P1-B: WA survey — 120 funcs/450 strings; WA role identified (EXT_CMD handlers: STAREC/BSS/DevInfo updates, PKTLOSS accounting); overview script fixed (string type filter)

docs/findings.md

@@ -109,6 +109,22 @@ Interpretation (labelled): the patch extends boot ROM with host-comm hooks
 download-plumbing register programming — the glue the ROM needs before
 WM/WA firmware arrives.
 
+## F6 — mt7981_wa survey (2026-08-20)
+
+Ghidra project `wa` imported + analyzed: 120 functions, 450 strings.
+Strings self-identify WA's role — host command handling and TX bookkeeping
+(`MCU_EXT_CMD` protocol), matching the driver's separate WA MCU queue:
+
+- `cmdEventParserCmd` with `ucCID` printing; `EXT_CMD_ID_STAREC_UPDATE`,
+  `DevInfo Update Command`, `BssInfo Update Command` (own-MAC/BSS record
+  management), `staRec with invalid wandidx` (station records)
+- Per-STA loss accounting: `PKTLOSS[%d]times/cnt[tot_tx,drop_tx,seq]`,
+  `lost seq`, `dup seq`, `dlycnt/maxdly`, plus `[proto,port,src_ip,dest_ip]`
+  flow dump formatting
+
+Next: match `MCU_EXT_CMD_*` enum ids (mt76 headers) to `cmdEventParserCmd`
+dispatch — the ABI anchor map (P1-C/D).
+
 ## Unknowns registry
 
 - **U1 — `feature_set` bit 7 (0x80):** observed only on WM regions at

tools/ghidra_scripts/ExportOverview.py

@@ -1,29 +1,24 @@
-# Ghidra headless post-script: dump function/strings/block overview.
-# Usage: analyzeHeadless <proj> <name> -process <prog> -noanalysis
-#   -scriptPath tools/ghidra_scripts -postScript ExportOverview.py
+# Ghidra headless post-script: dump function/string/block overview.
+# Run via PyGhidra launcher (see PLAN.md tooling notes).
 #@category Analysis
 
-from ghidra.program.model.symbol import SymbolType
-
 fm = currentProgram.getFunctionManager()
 listing = currentProgram.getListing()
 
-funcs = fm.getFunctions(True)
-n = 0
 print('=== FUNCTIONS ===')
-for f in funcs:
+n = 0
+for f in fm.getFunctions(True):
     print('%s %s' % (f.getEntryPoint(), f.getName()))
     n += 1
 print('total functions: %d' % n)
 
 print('=== STRINGS (>=6 chars) ===')
-di = listing.getDefinedData(True)
 ns = 0
-for d in di:
+for d in listing.getDefinedData(True):
     dt = d.getDataType().getName().lower()
-    if 'char' in dt or 'unicode' in dt:
+    if 'char' in dt or 'unicode' in dt or 'string' in dt:
         v = d.getValue()
-        if v and len(str(v)) >= 6:
+        if v is not None and len(str(v)) >= 6:
             print('%s %r' % (d.getAddress(), str(v)[:120]))
             ns += 1
 print('total strings: %d' % ns)