Round 29: sub-checkpoints inside scanout driver probe

RESEARCH.md

@@ -1101,3 +1101,35 @@ Reboot, select Internal storage. Expect: bands → black → then either
 frozen black with WHITE TEXT (transcribe it! esr/FAR/ELR tell us the
 exact fault), or a hang at some band stage. Report the band stack
 (yellow/pink/gray) and any text.
+
+## Round 29 — crash localized inside the driver probe; step-by-step bands
+
+Round 28 (`d1e78b0f…`, PANIC_HANG): **purple (bind) + magenta (probe
+entered), frozen; no gray, no pink, no text.** Decode:
+- The crash is inside mt8183_scanout_probe, between entry (magenta,
+  y=500) and geometry resolution (gray, y=620) — and NOT in any of the
+  handled error paths (no red bands).
+- Why no abort text despite PANIC_HANG: at this point the vidconsole
+  doesn't exist yet, so printf output goes to the pre-console buffer
+  and the dump is invisible. Expected — not a contradiction.
+- Note the magenta band itself proves post-reloc mmu_map_region + MMIO
+  read of 0x14008f40 + fb write work (dcache on). Remaining suspects
+  between magenta and gray: revival MMIO writes (same 4K page as the
+  working read — unlikely), mmu_map_region(0xffed9000, 4K) (first
+  non-fb, non-DRAM mapping post-reloc — prime suspect),
+  find_framebuffer() reads of the coreboot table, format check.
+
+### Round 29 payload (`35376f63…`, flashed, cmp+vbutil OK)
+
+Sub-checkpoints inside the probe (all 20-row bands below magenta):
+- **mint** y=520: revival writes done
+- **violet** y=540: coreboot table mapped
+- **pale yellow** y=560: LBIO found
+- **pale cyan** y=580: format OK
+- red bands on the handled failures unchanged (y=780/800/820/840)
+
+### Ask
+
+Reboot and report which of mint/violet/pale-yellow/pale-cyan appear
+below the magenta band. The first missing one identifies the aborting
+statement.