# Symbol database: kind	addr	symbol	note
# kind: code | data | xdata | reg | vec
# Confirmed = semantics verified against bytes; guess = plausible, unverified
code	0x4000	vec_reset	reset vector slot 0: LJMP 0x4630 [confirmed]
code	0x4013	vec_int	vector slot 0x13: LJMP 0x60F2, interrupt handler [confirmed]
code	0x4630	startup_1	LJMP 0x466E [confirmed]
code	0x4636	init_copy	loop copying init records to direct/movx targets [confirmed]
data	0x4666	init_bitmask	01 02 04 08 10 20 40 80, read PC-relative [confirmed]
code	0x466E	startup_2	MOV DPTR,#0x4B23; enter init-table interpreter [confirmed]
code	0x4671	init_records_loop	Keil C51 INITTAB interpreter [confirmed]
data	0x4B23	init_records	C initialization records [confirmed]
code	0x50C6	main	reached when init records hit terminator [confirmed]
code	0x435F	lib_reg_cpy	multi-byte register copy (B = count), 38 call sites [confirmed]
code	0x436B	lib_reg_cpy2	34 call sites, same family [guess]
code	0x4220	lib_28	28 call sites [guess]
code	0x4281	lib_14	14 call sites [guess]
code	0x5560	h2c_poll	H2C poller: REG 0x01CC & 0x0F -> 0x8ACF [confirmed]
code	0x568A	h2c_poll_2	second poller site [confirmed]
code	0x5EE4	h2c_handoff	state-machine handoff of command payload [guess]
code	0x60F2	int_handler	interrupt handler; hang candidate [confirmed addr, role guess]
code	0x6844	main_callee_1	unexplored
code	0x7255	main_callee_2	unexplored
code	0x7842	main_callee_3	unexplored
# ROM targets (bytes not in our image)
code	0x29D9	rom_call_1	boot ROM library [confirmed target, unknown content]
code	0x2A7F	rom_call_2	boot ROM library [confirmed target, unknown content]
code	0x2FD9	rom_call_3	boot ROM library [confirmed target, unknown content]
code	0x29F2	rom_call_4	boot ROM library [confirmed target, unknown content]
# XDATA
xdata	0x01CC	REG_HMETFR	H2C mailbox pending bitmask, bit N = box N has data [confirmed]
xdata	0x01D0	REG_HMEBOX_0	box 0: cmd id byte + 3 arg bytes [confirmed]
xdata	0x01D4	REG_HMEBOX_1	box 1 [confirmed]
xdata	0x01D8	REG_HMEBOX_2	box 2 [confirmed]
xdata	0x01DC	REG_HMEBOX_3	box 3 [confirmed]
xdata	0x0088	REG_HMEBOX_EXT_0	extended args for 5+ byte commands [confirmed]
xdata	0x01C6	fw_ack_reg	fw sets bit 1 after processing a box [confirmed role, name guessed]
xdata	0x01C0	REG_MCUTST_1	host-side box-read check (kernel reg.h) [confirmed]
xdata	0x0080	REG_MCU_FW_DL	fw download control (kernel regs.h) [confirmed]
xdata	0x8ACF	fw_mail_pending	mailbox pending mask copy [confirmed]
xdata	0x8AD0	fw_cmd_flags	flags/length companion of the id [uncertain]
xdata	0x8AD1	fw_cmd_id	current H2C command id (switch value; CORRECTED 2026-11-05, was 8AD0) [confirmed]
xdata	0x8AD2	fw_cmd_args	H2C arg bytes staging (arg0 via ROM 0x29D9) [confirmed]
xdata	0x8B51	fw_state	state machine state, ring of 4 (& 3) [confirmed]
# handler-internal globals seen in first pass
xdata	0x8B10	fw_rsvdpage_loc	RSVDPAGE stores page locs here (cmd 3) [confirmed]
xdata	0x8B12	fw_ra_mask	RA_MASK mirror, also written to reg 0x01E7 (cmd 6) [confirmed]
xdata	0x8B15	fw_rssi_related	RSSI_REPORT state (cmd 5) [guess]
data	0x8923	mac_mode_table	32-entry table indexed by MAC_MODE_SEL arg0 (cmd 9) [confirmed]
data	0x4112	seq_lut	lookup table indexed by mailbox seq (0x6C cluster) [guess]
data	0x40DA	seq_lut_a	lookup tables used by 0x6C cluster [guess]
data	0x40F6	seq_lut_b	lookup tables used by 0x6C cluster [guess]
# ROM + library helpers identified by usage
code	0x29D9	rom_get_arg0	boot ROM: returns current H2C arg byte 0 in A [behavior confirmed]
code	0x4220	lib_reg_read	single MAC register read (28 xrefs) [confirmed]
code	0x6C30	h2c_mbox_sequencing	per-mailbox bookkeeping/seq checks [guess]
# H2C dispatch (switch table at 0x54B0, entries {target_hi, target_lo, case},
# 00 00 terminator + default 0x54DE; names from rtlwifi enum rtl8192c_h2c_cmd)
code	0x4394	keil_switch_walk	3-byte-entry switch table walker [confirmed]
code	0x54A6	h2c_dispatch	switch on cmd id & 0x7F [confirmed]
code	0x54B0	h2c_switch_table	12 cases + default [confirmed]
code	0x7485	h2c_default	default handler [confirmed]
code	0x748B	h2c_joinbssrpt	cmd 2 JOINBSSRPT [confirmed]
code	0x74B8	h2c_rsvdpage	cmd 3 RSVDPAGE [confirmed]
code	0x7500	h2c_rssi_report	cmd 5 RSSI_REPORT [confirmed]
code	0x7539	h2c_ra_mask	cmd 6 RA_MASK [confirmed]
code	0x7552	h2c_p2p_ps_offload	cmd 8 P2P_PS_OFFLOAD [confirmed]
code	0x740F	h2c_mac_mode_sel	cmd 9 MAC_MODE_SEL [confirmed]
code	0x56A6	h2c_cmd_0x20	cmd 32, unknown to Linux [confirmed id, role unknown]
code	0x759A	h2c_cmd_0x2C	cmd 44, unknown to Linux [confirmed id, role unknown]
code	0x541E	h2c_cmd_0x2D	cmd 45, unknown to Linux [confirmed id, role unknown]
code	0x7881	h2c_cmd_0x2E	cmd 46, unknown to Linux [confirmed id, role unknown]
code	0x7AC2	h2c_cmd_0x3B	cmd 59, unknown to Linux [confirmed id, role unknown]
code	0x7C2B	h2c_cmd_0x4B	cmd 75, unknown to Linux [confirmed id, role unknown]
code	0x5559	h2c_service	H2C service routine: poll 0x01CC, fetch, dispatch, ack [confirmed]
code	0x568A	h2c_ack_tail	clear mailbox bit, fw_state ring++, ack 0x01C6, RET [confirmed]
code	0x565D	h2c_dispatch_call	ACALL 54A6 with id in R7 [confirmed]