Save Selector Dispatch Table Context

Route map1_01a -> map2_02d; general table 0x00440538; save-selector table 0x00440720; slice offset 0x7a; generic dispatcher 0x00402321 indexed call 0x0040234c uses u8.

save-selector slice anchored: True; save-selector direct runtime dispatch proof found: False; proof found: False; failed dispatch table gates: save-selector-slice-runtime-dispatch, descriptor-boundary-runtime-bridge, dynamic-save-selector-table-base-candidate, route-relevant-slice-table-base-switch; missing evidence count: 4; evidence refs: 3; descriptor boundary depends on save-selector slice model: True; route-relevant table-base switch rows: 6; data descriptors byte-reachable through generic dispatcher: 0; dynamic indexed dispatch rows: 3; dynamic dispatch classifications: {"seh-registration-scope-table-callback":1,"seh-scope-table-callback":2}; dynamic SEH scope-table callback count: 3; dynamic SEH scope-table callback sites: 0x00438456, 0x004390b7, 0x004390f3; dynamic save-selector table-base immediate candidates: 0; dynamic save-selector table-base static candidates: 0; save-selector table-base arithmetic scan rows/candidates: 116/0; dynamic save-selector table-base candidate sites: -; selected-root execution dispatch ref found: False; promotion status: blocked.

The current save-selector decoder is anchored to the 0x00440720 table slice, which starts 0x7a entries after the generic 0x00440538 dispatch table. The EXE contains one direct indexed dispatch immediate for the generic table at 0x0040234c and no direct indexed dispatch or dword reference to 0x00440720 itself. Relative save-selector opcodes still map consistently to the expected handlers through that slice, including byte-reachable selected-pointer handlers 0x07/0x08/0x09 and branch-state handlers 0x10..0x13, but this is static decoder anchoring only. Route-relevant low bytes that become data descriptors under the slice do not resolve the same way through the raw generic table, and the descriptor-stop rows require a save-selector table-base switch rather than the observed u8 generic indexed dispatcher. A .text scan finds only a small set of dynamic register-base indexed call sites; all three match an SEH scope-table callback pattern and none has a nearby immediate reference to 0x00440720. A separate table-base arithmetic scan covers direct absolute indexed dispatches plus those dynamic sites and finds no nearby general-table+0x1e8 or direct save-selector-table base candidate, so there is still no static table-base switch candidate for the save-selector slice. The descriptor boundary classification therefore depends on the static save-selector slice model until runtime proves that control is dispatching the current stream through that slice. It does not prove that selector root 2:0 executes on the normal route.

Table References

Relative Opcode Rows

Route-Relevant Raw vs Slice Rows

Dynamic Indexed Dispatch Rows

Dynamic SEH Scope-Table Callback Rows

Dynamic Save-Selector Table-Base Candidate Rows

Save-Selector Table-Base Arithmetic Rows

Remaining Proofs

• prove at runtime that the current 2:0 root is selected and executed
• prove the VM/control-flow mode or dynamic table-base switch that interprets the current stream through the 0x00440720 slice
• prove that route-relevant descriptor boundaries are reached through the save-selector slice, not just modeled statically
• keep requiring a strict map1_01a source hotspot or equivalent runtime trigger