1 Address overlap

The DMA register slot was decoded as 8 KB, so slots 0 and 1 overlap.

Decode addr[15:12] into the 4 KB APB slots.

The overlap checker rejects the map and a clean SBR CTRL write no longer changes DMA data bit 0.

2 Reset release order

rst_cpu_n released with rst_sys_n, so the first fetch outran the fabric.

Release the CPU last, after the 8 clk_sys gap and 2 clk_cpu synchroniser.

The reset trace shows the documented order and the first fetch receives RVALID.

3 Mis-wired interrupt

irq_dma was tied to spare INTC input 6 instead of input 1.

Connect input 1 and drive a per-input connectivity test.

Forcing DMA completion sets RAW bit 1 and not bit 6.

4 Width and addressing

The APB path supplied word addresses while the DMA decodes byte offsets; 0x10 became 0x04.

Connect apb_paddr[7:0] without an extra word-address shift.

STATUS, LEN and KEY decode at their byte offsets and unmapped accesses return the expected error.

5 Unsynchronised crossing

irq_dma entered clk_per without the required two-flop synchroniser.

Synchronise every INTC input in the controller clock domain.

The crossing review finds the two flops and repeated jobs no longer lose the level.

6 Missing isolation

Only 112 of the 114 PD_SW-to-PD_AON signals were clamped; irq_dma and irq_sbr were omitted.

Add clamp-to-0 cells before switch-off and assert the isolation order.

The isolation census totals 47 + 52 + 13 + 2 = 114 and RAW stays clear in SLEEP.

7 Secure attribute

SBR control reset with NS=1, but SRAM1 is secure-only.

Secure software clears CTRL.NS before the SRAM1 transfer.

The access carries the secure attribute and the first SRAM1 beat no longer returns STATUS.ERR.

8 Stream length mismatch

The SBR and DMA LEN registers contained different word counts.

Write one n_words value to both registers and check both before start.

SBR LEN=32 with DMA LEN=64 gives ERR and COUNT=32; SBR LEN=64 with DMA LEN=32 gives DMA DONE at 32 while SBR remains BUSY. Equal lengths complete both blocks.

9 Contract traps

Writes while BUSY were ignored, ERR was sticky, and rewriting CTRL cleared IRQ_EN.

Wait for BUSY=0 before KEY or LEN, write STATUS=0x6 to clear both causes, and CTRL=0x3 to start with IRQ_EN.

The corrected job uses the new KEY; after the error test both causes clear and irq drops; reading CTRL confirms IRQ_EN remains set after start.

10 Gated-clock hang

The DMA clock stopped while the bridge had no timeout, so PREADY never arrived.

Complete the access with a 256-cycle bridge watchdog and return SLVERR.

The liveness test terminates with SLVERR instead of hanging until reset.

Same-bank performance trap

The Stage 1 worked checks compare separate banks at 361.4 MB/s per direction with a shared single-port bank at 180.7 MB/s per direction. Record the placement and both rates; the functional result alone cannot close a throughput claim.

Open SBR attribute control in v1

The Stage 3 and final worked checks reproduce a non-secure register write that clears NS and reaches SRAM1. The final check then models a secure-write guard and proves the access is refused. Keep the weakness open until the guard or a secure-only slot is implemented and independently verified.