From b9c46bc11de40b20fc5bc97ab24330ddabc2411f Mon Sep 17 00:00:00 2001
From: Zachery Aaron Shores-Chmielewski <zacheryasc@gmail.com>
Date: Thu, 20 Aug 2026 21:53:39 +0400
Subject: [PATCH] =?UTF-8?q?P1-B:=20WA=20survey=20=E2=80=94=20120=20funcs/4?=
 =?UTF-8?q?50=20strings;=20WA=20role=20identified=20(EXT=5FCMD=20handlers:?=
 =?UTF-8?q?=20STAREC/BSS/DevInfo=20updates,=20PKTLOSS=20accounting);=20ove?=
 =?UTF-8?q?rview=20script=20fixed=20(string=20type=20filter)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/findings.md                       | 16 ++++++++++++++++
 tools/ghidra_scripts/ExportOverview.py | 19 +++++++------------
 2 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/docs/findings.md b/docs/findings.md
index e03b0b2..fc683ac 100644
--- a/docs/findings.md
+++ b/docs/findings.md
@@ -109,6 +109,22 @@ Interpretation (labelled): the patch extends boot ROM with host-comm hooks
 download-plumbing register programming — the glue the ROM needs before
 WM/WA firmware arrives.
 
+## F6 — mt7981_wa survey (2026-08-20)
+
+Ghidra project `wa` imported + analyzed: 120 functions, 450 strings.
+Strings self-identify WA's role — host command handling and TX bookkeeping
+(`MCU_EXT_CMD` protocol), matching the driver's separate WA MCU queue:
+
+- `cmdEventParserCmd` with `ucCID` printing; `EXT_CMD_ID_STAREC_UPDATE`,
+  `DevInfo Update Command`, `BssInfo Update Command` (own-MAC/BSS record
+  management), `staRec with invalid wandidx` (station records)
+- Per-STA loss accounting: `PKTLOSS[%d]times/cnt[tot_tx,drop_tx,seq]`,
+  `lost seq`, `dup seq`, `dlycnt/maxdly`, plus `[proto,port,src_ip,dest_ip]`
+  flow dump formatting
+
+Next: match `MCU_EXT_CMD_*` enum ids (mt76 headers) to `cmdEventParserCmd`
+dispatch — the ABI anchor map (P1-C/D).
+
 ## Unknowns registry
 
 - **U1 — `feature_set` bit 7 (0x80):** observed only on WM regions at
diff --git a/tools/ghidra_scripts/ExportOverview.py b/tools/ghidra_scripts/ExportOverview.py
index e89093a..07a1022 100644
--- a/tools/ghidra_scripts/ExportOverview.py
+++ b/tools/ghidra_scripts/ExportOverview.py
@@ -1,29 +1,24 @@
-# Ghidra headless post-script: dump function/strings/block overview.
-# Usage: analyzeHeadless <proj> <name> -process <prog> -noanalysis
-#   -scriptPath tools/ghidra_scripts -postScript ExportOverview.py
+# Ghidra headless post-script: dump function/string/block overview.
+# Run via PyGhidra launcher (see PLAN.md tooling notes).
 #@category Analysis
 
-from ghidra.program.model.symbol import SymbolType
-
 fm = currentProgram.getFunctionManager()
 listing = currentProgram.getListing()
 
-funcs = fm.getFunctions(True)
-n = 0
 print('=== FUNCTIONS ===')
-for f in funcs:
+n = 0
+for f in fm.getFunctions(True):
     print('%s %s' % (f.getEntryPoint(), f.getName()))
     n += 1
 print('total functions: %d' % n)
 
 print('=== STRINGS (>=6 chars) ===')
-di = listing.getDefinedData(True)
 ns = 0
-for d in di:
+for d in listing.getDefinedData(True):
     dt = d.getDataType().getName().lower()
-    if 'char' in dt or 'unicode' in dt:
+    if 'char' in dt or 'unicode' in dt or 'string' in dt:
         v = d.getValue()
-        if v and len(str(v)) >= 6:
+        if v is not None and len(str(v)) >= 6:
             print('%s %r' % (d.getAddress(), str(v)[:120]))
             ns += 1
 print('total strings: %d' % ns)