_APB_IO x4
  712  sprot/amzn_remapper.json                    PEB_APB_IO_BCAST x448, PEB_APB_IO x264
  220  sprot/nsm.json                              PEB_APB_IO_BCAST x192, PEB_APB_IO x28
 1208  sprot/qos_host_visible.json                 PEB_APB_IO x604, APB_IO x476, APB_SE x128
  528  sprot/qos_pmu.json                          PEB_APB_IO x264, APB_IO x136, APB_SE x128
 1500  sprot/qos_prot.json                         PEB_APB_IO_BCAST x896, PEB_APB_IO x604
  528  sprot/user_remapper.json                    PEB_APB_IO x264, APB_IO x136, APB_SE x128
   40  top_sp/top_sp_ram.json                      APB_IO x20, PEB_APB_IO x20
   16  tpb/tpb.json                                APB_IO x8, PEB_APB_IO x8
   16  tpb/tpb_arr_seq_cluster_host_visible.json   APB_IO x8, PEB_APB_IO x8
   16  tpb/tpb_arr_seq_top_host_visible.json       APB_IO x8, PEB_APB_IO x8
    8  tpb/tpb_arr_seq_top_protected.json          PEB_APB_IO x8
    8  tpb/tpb_ham.json                            PEB_APB_IO x8
   64  tpb/tpb_sbuf_cluster.json                   APB_IO x32, PEB_APB_IO x32
   16  tpb/tpb_sbuf_pool_act.json                  APB_IO x8, PEB_APB_IO x8
   84  tpb/tpb_xt_local_reg.json                   TPB x40, TOP_SP x20, PEB_SP x20, PREPROC x4   <== canonical shared Q7/SP IP
  264  urb/sfabric_urb.json                        PEB_APB_IO x264
  136  urb/urb.json                                PEB_APB_IO x136
   60  xtensa_nx/xtensa_nx.json                    PEB_APB_IO x60
   80  xtensa_q7/xtensa_q7.json                    PEB_APB_IO x80
                                                   --------------------------------------------
   TOTAL bound nodes across all 76 schemas = 19,012

Reading the index. The engine-window schema (tpb_xt_local_reg) binds the USER engine plane (TPB/TOP_SP/PEB_SP/PREPROC) directly. Almost every other schema binds the PEB_APB_IO* privileged control plane — Cayman exposes IP control surfaces through the PEB aperture (bit-53), mirrored into PEB_APB_IO_BCAST for the APB-broadcast variant. The handful with APB_IO/APB_SE families (cxela500, notific_*, qos_*, intc_4grp_msix, udma_*, tpb_*, top_sp_ram) are the host-visible (BAR0) duplicates of the same IP — the USER-plane view of the privileged block.

7. The join algorithm (pseudocode)

The block→schema join over the Cayman artifacts, naming the real YAML keys.

Python (the canonical join, used to build every table above)

import re, os
from collections import Counter

FLAT  = ".../address_map_flat.yaml"
CSRS  = ".../cayman-arch-regs_tgz/csrs"

NAME = re.compile(r'name:\s*([A-Za-z0-9_]+)')
JSON = re.compile(r'json:\s*(csrs/[A-Za-z0-9_/]+\.json)')
FAM  = re.compile(r'^([A-Za-z]+(?:_[A-Za-z]+)*?)_\d')   # top-family before first numeric idx

def top_family(node_name: str) -> str:
    """Leading alpha group up to the first numeric instance index (e.g. PEB_APB_IO)."""
    m = FAM.match(node_name)
    return m.group(1) if m else node_name

block_to_schema   = {}                 # node name        -> csrs/<sub>/<unit>.json
schema_to_count   = Counter()          # schema           -> #bound leaves
schema_to_family  = {}                 # schema           -> Counter(top_family)
total = bound = 0

for line in open(FLAT):
    if "name:" not in line:            # skip blank / comment lines
        continue
    name = NAME.search(line)
    if not name:
        continue
    total += 1
    j = JSON.search(line)
    if j is None:                      # ABSENT json => memory / reserved / container
        continue
    bound += 1
    node, schema = name.group(1), j.group(1)
    block_to_schema[node] = schema                       # the forward bind
    schema_to_count[schema] += 1
    schema_to_family.setdefault(schema, Counter())[top_family(node)] += 1

# coverage: schemas on disk but never bound (the orphans)
on_disk  = {f"csrs/{os.path.relpath(os.path.join(r, f), CSRS)}"
            for r, _, fs in os.walk(CSRS) for f in fs if f.endswith(".json")}
referenced = set(schema_to_count)
unplaced   = sorted(on_disk - referenced)               # 9 orphans
multi      = [s for s, fam in schema_to_family.items() if len(fam) > 1]   # 44 shared-IP

assert total == 34858 and bound == 19012
assert len(referenced) == 76 and len(on_disk) == 85 and len(unplaced) == 9
assert len(multi) == 44

C (the runtime lookup an engine reimplementation would use)

/* Forward bind: given a node name, return its schema basename, or NULL if schema-free.
 * The address map is loaded once into a sorted name->schema table; lookup is O(log n).
 * Returning NULL is a VALID answer (pure memory / reserved / container), not an error. */
const char *block_schema(const struct addr_map *m, const char *node_name)
{
    const struct map_entry *e = map_find(m, node_name);   /* bsearch by name */
    if (e == NULL || e->json[0] == '\0')                  /* absent json field */
        return NULL;                                      /* schema-free leaf  */
    return e->json;                                       /* "csrs/<sub>/<unit>.json" */
}

/* Reverse bind: enumerate every node bound to one schema (the multi-instance fan-out). */
size_t schema_blocks(const struct addr_map *m, const char *schema,
                     const char **out, size_t cap)
{
    size_t n = 0;
    for (size_t i = 0; i < m->count && n < cap; ++i)
        if (m->entries[i].json[0] && strcmp(m->entries[i].json, schema) == 0)
            out[n++] = m->entries[i].name;
    return n;                                             /* e.g. 84 for tpb_xt_local_reg */
}

GOTCHA. A NULL from block_schema is not a missing-data error — 15,846 of the 34,858 nodes are legitimately schema-free (memory / reserved / container, §5b). Treating NULL as "unknown register block" would mislabel every IRAM/DRAM/PSUM window. The only arguable false-NULL is the EVT_SEM op aperture (§4d), where the data layout is recovered from the address arithmetic rather than an attached schema.

8. Verification ledger (this session)

Re-derived [HIGH/OBSERVED] by direct parse of the shipped artifacts:

• flat YAML: 34,858 nodes; 19,012 with json:; 15,846 without; 76 distinct schemas; per-schema Counter computed.
• json_xref: 19,012 bindings; set(xref) == set(flat) → True; per-schema counts identical (0 mismatch) — independent cross-check of the inline bind.
• on-disk csrs/: 85 JSON schemas across 29 subdirs; 76 referenced, 9 unplaced (each with on-disk byte size, §5a); 0 referenced-but-missing.
• multi-instance: 44 schemas bind >1 top family (§5c).
• reverse index (§6): all 76 schemas' per-family breakdown computed; counts sum to 19,012.
• EVT_SEM: rg 'EVT_SEM' … \| rg -c 'json:' = 0 (Cayman unbound); Maverick mirror binds TPB_EVT_SEM.json (§4d).
• Maverick pkl mirror: 323,197 json:-field records streamed; 320 distinct basenames; Cayman∩Maverick = 44 shared, 32 Cayman-only (both enumerated, §4a); *_LOCAL_REG → tpb_xt_local_reg.json, tpb_top.json, al_udma_m2s_regs.json all confirmed present in the mirror (§4b/§4c).

Carried [CARRIED HIGH]: per-gen applicability cells (INV/SCL/SPC/ABS) from the gen survey; the EVT_SEM op-window layout from the CSR-16 / ADDR-08 pages; the SX-CSR schema identities from the CSR-lane page headers.

MED/INFERRED: "the ap_intc_* + intc_1grp_no_msix orphans are unplaced because they are the Maverick-gen INTC fleet" (INFERRED from the pkl binding them heavily while Cayman does not). The exact Cayman(34,858) ↔ Maverick(323,198) node-level prune mapping is not byte-reconstructed — these are different SoC instances; the reconciliation here is at schema-basename granularity (HIGH), not 1:1 node correspondence (which is MED). The "(PEB)" representative bases for PEB-only schemas are family-level, not a single grepped leaf (MED).

NOTE. Nothing here is fabricated and no vendor source snapshot was consulted. Every count, base, size, and binding traces to the shipped flat YAML / json_xref / on-disk csrs/ JSONs / Maverick pkl mirror, parsed this session (lawful interoperability reverse engineering, DMCA 17 U.S.C. §1201(f)).