# ECP5 VM jail-break probe record — 2026-09-27

## Result and scope

Company-authored physical-board engineering evidence: the first direct
attack of the deployed interpreter's confinement on hardware. A new volatile
ECP5 image (`board-vm-jailbreak`, built from the current tree with the same
GHDL/yosys/nextpnr pipeline as the 2026-09-26 VM-to-arm image, NEORV32
top `board_timing_top`) places canary bytes immediately around the whole
interpreter state (`Vm`) and a sentinel elsewhere in data memory, then runs
seventeen baked probe programs against the machine the untrusted planner
would face:

- window fill/verify across all 512 bytes (placement truth),
- every out-of-bounds shape the public emulator bounty series used: word and
  half loads at 511/512, word store at 509, half store at 511,
  register-form store at 512, and a base constructed as 1<<31,
- the address-wrap shape (base 0xFFFFFFFE + offset 2),
- the frame-pointer write and shift-by-32 rails,
- a capability hammer (out-of-range joint index, extreme setpoints, a seal
  request, ten calls),
- an infinite loop against instruction fuel, and
- three malformed programs the loader must reject.

Retained raw UART (1 Mbaud) reported `JB:SUMMARY pass=17 fail=0` on every
captured boot — at least five complete, identical suites across the JTAG load
resets. No canary byte changed, no canary word appeared in the proposal
sink, the wrapped read returned window content rather than canary data, and
the loop halted at exactly the 1024-step fuel budget. Runtime address
arithmetic confirmed the canaries are genuinely adjacent to the interpreter
state (`delta_post = sizeof(Vm)`).

The image was JTAG-loaded into volatile SRAM only. No configuration flash,
expansion pin, product I/O or actuator was used.

## What this establishes

The rustc/RV32IMC translation of the proven interpreter, running on the
deployed NEORV32 image, held the memory bound, the capability bound and the
fuel bound under every probe shape this suite mounts, with instrumentation
around the interpreter rather than around a simulation of it. It is the
hardware counterpart of the emulator bounty's "boundary held" verdicts for the
interpreter-isolation class.

Scope: the interpreter-isolation class, with canaries guarding the
interpreter-struct boundary. PMP, fabric authority and physical-envelope
properties have their own records.

## Reproducibility

The completed internal record is
`evidence/runs/2026-09-27-ecp5-jailbreak-001/manifest.json`. It retains the
frozen source (current tree plus the fixture, hashed), the private NEORV32
checkout revision, the firmware and bitstream with SHA-256, the full build
log, tool versions, and the raw UART capture of every boot observed.