From 67438d99c230f9f5566e00a5e04914b42784ef83 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Tue, 23 Jun 2026 21:21:06 +0300
Subject: [PATCH 01/31] sponsorship: FTWDMA

---
 README | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/README b/README
index 2c0cae2..fd3227d 100644
--- a/README
+++ b/README
@@ -192,11 +192,13 @@ Windows device-history cleanup
 
 SPECIAL THANKS
 --------------
-  TrueTuring     sponsorship, NVMe and xHCI fixes
+  FTWDMA         Sponsorship
+                 https://ftwdma.com
+  TrueTuring     Sponsorship, NVMe and xHCI fixes
                  https://github.com/TrueTuring
-  pcileech-fpga  the FPGA framework this project builds upon
+  pcileech-fpga  The FPGA framework this project builds upon
                  https://github.com/ufrisk/pcileech-fpga
-  CaptainDMA     for best FPGA DMA hardware
+  CaptainDMA     For best FPGA DMA hardware
                  https://captaindma.com
 
 

From b4ab213713543e459adf8bb09c2827b325392138 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Tue, 23 Jun 2026 21:38:43 +0300
Subject: [PATCH 02/31] updated special thanks

---
 README | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/README b/README
index fd3227d..b9f0ca5 100644
--- a/README
+++ b/README
@@ -196,11 +196,10 @@ SPECIAL THANKS
                  https://ftwdma.com
   TrueTuring     Sponsorship, NVMe and xHCI fixes
                  https://github.com/TrueTuring
+  CaptainDMA     Sponsorship
+                 https://captaindma.com
   pcileech-fpga  The FPGA framework this project builds upon
                  https://github.com/ufrisk/pcileech-fpga
-  CaptainDMA     For best FPGA DMA hardware
-                 https://captaindma.com
-
 
 LICENSE
 -------

From be0d31fb1b0994dad1315918e285e83806af8ff8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Thu, 25 Jun 2026 04:22:36 +0300
Subject: [PATCH 03/31] lint generated hdl with verilator

---
 .github/workflows/ci.yml                 |  26 +++++
 .gitignore                               |   1 +
 Makefile                                 |  11 ++-
 README                                   |  25 ++---
 cmd/pcileechgen/fixtures.go              |  49 ++++++++++
 go.mod                                   |   2 +-
 go.sum                                   |   2 +
 internal/donor/synthetic/builder.go      | 105 +++++++++++++++++++++
 internal/donor/synthetic/builder_test.go |  72 ++++++++++++++
 internal/firmware/devclass/strategy.go   |   8 ++
 internal/firmware/scrub/pcie_inject.go   |   3 +-
 scripts/hdl-lint-negative-test.sh        |  57 +++++++++++
 scripts/hdl-lint.sh                      |  79 ++++++++++++++++
 testdata/.verilator.vlt                  |   8 ++
 testdata/donors/audio.json               | 115 +++++++++++++++++++++++
 testdata/donors/ethernet.json            | 115 +++++++++++++++++++++++
 testdata/donors/generic.json             | 115 +++++++++++++++++++++++
 testdata/donors/gpu.json                 | 115 +++++++++++++++++++++++
 testdata/donors/nvme.json                | 115 +++++++++++++++++++++++
 testdata/donors/sata.json                | 115 +++++++++++++++++++++++
 testdata/donors/thunderbolt.json         | 115 +++++++++++++++++++++++
 testdata/donors/wifi.json                | 115 +++++++++++++++++++++++
 testdata/donors/xhci.json                | 115 +++++++++++++++++++++++
 testdata/stubs/blackbox.sv               |  15 +++
 24 files changed, 1482 insertions(+), 16 deletions(-)
 create mode 100644 cmd/pcileechgen/fixtures.go
 create mode 100644 internal/donor/synthetic/builder.go
 create mode 100644 internal/donor/synthetic/builder_test.go
 create mode 100755 scripts/hdl-lint-negative-test.sh
 create mode 100755 scripts/hdl-lint.sh
 create mode 100644 testdata/.verilator.vlt
 create mode 100644 testdata/donors/audio.json
 create mode 100644 testdata/donors/ethernet.json
 create mode 100644 testdata/donors/generic.json
 create mode 100644 testdata/donors/gpu.json
 create mode 100644 testdata/donors/nvme.json
 create mode 100644 testdata/donors/sata.json
 create mode 100644 testdata/donors/thunderbolt.json
 create mode 100644 testdata/donors/wifi.json
 create mode 100644 testdata/donors/xhci.json
 create mode 100644 testdata/stubs/blackbox.sv

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 022617c..db4a79d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,3 +44,29 @@ jobs:
           valColorRange: ${{ steps.coverage.outputs.percentage }}
           maxColorRange: 100
           minColorRange: 0
+
+  hdl-lint:
+    name: HDL Lint (Verilator)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          submodules: recursive
+
+      - name: Install Verilator
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y verilator
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Build pcileechgen
+        run: make build
+
+      - name: Run HDL lint
+        run: make hdl-lint
diff --git a/.gitignore b/.gitignore
index bb1e692..53f161c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,6 +9,7 @@ pcileech_datastore/
 *.bit
 *.json
 !internal/board/boards.json
+!testdata/donors/*.json
 
 # Go
 *.exe
diff --git a/Makefile b/Makefile
index 7efebbd..9918a28 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build test lint clean install
+.PHONY: build test lint clean install fixtures hdl-lint
 
 BINARY_NAME=pcileechgen
 BUILD_DIR=bin
@@ -31,6 +31,15 @@ clean:
 	rm -rf $(BUILD_DIR)
 	rm -f coverage.out coverage.html
 
+# generate synthetic donor fixture jsons
+fixtures: build
+	$(BUILD_DIR)/$(BINARY_NAME) fixtures --out testdata/donors
+
+# lint generated sv with verilator
+hdl-lint: build
+	@command -v verilator >/dev/null 2>&1 || { echo "verilator not installed; see Makefile"; exit 1; }
+	./scripts/hdl-lint.sh
+
 # Install binary to GOPATH/bin
 install:
 	$(GO) install $(GOFLAGS) -ldflags "$(LDFLAGS)" ./cmd/pcileechgen/
diff --git a/README b/README
index b9f0ca5..807502c 100644
--- a/README
+++ b/README
@@ -4,7 +4,7 @@ Custom firmware generator for PCILeech FPGA boards. Reads a real PCI/PCIe
 donor device through VFIO, clones its identity (config space, BARs,
 capabilities), and builds a ready-to-flash .bin bitstream via Vivado.
 
-Help / Discord: https://discord.gg/kcWVCAhNSg
+Discord Community: https://discord.gg/kcWVCAhNSg
 
 ******************************************************************************
 * WARNING: FOR EDUCATIONAL AND RESEARCH USE ONLY                             *
@@ -26,6 +26,18 @@ PREREQUISITES
   (intel_iommu=on or amd_iommu=on).
 
 
+SPECIAL THANKS
+--------------
+  FTWDMA         Sponsorship
+                 https://ftwdma.com
+  TrueTuring     Sponsorship, NVMe and xHCI fixes
+                 https://github.com/TrueTuring
+  CaptainDMA     Sponsorship
+                 https://captaindma.com
+  pcileech-fpga  The FPGA framework this project builds upon
+                 https://github.com/ufrisk/pcileech-fpga
+
+
 HOW IT WORKS
 ------------
   scan  ->  check  ->  build  ->  flash
@@ -190,17 +202,6 @@ Windows device-history cleanup
   the device.
 
 
-SPECIAL THANKS
---------------
-  FTWDMA         Sponsorship
-                 https://ftwdma.com
-  TrueTuring     Sponsorship, NVMe and xHCI fixes
-                 https://github.com/TrueTuring
-  CaptainDMA     Sponsorship
-                 https://captaindma.com
-  pcileech-fpga  The FPGA framework this project builds upon
-                 https://github.com/ufrisk/pcileech-fpga
-
 LICENSE
 -------
   Creative Commons Zero v1.0 Universal (CC0-1.0)
diff --git a/cmd/pcileechgen/fixtures.go b/cmd/pcileechgen/fixtures.go
new file mode 100644
index 0000000..6b006e8
--- /dev/null
+++ b/cmd/pcileechgen/fixtures.go
@@ -0,0 +1,49 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/sercanarga/pcileechgen/internal/donor/synthetic"
+	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
+	"github.com/spf13/cobra"
+)
+
+var fixturesOpts struct {
+	out string
+}
+
+var fixturesCmd = &cobra.Command{
+	Use:   "fixtures",
+	Short: "Generate synthetic donor fixtures for CI HDL verification",
+	Long: "Writes one representative device_context.json per device class.",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if err := os.MkdirAll(fixturesOpts.out, 0o755); err != nil {
+			return fmt.Errorf("create output dir: %w", err)
+		}
+		for _, class := range devclass.AllClasses() {
+			ctx := synthetic.Build(class)
+			if ctx == nil {
+				return fmt.Errorf("no synthetic builder for class %q", class)
+			}
+			data, err := json.MarshalIndent(ctx, "", "  ")
+			if err != nil {
+				return fmt.Errorf("marshal %s: %w", class, err)
+			}
+			path := filepath.Join(fixturesOpts.out, class+".json")
+			if err := os.WriteFile(path, data, 0o644); err != nil {
+				return fmt.Errorf("write %s: %w", path, err)
+			}
+			fmt.Println("wrote", path)
+		}
+		return nil
+	},
+}
+
+func init() {
+	fixturesCmd.Flags().StringVar(&fixturesOpts.out, "out", "testdata/donors",
+		"output directory for fixture JSON files")
+	rootCmd.AddCommand(fixturesCmd)
+}
diff --git a/go.mod b/go.mod
index dfb9ce0..d302779 100644
--- a/go.mod
+++ b/go.mod
@@ -10,5 +10,5 @@ require (
 
 require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 )
diff --git a/go.sum b/go.sum
index 5f99fe6..51eeaa6 100644
--- a/go.sum
+++ b/go.sum
@@ -6,6 +6,8 @@ github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
 github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
diff --git a/internal/donor/synthetic/builder.go b/internal/donor/synthetic/builder.go
new file mode 100644
index 0000000..241b014
--- /dev/null
+++ b/internal/donor/synthetic/builder.go
@@ -0,0 +1,105 @@
+// Package synthetic builds donor device contexts for CI fixture generation.
+package synthetic
+
+import (
+	"time"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+	"github.com/sercanarga/pcileechgen/internal/version"
+)
+
+type classProfile struct {
+	vendorID   uint16
+	deviceID   uint16
+	classCode  uint32
+	headerType uint8
+	bar0Size   uint64
+}
+
+var profiles = map[string]classProfile{
+	devclass.ClassNVMe:        {0x144d, 0xa809, 0x010802, 0x00, 0x4000},
+	devclass.ClassXHCI:        {0x8086, 0x9d2f, 0x0c0330, 0x00, 0x10000},
+	devclass.ClassEthernet:    {0x8086, 0x15b7, 0x020000, 0x00, 0x20000},
+	devclass.ClassAudio:       {0x8086, 0x9d71, 0x040300, 0x00, 0x4000},
+	devclass.ClassGPU:         {0x10de, 0x1b06, 0x030000, 0x00, 0x4000},
+	devclass.ClassSATA:        {0x8086, 0x9d03, 0x010601, 0x00, 0x2000},
+	devclass.ClassWiFi:        {0x8086, 0x24fd, 0x028000, 0x00, 0x2000},
+	devclass.ClassThunderbolt: {0x8086, 0x15d9, 0x080700, 0x00, 0x4000},
+	devclass.ClassGeneric:     {0x1234, 0x5678, 0x000000, 0x00, 0x1000},
+}
+
+// Build returns a representative DeviceContext for class, or nil if unknown.
+func Build(class string) *donor.DeviceContext {
+	p, ok := profiles[class]
+	if !ok {
+		return nil
+	}
+	cs := buildConfigSpace(p)
+	// Capabilities are populated by parsing the config space, mirroring how
+	// donor.FromJSON / collector populate real donor contexts (the field is a
+	// denormalized cache; the scrub pipeline re-parses the config space).
+	return &donor.DeviceContext{
+		CollectedAt: time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
+		ToolVersion: version.Version,
+		Hostname:    "ci-synthetic",
+		Device: pci.PCIDevice{
+			BDF:        pci.BDF{Bus: 0x03, Device: 0x00, Function: 0x0},
+			VendorID:   p.vendorID,
+			DeviceID:   p.deviceID,
+			ClassCode:  p.classCode,
+			HeaderType: p.headerType,
+		},
+		ConfigSpace:  cs,
+		BARs:         buildBARs(p.bar0Size),
+		Capabilities: pci.ParseCapabilities(cs),
+	}
+}
+
+func buildConfigSpace(p classProfile) *pci.ConfigSpace {
+	cs := &pci.ConfigSpace{Size: pci.ConfigSpaceLegacySize}
+	cs.WriteU16(0x00, p.vendorID)
+	cs.WriteU16(0x02, p.deviceID)
+	cs.WriteU8(0x08, 0x01)
+	cs.WriteU8(0x09, byte(p.classCode))
+	cs.WriteU8(0x0A, byte(p.classCode>>8))
+	cs.WriteU8(0x0B, byte(p.classCode>>16))
+	cs.WriteU8(0x0E, p.headerType)
+
+	cs.WriteU16(0x06, 0x0010)
+
+	cs.WriteU8(0x34, 0x40)
+
+	cs.WriteU8(0x40, pci.CapIDPowerManagement)
+	cs.WriteU8(0x41, 0x48)
+	cs.WriteU16(0x42, 0x0003)
+	cs.WriteU16(0x44, 0x0008)
+	cs.WriteU16(0x46, 0x0000)
+
+	cs.WriteU8(0x48, pci.CapIDMSI)
+	cs.WriteU8(0x49, 0x54)
+	cs.WriteU16(0x4A, 0x0000)
+	cs.WriteU32(0x4C, 0x00000000)
+	cs.WriteU16(0x50, 0x0000)
+	cs.WriteU16(0x52, 0x0000)
+
+	cs.WriteU8(0x54, pci.CapIDPCIExpress)
+	cs.WriteU8(0x55, 0x00)
+	cs.WriteU16(0x56, 0x0002)
+
+	return cs
+}
+
+func buildBARs(bar0Size uint64) []pci.BAR {
+	raw := uint32(^(bar0Size - 1)) & 0xFFFFFFF0
+	return []pci.BAR{
+		{
+			Index:    0,
+			RawValue: raw,
+			Address:  0,
+			Size:     bar0Size,
+			Type:     "mem32",
+		},
+	}
+}
diff --git a/internal/donor/synthetic/builder_test.go b/internal/donor/synthetic/builder_test.go
new file mode 100644
index 0000000..75b61de
--- /dev/null
+++ b/internal/donor/synthetic/builder_test.go
@@ -0,0 +1,72 @@
+package synthetic
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestBuild_RoundTrip(t *testing.T) {
+	for _, class := range devclass.AllClasses() {
+		t.Run(class, func(t *testing.T) {
+			ctx := Build(class)
+			if ctx == nil {
+				t.Fatalf("Build(%q) returned nil", class)
+			}
+			data, err := json.Marshal(ctx)
+			if err != nil {
+				t.Fatalf("marshal: %v", err)
+			}
+			got, err := donor.FromJSON(data)
+			if err != nil {
+				t.Fatalf("FromJSON: %v", err)
+			}
+			if got.Device.ClassCode != ctx.Device.ClassCode {
+				t.Errorf("class code lost in round-trip: got %#x want %#x",
+					got.Device.ClassCode, ctx.Device.ClassCode)
+			}
+			if len(got.BARs) == 0 {
+				t.Error("no BARs after round-trip; BAR0 needed for BAR model build")
+			}
+			if got.Device.VendorID != ctx.Device.VendorID {
+				t.Errorf("vendor ID lost in round-trip: got %#x want %#x",
+					got.Device.VendorID, ctx.Device.VendorID)
+			}
+			if len(got.BARs) > 0 && got.BARs[0].Size != ctx.BARs[0].Size {
+				t.Errorf("BAR0 size lost in round-trip: got %d want %d",
+					got.BARs[0].Size, ctx.BARs[0].Size)
+			}
+		})
+	}
+}
+
+func TestBuild_UnknownClassReturnsNil(t *testing.T) {
+	if Build("does-not-exist") != nil {
+		t.Error("Build with unknown class should return nil")
+	}
+}
+
+func TestBuild_HasPCIeCapability(t *testing.T) {
+	for _, class := range devclass.AllClasses() {
+		t.Run(class, func(t *testing.T) {
+			ctx := Build(class)
+			if ctx == nil {
+				t.Fatalf("Build(%q) returned nil", class)
+			}
+			caps := pci.ParseCapabilities(ctx.ConfigSpace)
+			found := false
+			for _, c := range caps {
+				if c.ID == pci.CapIDPCIExpress {
+					found = true
+					break
+				}
+			}
+			if !found {
+				t.Errorf("%s: config space has no PCIe capability after parse", class)
+			}
+		})
+	}
+}
diff --git a/internal/firmware/devclass/strategy.go b/internal/firmware/devclass/strategy.go
index 27a393d..77a1e30 100644
--- a/internal/firmware/devclass/strategy.go
+++ b/internal/firmware/devclass/strategy.go
@@ -12,6 +12,14 @@ const (
 	ClassGeneric     = "generic"
 )
 
+// AllClasses returns all supported device class strings.
+func AllClasses() []string {
+	return []string{
+		ClassNVMe, ClassXHCI, ClassEthernet, ClassAudio, ClassGPU,
+		ClassSATA, ClassWiFi, ClassThunderbolt, ClassGeneric,
+	}
+}
+
 // DeviceStrategy centralizes device-class-specific behavior.
 type DeviceStrategy interface {
 	ClassName() string
diff --git a/internal/firmware/scrub/pcie_inject.go b/internal/firmware/scrub/pcie_inject.go
index 5fe1bd1..f2af45a 100644
--- a/internal/firmware/scrub/pcie_inject.go
+++ b/internal/firmware/scrub/pcie_inject.go
@@ -160,8 +160,7 @@ func injectPCIeCapIfMissing(cs *pci.ConfigSpace, b *board.Board, om *overlay.Map
 		om.WriteU16(0x06, status|0x0010, "set Capabilities List bit in Status")
 	}
 
-	// ensure CapPtr is valid when there are no existing caps
-	if len(ctx.Caps) == 0 && cs.CapabilityPointer() == 0 {
+	if len(ctx.Caps) == 0 {
 		slog.Info("donor has no capability chain, creating minimal PM + MSI + PCIe chain")
 		injectFullCapChain(cs, b, om, ctx)
 		return
diff --git a/scripts/hdl-lint-negative-test.sh b/scripts/hdl-lint-negative-test.sh
new file mode 100755
index 0000000..9ed1408
--- /dev/null
+++ b/scripts/hdl-lint-negative-test.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# verify verilator catches real errors (smoke test)
+set -euo pipefail
+command -v verilator >/dev/null 2>&1 || { echo "verilator missing"; exit 1; }
+
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+# undefined module
+cat > "$TMP/uses_undefined.sv" <<'EOF'
+module uses_undefined(input wire clk);
+  wire x;
+  nonexistent_module u_nonexistent(.clk(clk), .o(x));
+endmodule
+EOF
+if verilator --lint-only -Wno-fatal "$TMP/uses_undefined.sv" testdata/stubs/blackbox.sv \
+     >"$TMP/a.log" 2>&1; then
+  echo "NEGATIVE TEST (a) FAILED: lint passed on undefined module"; exit 1
+fi
+echo "OK (a): undefined module correctly fails lint"
+
+# syntax error
+cat > "$TMP/syntax_err.sv" <<'EOF'
+module syntax_err(input wire clk
+endmodule
+EOF
+if verilator --lint-only -Wno-fatal "$TMP/syntax_err.sv" \
+     >"$TMP/b.log" 2>&1; then
+  echo "NEGATIVE TEST (b) FAILED: lint passed on syntax error"; exit 1
+fi
+echo "OK (b): syntax error correctly fails lint"
+
+# CQE field order
+cat > "$TMP/cqe_bad.sv" <<'EOF'
+module cqe_bad(input wire clk);
+  logic [31:0] cqe_dw2;
+  logic [15:0] sq_head;
+  logic [15:0] cmd_cid;
+  // Intentionally wrong: spec wants {sq_head, cmd_cid}.
+  assign cqe_dw2 = {cmd_cid, sq_head};
+endmodule
+EOF
+if verilator --lint-only --Wall -Wno-fatal "$TMP/cqe_bad.sv" \
+     >"$TMP/c.log" 2>&1; then
+  # This is a WARNING-level issue (WIDTH), not an error.
+  # Verilator 5+ may pass with WIDTH only. Check for WIDTH in the log.
+  if grep -q 'WIDTH\|UNUSED\|UNDEF' "$TMP/c.log"; then
+    echo "OK (c): CQE-packing structural issue caught (WIDTH/UNUSED in log)"
+  else
+    echo "WARN (c): CQE-packing test produced no warnings — structural field-order"
+    echo "       issues may need elaboration-level detection or sim (phase 2)."
+  fi
+else
+  echo "OK (c): CQE-packing test correctly fails lint"
+fi
+
+echo ""
+echo "All negative checks passed."
diff --git a/scripts/hdl-lint.sh b/scripts/hdl-lint.sh
new file mode 100755
index 0000000..4fbcc0d
--- /dev/null
+++ b/scripts/hdl-lint.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# lint generated SV across all donor fixtures and boards
+set -uo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+require() { command -v "$1" >/dev/null 2>&1 || { echo "missing dep: $1" >&2; exit 1; }; }
+require verilator
+require ./bin/pcileechgen
+
+FIXTURES=(testdata/donors/*.json)
+# Board names come from the CLI so the matrix stays in sync with board.go.
+# (NR>2 skips the two-line table header; bash 3.2 compat via while-read.)
+BOARDS=()
+while IFS= read -r line; do BOARDS+=("$line"); done < <(
+  ./bin/pcileechgen boards | awk 'NR>2 && $1!="----" && $1!="" && $1!="Total:"{print $1}'
+)
+
+if [ "${#BOARDS[@]}" -eq 0 ]; then
+  echo "ERROR: no boards parsed from 'pcileechgen boards'" >&2
+  exit 1
+fi
+
+# whitelist of svgen output files (primitives like pcileech_fifo.sv are blackboxed)
+SVGEN_PATTERN='pcileech_bar_impl_device.sv|pcileech_tlps128_bar_controller.sv|pcileech_bar_impl_msi.sv|tlp_latency_emulator.sv|device_config.sv|pcileech_msix_table.sv|pcileech_nvme_admin_responder.sv|pcileech_nvme_dma_bridge.sv|pcileech_hda_rirb_dma.sv|pcileech_hda_msi.sv'
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+total=0; pass=0; skip=0; fail=0
+
+for fixture in "${FIXTURES[@]}"; do
+  class="$(basename "$fixture" .json)"
+  for board in "${BOARDS[@]}"; do
+    total=$((total+1))
+    cell="${class}×${board}"
+    out="$TMP/$class/$board"
+    mkdir -p "$out"
+
+    build_log="$out/build.log"
+    if ! ./bin/pcileechgen build --from-json "$fixture" --board "$board" \
+          --skip-vivado --output "$out" --force >"$build_log" 2>&1; then
+      # Donor BAR > board BRAM (or other benign incompatibility): skip, do not fail CI.
+      echo "SKIP  $cell (build incompatible — see $build_log)"
+      skip=$((skip+1))
+      continue
+    fi
+
+    sv_files=()
+    while IFS= read -r f; do sv_files+=("$f"); done < <(
+      find "$out" -name '*.sv' -print \
+        | grep -E "$SVGEN_PATTERN" \
+        | sort
+    )
+
+    if [ "${#sv_files[@]}" -eq 0 ]; then
+      echo "SKIP  $cell (no svgen SV emitted)"
+      skip=$((skip+1))
+      continue
+    fi
+
+    lint_log="$out/verilator.log"
+    if verilator --lint-only -Wno-fatal --top-module pcileech_bar_impl_device \
+          +incdir+"$out/src" \
+          "${sv_files[@]}" testdata/stubs/blackbox.sv \
+          >"$lint_log" 2>&1; then
+      echo "PASS  $cell"
+      pass=$((pass+1))
+    else
+      echo "FAIL  $cell (see $lint_log)"
+      cat "$lint_log" >&2
+      fail=$((fail+1))
+    fi
+  done
+done
+
+echo "HDL lint: total=$total pass=$pass skip=$skip fail=$fail"
+[ "$fail" -eq 0 ]
diff --git a/testdata/.verilator.vlt b/testdata/.verilator.vlt
new file mode 100644
index 0000000..e4d55c9
--- /dev/null
+++ b/testdata/.verilator.vlt
@@ -0,0 +1,8 @@
+`verilator_config`
+
+/* verilator lint_off DECLFILENAME */
+/* verilator lint_off UNUSED */
+/* verilator lint_off CASEINCOMPLETE */
+/* verilator lint_off PINMISSING */
+/* verilator lint_off BLKSEQ */
+/* verilator lint_off WIDTH */
diff --git a/testdata/donors/audio.json b/testdata/donors/audio.json
new file mode 100644
index 0000000..53310bd
--- /dev/null
+++ b/testdata/donors/audio.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 32902,
+    "device_id": 40305,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 262912,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "9d718086",
+    "00100000",
+    "04030001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294950912,
+      "address": 0,
+      "size": 16384,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/ethernet.json b/testdata/donors/ethernet.json
new file mode 100644
index 0000000..104716a
--- /dev/null
+++ b/testdata/donors/ethernet.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 32902,
+    "device_id": 5559,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 131072,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "15b78086",
+    "00100000",
+    "02000001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294836224,
+      "address": 0,
+      "size": 131072,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/generic.json b/testdata/donors/generic.json
new file mode 100644
index 0000000..ce98f0f
--- /dev/null
+++ b/testdata/donors/generic.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 4660,
+    "device_id": 22136,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 0,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "56781234",
+    "00100000",
+    "00000001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294963200,
+      "address": 0,
+      "size": 4096,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/gpu.json b/testdata/donors/gpu.json
new file mode 100644
index 0000000..6eaaa44
--- /dev/null
+++ b/testdata/donors/gpu.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 4318,
+    "device_id": 6918,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 196608,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "1b0610de",
+    "00100000",
+    "03000001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294950912,
+      "address": 0,
+      "size": 16384,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/nvme.json b/testdata/donors/nvme.json
new file mode 100644
index 0000000..29bdc51
--- /dev/null
+++ b/testdata/donors/nvme.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 5197,
+    "device_id": 43017,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 67586,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "a809144d",
+    "00100000",
+    "01080201",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294950912,
+      "address": 0,
+      "size": 16384,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/sata.json b/testdata/donors/sata.json
new file mode 100644
index 0000000..0d64c7a
--- /dev/null
+++ b/testdata/donors/sata.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 32902,
+    "device_id": 40195,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 67073,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "9d038086",
+    "00100000",
+    "01060101",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294959104,
+      "address": 0,
+      "size": 8192,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/thunderbolt.json b/testdata/donors/thunderbolt.json
new file mode 100644
index 0000000..e78e67c
--- /dev/null
+++ b/testdata/donors/thunderbolt.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 32902,
+    "device_id": 5593,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 526080,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "15d98086",
+    "00100000",
+    "08070001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294950912,
+      "address": 0,
+      "size": 16384,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/wifi.json b/testdata/donors/wifi.json
new file mode 100644
index 0000000..7e35292
--- /dev/null
+++ b/testdata/donors/wifi.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 32902,
+    "device_id": 9469,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 163840,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "24fd8086",
+    "00100000",
+    "02800001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294959104,
+      "address": 0,
+      "size": 8192,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/donors/xhci.json b/testdata/donors/xhci.json
new file mode 100644
index 0000000..c838f62
--- /dev/null
+++ b/testdata/donors/xhci.json
@@ -0,0 +1,115 @@
+{
+  "collected_at": "2026-01-01T00:00:00Z",
+  "tool_version": "b4ab213-7-ga15c776",
+  "hostname": "ci-synthetic",
+  "device": {
+    "bdf": {
+      "Domain": 0,
+      "Bus": 3,
+      "Device": 0,
+      "Function": 0
+    },
+    "vendor_id": 32902,
+    "device_id": 40239,
+    "subsys_vendor_id": 0,
+    "subsys_device_id": 0,
+    "revision_id": 0,
+    "class_code": 787248,
+    "header_type": 0
+  },
+  "config_space_hex": [
+    "9d2f8086",
+    "00100000",
+    "0c033001",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000040",
+    "00000000",
+    "00000000",
+    "00034801",
+    "00000008",
+    "00005405",
+    "00000000",
+    "00000000",
+    "00020010",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000",
+    "00000000"
+  ],
+  "config_space_size": 256,
+  "bars": [
+    {
+      "index": 0,
+      "raw_value": 4294901760,
+      "address": 0,
+      "size": 65536,
+      "type": "mem32",
+      "prefetchable": false,
+      "is_64bit": false
+    }
+  ],
+  "capabilities": [
+    {
+      "id": 1,
+      "offset": 64,
+      "data": "AUgDAAgAAAA="
+    },
+    {
+      "id": 5,
+      "offset": 72,
+      "data": "BVQAAAAAAAAAAAAA"
+    },
+    {
+      "id": 16,
+      "offset": 84,
+      "data": "EAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  ]
+}
\ No newline at end of file
diff --git a/testdata/stubs/blackbox.sv b/testdata/stubs/blackbox.sv
new file mode 100644
index 0000000..ac28244
--- /dev/null
+++ b/testdata/stubs/blackbox.sv
@@ -0,0 +1,15 @@
+// stub xilinx modules so verilator can resolve svgen port refs
+`timescale 1ns/1ps
+`default_nettype none
+
+module pcileech_pcie_cfg_a7 (
+    input  wire        clk,
+    input  wire        rst
+);
+endmodule
+
+module pcileech_fifo (
+    input  wire        clk,
+    input  wire        rst
+);
+endmodule

From 21ff04ec4ef7779409a86d2006ec36dade71bfc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Thu, 25 Jun 2026 04:32:53 +0300
Subject: [PATCH 04/31] updated readme

---
 README | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/README b/README
index 807502c..a0ed33d 100644
--- a/README
+++ b/README
@@ -16,16 +16,6 @@ Discord Community: https://discord.gg/kcWVCAhNSg
 ******************************************************************************
 
 
-PREREQUISITES
--------------
-  - Go 1.26+
-  - Linux with IOMMU/VFIO enabled
-  - Vivado 2023.2+ (for synthesis)
-
-  VFIO needs IOMMU enabled in BIOS and in the kernel parameters
-  (intel_iommu=on or amd_iommu=on).
-
-
 SPECIAL THANKS
 --------------
   FTWDMA         Sponsorship
@@ -38,6 +28,16 @@ SPECIAL THANKS
                  https://github.com/ufrisk/pcileech-fpga
 
 
+PREREQUISITES
+-------------
+  - Go 1.26+
+  - Linux with IOMMU/VFIO enabled
+  - Vivado 2023.2+ (for synthesis)
+
+  VFIO needs IOMMU enabled in BIOS and in the kernel parameters
+  (intel_iommu=on or amd_iommu=on).
+
+
 HOW IT WORKS
 ------------
   scan  ->  check  ->  build  ->  flash

From 600770d2c518c04f38db4e17f28cc001eae03383 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 04:49:47 +0200
Subject: [PATCH 05/31] feat(trace): add mmio live trace capture command

---
 README                        |   1 +
 cmd/pcileechgen/mmio_trace.go | 160 ++++++++++++++++++++++++++++++++++
 2 files changed, 161 insertions(+)
 create mode 100644 cmd/pcileechgen/mmio_trace.go

diff --git a/README b/README
index a0ed33d..83449ca 100644
--- a/README
+++ b/README
@@ -72,6 +72,7 @@ COMMANDS
   build            generate firmware artifacts (+ Vivado)
   validate         verify artifacts match the donor context
   verify-manifest  check SHA256 integrity of build output
+  mmio-trace       capture live BAR MMIO access trace from donor
   boards           list supported FPGA boards
   version          print version
 
diff --git a/cmd/pcileechgen/mmio_trace.go b/cmd/pcileechgen/mmio_trace.go
new file mode 100644
index 0000000..16300e7
--- /dev/null
+++ b/cmd/pcileechgen/mmio_trace.go
@@ -0,0 +1,160 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/sercanarga/pcileechgen/internal/color"
+	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
+	"github.com/sercanarga/pcileechgen/internal/donor/mmio"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+	"github.com/spf13/cobra"
+)
+
+type mmioTraceOptions struct {
+	bdf        string
+	duration   time.Duration
+	barIndex   int
+	barSize    int
+	classCode  string
+	jsonOutput bool
+	outputFile string
+}
+
+var mmioTraceOpts mmioTraceOptions
+
+var mmioTraceCmd = &cobra.Command{
+	Use:   "mmio-trace",
+	Short: "Capture live donor MMIO accesses with mmiotrace",
+	Long: `Captures MMIO BAR accesses for a short duration using the kernel mmiotrace tracer.
+
+Example:
+  pcileechgen mmio-trace --bdf 0000:03:00.0 --duration 5s
+  pcileechgen mmio-trace --bdf 03:00.0 --bar-size 4096 --class-code 0x010802`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if _, err := pci.ParseBDF(mmioTraceOpts.bdf); err != nil {
+			return fmt.Errorf("invalid BDF %q: %w", mmioTraceOpts.bdf, err)
+		}
+		if mmioTraceOpts.barIndex < 0 || mmioTraceOpts.barIndex > 5 {
+			return fmt.Errorf("--bar-index must be between 0 and 5")
+		}
+		if mmioTraceOpts.barSize <= 0 || mmioTraceOpts.barSize > 16*1024*1024 {
+			return fmt.Errorf("--bar-size must be between 1 and 16MB")
+		}
+		if mmioTraceOpts.duration <= 0 {
+			return fmt.Errorf("--duration must be greater than zero")
+		}
+
+		classCode, err := parseTraceClassCode(mmioTraceOpts.classCode)
+		if err != nil {
+			return err
+		}
+
+		start := time.Now()
+		trace, err := mmio.LiveTrace(mmioTraceOpts.bdf, mmioTraceOpts.duration)
+		if err != nil {
+			return fmt.Errorf("trace capture failed: %w", err)
+		}
+
+		trace.BARIndex = mmioTraceOpts.barIndex
+		trace.BARSize = mmioTraceOpts.barSize
+		trace.Duration = mmioTraceOpts.duration
+		trace.StartTime = start
+
+		pattern := mmio.Analyze(trace)
+		profile := behavior.FromMMIOTrace(trace, classCode)
+		timing := behavior.ExtractTimingHistogram(trace)
+
+		if mmioTraceOpts.jsonOutput {
+			report := map[string]any{
+				"trace":            trace,
+				"analysis":         pattern,
+				"behavior_profile": profile,
+				"timing_histogram": timing,
+			}
+			enc := json.NewEncoder(cmd.OutOrStdout())
+			enc.SetIndent("", "  ")
+			if err := enc.Encode(report); err != nil {
+				return fmt.Errorf("render JSON report: %w", err)
+			}
+		} else {
+			printMMIOTraceReport(cmd.OutOrStdout(), trace, pattern, profile, timing)
+		}
+
+		if mmioTraceOpts.outputFile != "" {
+			traceData, err := json.MarshalIndent(trace, "", "  ")
+			if err != nil {
+				return fmt.Errorf("marshal trace: %w", err)
+			}
+			if err := os.WriteFile(mmioTraceOpts.outputFile, traceData, 0o644); err != nil {
+				return fmt.Errorf("write %q: %w", mmioTraceOpts.outputFile, err)
+			}
+			fmt.Fprintln(cmd.ErrOrStderr(), color.OK(fmt.Sprintf("saved trace to %s", mmioTraceOpts.outputFile)))
+		}
+
+		return nil
+	},
+}
+
+func parseTraceClassCode(raw string) (uint32, error) {
+	if strings.TrimSpace(raw) == "" {
+		return 0, nil
+	}
+
+	r := strings.TrimSpace(raw)
+	if !strings.HasPrefix(r, "0x") && !strings.HasPrefix(r, "0X") {
+		r = "0x" + r
+	}
+
+	v, err := strconv.ParseUint(r, 0, 24)
+	if err != nil {
+		return 0, fmt.Errorf("invalid --class-code %q: %w", raw, err)
+	}
+
+	return uint32(v), nil
+}
+
+func printMMIOTraceReport(out io.Writer, trace *mmio.TraceResult, pattern *mmio.AccessPattern, profile *behavior.Profile, timing *behavior.TimingHistogram) {
+	if out == nil {
+		return
+	}
+
+	fmt.Fprintln(out, color.Header("MMIO Trace Capture"))
+	fmt.Fprintf(out, "BDF: %s\n", trace.BDF)
+	fprintf := fmt.Fprintf
+	fprintf(out, "BAR index: %d | bar size: %d\n", trace.BARIndex, trace.BARSize)
+	fprintf(out, "Duration: %s | records: %d\n\n", trace.Duration, len(trace.Records))
+
+	if len(trace.Records) == 0 {
+		fmt.Fprintln(out, color.Warn("No MMIO records were captured.\n"))
+		return
+	}
+
+	fmt.Fprintln(out, mmio.FormatReport(pattern))
+
+	fmt.Fprintln(out, color.Header("Behavior Profile"))
+	fprintf(out, "%s\n", behavior.FormatReport(profile))
+
+	fprintf(out, color.Header("Timing Histogram")+"\n")
+	fprintf(out, "Samples: %d\n", timing.SampleCount)
+	fprintf(out, "Min cycles: %d\n", timing.MinCycles)
+	fprintf(out, "Median cycles: %d\n", timing.MedianCycles)
+	fprintf(out, "Max cycles: %d\n", timing.MaxCycles)
+}
+
+func init() {
+	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.bdf, "bdf", "", "device BDF address (e.g. 0000:03:00.0)")
+	mmioTraceCmd.Flags().DurationVar(&mmioTraceOpts.duration, "duration", 5*time.Second, "trace length (e.g. 5s, 1m)")
+	mmioTraceCmd.Flags().IntVar(&mmioTraceOpts.barIndex, "bar-index", 0, "BAR index that was targeted for this trace")
+	mmioTraceCmd.Flags().IntVar(&mmioTraceOpts.barSize, "bar-size", 4096, "expected BAR size hint in bytes")
+	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.classCode, "class-code", "", "PCI class code in hex (e.g. 0x010802)")
+	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.outputFile, "output", "", "save raw trace JSON to file")
+	mmioTraceCmd.Flags().BoolVar(&mmioTraceOpts.jsonOutput, "json", false, "emit machine-readable report")
+	_ = mmioTraceCmd.MarkFlagRequired("bdf")
+	rootCmd.AddCommand(mmioTraceCmd)
+}

From 436060ddebebf95dd5afc0ed2abda18ab98da4fc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Thu, 25 Jun 2026 20:16:10 +0300
Subject: [PATCH 06/31] add per-bit write-1-to-clear masks to bar model, probe,
 and hdl emitter

---
 internal/donor/bar_profiler.go                |  40 +++--
 internal/donor/bar_profiler_classify_test.go  |  45 +++++
 internal/donor/context_w1c_test.go            |  46 ++++++
 internal/firmware/barmodel/model.go           | 117 ++++++++++---
 internal/firmware/barmodel/model_test.go      | 154 ++++++++++++++++++
 internal/firmware/devclass/audio.go           |   6 +-
 internal/firmware/devclass/profile.go         |   1 +
 internal/firmware/devclass/w1c_masks_test.go  |  45 +++++
 internal/firmware/devclass/xhci.go            |   4 +-
 internal/firmware/svgen/generator.go          |   8 +
 internal/firmware/svgen/generic_w1c_test.go   | 106 ++++++++++++
 .../svgen/templates/bar_impl_device.sv.tmpl   |   9 +-
 12 files changed, 533 insertions(+), 48 deletions(-)
 create mode 100644 internal/donor/bar_profiler_classify_test.go
 create mode 100644 internal/donor/context_w1c_test.go
 create mode 100644 internal/firmware/devclass/w1c_masks_test.go
 create mode 100644 internal/firmware/svgen/generic_w1c_test.go

diff --git a/internal/donor/bar_profiler.go b/internal/donor/bar_profiler.go
index 83a0bc9..8988111 100644
--- a/internal/donor/bar_profiler.go
+++ b/internal/donor/bar_profiler.go
@@ -12,7 +12,8 @@ type BARProbeResult struct {
 	Offset    uint32 `json:"offset"`
 	Original  uint32 `json:"original"`
 	RWMask    uint32 `json:"rw_mask"`    // 1 = writable bit
-	MaybeRW1C bool   `json:"maybe_rw1c"` // write-1-to-clear suspect
+	W1CMask   uint32 `json:"w1c_mask"`   // bits that self-cleared on write-of-1
+	MaybeRW1C bool   `json:"maybe_rw1c"` // true if W1CMask != 0
 }
 
 // BARProfile is the full probe output for one BAR.
@@ -94,6 +95,16 @@ func probeRegisters(mem []byte, size int) []BARProbeResult {
 	return probes
 }
 
+// classifyRegisterBits derives the RW mask and the W1C-suspect mask from probe
+// readbacks. Split out from probeOneRegister so it can be tested without a device.
+func classifyRegisterBits(allOnes, allZeros, testVal, afterWrite uint32) (rwMask, w1cMask uint32) {
+	rwMask = allOnes ^ allZeros
+	if rwMask != 0 {
+		w1cMask = testVal & ^afterWrite & rwMask
+	}
+	return
+}
+
 // probeOneRegister does the write-readback dance on one DWORD.
 func probeOneRegister(mem []byte, offset uint32) BARProbeResult {
 	off := int(offset)
@@ -109,30 +120,25 @@ func probeOneRegister(mem []byte, offset uint32) BARProbeResult {
 	binary.LittleEndian.PutUint32(mem[off:off+4], 0x00000000)
 	allZeros := binary.LittleEndian.Uint32(mem[off : off+4])
 
-	// put it back
-	binary.LittleEndian.PutUint32(mem[off:off+4], original)
-
-	// RW mask: bits that flipped between all-ones and all-zeros
+	// W1C probe: write 1s to writable bits and read back, to see which self-clear.
 	rwMask := allOnes ^ allZeros
-
-	// RW1C check: write 1s to writable bits, see if they self-clear
-	maybeRW1C := false
+	var testVal, afterWrite uint32
 	if rwMask != 0 {
-		testVal := original | rwMask
+		testVal = original | rwMask
 		binary.LittleEndian.PutUint32(mem[off:off+4], testVal)
-		afterWrite := binary.LittleEndian.Uint32(mem[off : off+4])
-		cleared := testVal & ^afterWrite & rwMask
-		if cleared != 0 {
-			maybeRW1C = true
-		}
-		// Restore again
-		binary.LittleEndian.PutUint32(mem[off:off+4], original)
+		afterWrite = binary.LittleEndian.Uint32(mem[off : off+4])
 	}
 
+	// put it back
+	binary.LittleEndian.PutUint32(mem[off:off+4], original)
+
+	_, w1cMask := classifyRegisterBits(allOnes, allZeros, testVal, afterWrite)
+
 	return BARProbeResult{
 		Offset:    offset,
 		Original:  original,
 		RWMask:    rwMask,
-		MaybeRW1C: maybeRW1C,
+		W1CMask:   w1cMask,
+		MaybeRW1C: w1cMask != 0,
 	}
 }
diff --git a/internal/donor/bar_profiler_classify_test.go b/internal/donor/bar_profiler_classify_test.go
new file mode 100644
index 0000000..4b28b3c
--- /dev/null
+++ b/internal/donor/bar_profiler_classify_test.go
@@ -0,0 +1,45 @@
+package donor
+
+import "testing"
+
+func TestClassifyRegisterBits_RWOnly(t *testing.T) {
+	rw, w1c := classifyRegisterBits(0xFF, 0x00, 0xFF, 0xFF)
+	if rw != 0xFF {
+		t.Errorf("rwMask: got 0x%X, want 0xFF", rw)
+	}
+	if w1c != 0 {
+		t.Errorf("w1cMask: got 0x%X, want 0", w1c)
+	}
+}
+
+func TestClassifyRegisterBits_DetectsW1C(t *testing.T) {
+	rw, w1c := classifyRegisterBits(0x100, 0x00, 0x100, 0x00)
+	if rw != 0x100 {
+		t.Errorf("rwMask: got 0x%X, want 0x100", rw)
+	}
+	if w1c != 0x100 {
+		t.Errorf("w1cMask: got 0x%X, want 0x100", w1c)
+	}
+}
+
+func TestClassifyRegisterBits_MixedRWandW1C(t *testing.T) {
+	rw, w1c := classifyRegisterBits(0x103, 0x00, 0x103, 0x003)
+	if rw != 0x103 {
+		t.Errorf("rwMask: got 0x%X, want 0x103", rw)
+	}
+	if w1c != 0x100 {
+		t.Errorf("w1cMask: got 0x%X, want 0x100", w1c)
+	}
+}
+
+func TestProfileBARFromBuffer_NoW1COnPlainBuffer(t *testing.T) {
+	prof := ProfileBARFromBuffer(make([]byte, 16), 0)
+	for _, p := range prof.Probes {
+		if p.W1CMask != 0 {
+			t.Errorf("reg 0x%X: W1CMask 0x%X, want 0", p.Offset, p.W1CMask)
+		}
+		if p.MaybeRW1C {
+			t.Errorf("reg 0x%X: MaybeRW1C true, want false", p.Offset)
+		}
+	}
+}
diff --git a/internal/donor/context_w1c_test.go b/internal/donor/context_w1c_test.go
new file mode 100644
index 0000000..793ba84
--- /dev/null
+++ b/internal/donor/context_w1c_test.go
@@ -0,0 +1,46 @@
+package donor
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestDeviceContext_W1CMaskRoundTrip(t *testing.T) {
+	ctx := &DeviceContext{
+		CollectedAt: time.Now(),
+		ConfigSpace: pci.NewConfigSpace(),
+		BARProfiles: map[int]*BARProfile{
+			0: {BarIndex: 0, Size: 4096, Probes: []BARProbeResult{
+				{Offset: 0x10, Original: 0x000000FF, RWMask: 0x000000FF, W1CMask: 0x00000010, MaybeRW1C: true},
+				{Offset: 0x14, Original: 0x00000000, RWMask: 0x00000000},
+			}},
+		},
+	}
+	data, err := ctx.ToJSON()
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+	if !strings.Contains(string(data), `"w1c_mask": 16`) {
+		t.Errorf("W1CMask not serialized; output:\n%s", string(data))
+	}
+	ctx2, err := FromJSON(data)
+	if err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	prof := ctx2.BARProfiles[0]
+	if prof == nil {
+		t.Fatal("BARProfiles[0] missing")
+	}
+	var w1c uint32
+	for _, p := range prof.Probes {
+		if p.Offset == 0x10 {
+			w1c = p.W1CMask
+		}
+	}
+	if w1c != 0x00000010 {
+		t.Errorf("W1CMask round-trip: got 0x%08X, want 0x00000010", w1c)
+	}
+}
diff --git a/internal/firmware/barmodel/model.go b/internal/firmware/barmodel/model.go
index 2ff38f0..a28c8b9 100644
--- a/internal/firmware/barmodel/model.go
+++ b/internal/firmware/barmodel/model.go
@@ -16,8 +16,9 @@ type BARRegister struct {
 	Width       int    // 1, 2, or 4 bytes
 	Reset       uint32 // reset/initial value (from donor snapshot or spec default)
 	RWMask      uint32 // writable bits (1 = host can write, 0 = read-only)
+	W1CMask     uint32 // write-1-to-clear bits (1 = host writes 1 to clear, 0 = untouched)
 	Name        string // human-readable register name
-	IsRW1C      bool   // true if this register uses write-1-to-clear semantics
+	IsRW1C      bool   // true if any W1C bits are present
 	IsFSMDriven bool   // true if driven by a dedicated FSM always block (excluded from generic reset/write)
 }
 
@@ -45,26 +46,55 @@ func BuildBARModel(barData []byte, classCode uint32, profile *donor.BARProfile)
 	}
 
 	// fall back to hardcoded spec tables
+	model := specBARModelForClass(classCode, barData)
+	if model != nil {
+		validateModel(model)
+	}
+	return model
+}
+
+// specBARModelForClass returns the hardcoded spec model for a class, or nil.
+func specBARModelForClass(classCode uint32, barData []byte) *BARModel {
 	baseClass := (classCode >> 16) & 0xFF
 	subClass := (classCode >> 8) & 0xFF
 	progIF := classCode & 0xFF
-
-	var model *BARModel
 	switch {
 	case baseClass == 0x01 && subClass == 0x08 && progIF == 0x02:
-		model = buildNVMeBARModel(barData)
+		return buildNVMeBARModel(barData)
 	case baseClass == 0x0C && subClass == 0x03 && progIF == 0x30:
-		model = buildXHCIBARModel(barData)
+		return buildXHCIBARModel(barData)
 	case baseClass == 0x02:
-		model = buildEthernetBARModel(barData)
+		return buildEthernetBARModel(barData)
 	case baseClass == 0x04 && subClass == 0x03:
-		model = buildAudioBARModel(barData)
+		return buildAudioBARModel(barData)
 	}
+	return nil
+}
 
-	if model != nil {
-		validateModel(model)
+// specRegAttr carries the W1CMask and IsFSMDriven flags the spec assigns to a
+// known offset, so a probe-synthesized model stays consistent with the spec.
+type specRegAttr struct {
+	W1CMask     uint32
+	IsFSMDriven bool
+}
+
+// specRegisterAttrs returns the spec attributes for every offset the spec model
+// marks as W1C or device-driven.
+func specRegisterAttrs(classCode uint32) map[uint32]specRegAttr {
+	spec := specBARModelForClass(classCode, nil)
+	if spec == nil {
+		return nil
 	}
-	return model
+	var out map[uint32]specRegAttr
+	for _, r := range spec.Registers {
+		if r.W1CMask != 0 || r.IsFSMDriven {
+			if out == nil {
+				out = make(map[uint32]specRegAttr)
+			}
+			out[r.Offset] = specRegAttr{W1CMask: r.W1CMask, IsFSMDriven: r.IsFSMDriven}
+		}
+	}
+	return out
 }
 
 // validateModel checks for misaligned or duplicate offsets.
@@ -81,6 +111,22 @@ func validateModel(m *BARModel) {
 		if prev, ok := seen[r.Offset]; ok {
 			panic(fmt.Sprintf("barmodel: %s and %s share offset 0x%X", prev, r.Name, r.Offset))
 		}
+		// RW and W1C masks must be disjoint: a bit can't be both plain-writable
+		// and write-1-to-clear.
+		if r.W1CMask&r.RWMask != 0 {
+			panic(fmt.Sprintf("barmodel: register %s at offset 0x%X has overlapping W1C/RW masks (W1CMask=0x%08X & RWMask=0x%08X = 0x%08X) — they must be disjoint",
+				r.Name, r.Offset, r.W1CMask, r.RWMask, r.W1CMask&r.RWMask))
+		}
+		if r.Width > 0 {
+			var widthMask uint32 = 0xFFFFFFFF
+			if bits := r.Width * 8; bits < 32 {
+				widthMask = (1 << bits) - 1
+			}
+			if r.W1CMask&^widthMask != 0 || r.RWMask&^widthMask != 0 {
+				panic(fmt.Sprintf("barmodel: register %s at offset 0x%X has mask bits beyond Width %d (W1CMask=0x%08X, RWMask=0x%08X, valid=0x%08X)",
+					r.Name, r.Offset, r.Width, r.W1CMask, r.RWMask, widthMask))
+			}
+		}
 		seen[r.Offset] = r.Name
 	}
 }
@@ -156,7 +202,7 @@ func buildXHCIBARModel(barData []byte) *BARModel {
 		// operational regs
 		{Offset: 0x20, Width: 4, Name: "USBCMD", RWMask: 0x00002F0E, IsFSMDriven: true},
 		// USBSTS (mostly RW1C)
-		{Offset: 0x24, Width: 4, Name: "USBSTS", RWMask: 0x00000000, IsFSMDriven: true},
+		{Offset: 0x24, Width: 4, Name: "USBSTS", RWMask: 0x00000000, W1CMask: 0x0000041C, IsFSMDriven: true},
 		// Page Size (read-only)
 		{Offset: 0x28, Width: 4, Name: "PAGESIZE", RWMask: 0x00000000},
 		// Device Notification Control
@@ -302,7 +348,7 @@ func buildAudioBARModel(barData []byte) *BARModel {
 		{Offset: 0x48, Width: 4, Name: "CORBWP_CORBRP", RWMask: 0x0000FFFF, IsFSMDriven: true},
 		// CORBCTL(8) + CORBSTS(8) + CORBSIZE(8) packed
 		// CORBCTL: bit 1 (CORBRUN), bit 0 (CMEIE) writable; CORBSTS: bit 0 -> DWORD bit 8 (RPWP) RW1C; CORBSIZE: RO
-		{Offset: 0x4C, Width: 4, Name: "CORBCTL_STS_SIZE", RWMask: 0x00030003, IsRW1C: true},
+		{Offset: 0x4C, Width: 4, Name: "CORBCTL_STS_SIZE", RWMask: 0x00030003, W1CMask: 0x00000100, IsRW1C: true},
 		// RIRB lower base address
 		{Offset: 0x50, Width: 4, Name: "RIRBLBASE", RWMask: 0xFFFFFF80},
 		// RIRB upper base address
@@ -312,9 +358,9 @@ func buildAudioBARModel(barData []byte) *BARModel {
 		// RIRBCTL(8) + RIRBSTS(8) + RIRBSIZE(8)
 		// RIRBCTL: bit 0 (RINTCTL), bit 1 (RIRBDMAEN), bit 2 (OIC) writable
 		// RIRBSTS: bit 8 (RINTFL) RW1C, bit 9 (OIS) RW1C
-		{Offset: 0x5C, Width: 4, Name: "RIRBCTL_STS_SIZE", RWMask: 0x00000007, IsRW1C: true, IsFSMDriven: true},
+		{Offset: 0x5C, Width: 4, Name: "RIRBCTL_STS_SIZE", RWMask: 0x00000007, W1CMask: 0x00000700, IsRW1C: true, IsFSMDriven: true},
 		// RIRBINTSTS - RIRB interrupt status (RW1C: bit 0 INTFL)
-		{Offset: 0x60, Width: 4, Name: "RIRBINTSTS", RWMask: 0x00000001, IsRW1C: true, IsFSMDriven: true},
+		{Offset: 0x60, Width: 4, Name: "RIRBINTSTS", RWMask: 0x00000000, W1CMask: 0x00000001, IsRW1C: true, IsFSMDriven: true},
 		// IC (Immediate Command) - driver writes codec command
 		{Offset: 0x64, Width: 4, Name: "IC", RWMask: 0xFFFFFFFF},
 		// IR (Immediate Response) - driver reads codec response (RO)
@@ -386,19 +432,24 @@ func buildAudioBARModel(barData []byte) *BARModel {
 	}
 }
 
-// SynthesizeBARModel builds a model from probe data.
-// Drops dead regs and treats RW1C as RO.
+// SynthesizeBARModel builds a model from probe data, reconciling it with the spec.
+// Spec-known W1C bits win over the probe and are emitted as real W1C; bits the
+// probe flagged as W1C at unknown offsets are clamped to read-only (the probe is
+// not trustworthy enough to emit live W1C hardware for them).
 func SynthesizeBARModel(profile *donor.BARProfile, classCode uint32) *BARModel {
 	if profile == nil || len(profile.Probes) == 0 {
 		return nil
 	}
 
 	nameHints := classRegisterNames(classCode)
+	attrs := specRegisterAttrs(classCode)
 
 	var regs []BARRegister
 	for _, probe := range profile.Probes {
-		// skip dead regs
-		if probe.Original == 0 && probe.RWMask == 0 {
+		attr := attrs[probe.Offset]
+		// Drop dead regs, but keep ones the spec knows about — a status register
+		// legitimately reads 0 when idle.
+		if probe.Original == 0 && probe.RWMask == 0 && attr.W1CMask == 0 && !attr.IsFSMDriven {
 			continue
 		}
 
@@ -408,16 +459,32 @@ func SynthesizeBARModel(profile *donor.BARProfile, classCode uint32) *BARModel {
 		}
 
 		rwMask := probe.RWMask
-		if probe.MaybeRW1C {
-			rwMask = 0 // RW1C -> force RO
+		var w1cMask uint32
+		isRW1C := false
+
+		// Spec W1C bits are authoritative.
+		if attr.W1CMask != 0 {
+			w1cMask = attr.W1CMask
+			isRW1C = true
+			rwMask &^= attr.W1CMask
+		}
+
+		// Probe-suspected W1C bits are forced read-only, not emitted as W1C.
+		if probe.W1CMask != 0 {
+			rwMask &^= probe.W1CMask
+		} else if probe.MaybeRW1C {
+			rwMask = 0
 		}
 
 		regs = append(regs, BARRegister{
-			Offset: probe.Offset,
-			Width:  4,
-			Reset:  probe.Original,
-			RWMask: rwMask,
-			Name:   name,
+			Offset:      probe.Offset,
+			Width:       4,
+			Reset:       probe.Original,
+			RWMask:      rwMask,
+			W1CMask:     w1cMask,
+			Name:        name,
+			IsRW1C:      isRW1C,
+			IsFSMDriven: attr.IsFSMDriven,
 		})
 	}
 
diff --git a/internal/firmware/barmodel/model_test.go b/internal/firmware/barmodel/model_test.go
index 115f947..632a2cf 100644
--- a/internal/firmware/barmodel/model_test.go
+++ b/internal/firmware/barmodel/model_test.go
@@ -674,3 +674,157 @@ func TestIsProbeDataReliable_AllRW(t *testing.T) {
 		t.Error("all-RW probes should be considered unreliable")
 	}
 }
+
+func TestAudioModel_W1CMasks(t *testing.T) {
+	model := buildAudioBARModel(nil)
+	got := map[uint32]uint32{}
+	for _, r := range model.Registers {
+		got[r.Offset] = r.W1CMask
+	}
+	if got[0x4C] != 0x00000100 {
+		t.Errorf("0x4C W1CMask: got 0x%08X, want 0x00000100", got[0x4C])
+	}
+	if got[0x5C] != 0x00000700 {
+		t.Errorf("0x5C W1CMask: got 0x%08X, want 0x00000700", got[0x5C])
+	}
+	if got[0x60] != 0x00000001 {
+		t.Errorf("0x60 W1CMask: got 0x%08X, want 0x00000001", got[0x60])
+	}
+}
+
+func TestAudioModel_RIRBINTSTS_RWMaskCleared(t *testing.T) {
+	model := buildAudioBARModel(nil)
+	for _, r := range model.Registers {
+		if r.Offset == 0x60 {
+			if r.RWMask != 0 {
+				t.Errorf("0x60 RWMask: got 0x%08X, want 0 (bit0 is W1C)", r.RWMask)
+			}
+			return
+		}
+	}
+	t.Error("0x60 not found")
+}
+
+func TestAudioModel_W1CMasksDisjointFromRW(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("audio model has overlapping W1C/RW masks: %v", r)
+		}
+	}()
+	model := BuildBARModel(nil, 0x040300, nil)
+	if model == nil {
+		t.Fatal("audio model nil")
+	}
+	for _, r := range model.Registers {
+		if r.W1CMask&r.RWMask != 0 {
+			t.Errorf("register %s @ 0x%X: W1CMask 0x%08X overlaps RWMask 0x%08X", r.Name, r.Offset, r.W1CMask, r.RWMask)
+		}
+	}
+}
+
+func TestXHCIModel_USBSTS_W1CMask(t *testing.T) {
+	model := BuildBARModel(nil, 0x0C0330, nil)
+	for _, r := range model.Registers {
+		if r.Name == "USBSTS" {
+			if r.W1CMask != 0x0000041C {
+				t.Errorf("USBSTS W1CMask: got 0x%08X, want 0x0000041C", r.W1CMask)
+			}
+			if r.RWMask != 0 {
+				t.Errorf("USBSTS RWMask: got 0x%08X, want 0", r.RWMask)
+			}
+			return
+		}
+	}
+	t.Error("USBSTS not found")
+}
+
+func TestSynthesizeBARModel_SpecW1C_EmitsRealW1C(t *testing.T) {
+	profile := &donor.BARProfile{Size: 4096, Probes: []donor.BARProbeResult{
+		{Offset: 0x4C, Original: 0x00820000, RWMask: 0x00030003},
+	}}
+	model := SynthesizeBARModel(profile, 0x040300)
+	if model == nil {
+		t.Fatal("model nil")
+	}
+	r := model.Registers[0]
+	if r.W1CMask != 0x00000100 {
+		t.Errorf("spec W1C at 0x4C: W1CMask got 0x%08X, want 0x00000100", r.W1CMask)
+	}
+	if !r.IsRW1C {
+		t.Error("spec W1C at 0x4C: IsRW1C should be true")
+	}
+	if r.RWMask&0x100 != 0 {
+		t.Error("spec W1C bit8 must be cleared from RWMask")
+	}
+}
+
+func TestSynthesizeBARModel_ProbeSuspected_BitwiseRO(t *testing.T) {
+	profile := &donor.BARProfile{Size: 4096, Probes: []donor.BARProbeResult{
+		{Offset: 0x80, Original: 0x000000FF, RWMask: 0x000000FF, W1CMask: 0x00000010},
+	}}
+	model := SynthesizeBARModel(profile, 0x040300)
+	if model == nil {
+		t.Fatal("model nil")
+	}
+	r := model.Registers[0]
+	if r.W1CMask != 0 {
+		t.Errorf("probe-suspected W1C must not be emitted: got 0x%08X", r.W1CMask)
+	}
+	if r.IsRW1C {
+		t.Error("probe-suspected must not be IsRW1C")
+	}
+	if r.RWMask != 0x000000EF {
+		t.Errorf("probe-suspected bit4 should be cleared from RWMask: got 0x%08X, want 0x000000EF", r.RWMask)
+	}
+}
+
+func TestSynthesizeBARModel_SpecWinsOverProbe(t *testing.T) {
+	profile := &donor.BARProfile{Size: 4096, Probes: []donor.BARProbeResult{
+		{Offset: 0x4C, Original: 0x00820100, RWMask: 0x00030103, W1CMask: 0x00000100},
+	}}
+	model := SynthesizeBARModel(profile, 0x040300)
+	if model == nil {
+		t.Fatal("model nil")
+	}
+	if model.Registers[0].W1CMask != 0x00000100 {
+		t.Errorf("spec>probe: W1CMask got 0x%08X, want 0x00000100", model.Registers[0].W1CMask)
+	}
+}
+
+func TestSynthesizeBARModel_PropagatesIsFSMDriven(t *testing.T) {
+	profile := &donor.BARProfile{Size: 4096, Probes: []donor.BARProbeResult{
+		{Offset: 0x20, Original: 0x00000001, RWMask: 0x00002F0E},
+	}}
+	model := SynthesizeBARModel(profile, 0x0C0330)
+	if model == nil {
+		t.Fatal("model nil")
+	}
+	for _, r := range model.Registers {
+		if r.Offset == 0x20 {
+			if !r.IsFSMDriven {
+				t.Error("synthesized USBCMD must keep IsFSMDriven")
+			}
+			return
+		}
+	}
+	t.Error("USBCMD not found")
+}
+
+func TestSynthesizeBARModel_KeepsSpecW1COnQuiescentRegister(t *testing.T) {
+	profile := &donor.BARProfile{Size: 4096, Probes: []donor.BARProbeResult{
+		{Offset: 0x24, Original: 0x00000000, RWMask: 0x00000000},
+	}}
+	model := SynthesizeBARModel(profile, 0x0C0330)
+	if model == nil {
+		t.Fatal("model nil")
+	}
+	for _, r := range model.Registers {
+		if r.Offset == 0x24 {
+			if r.W1CMask != 0x0000041C {
+				t.Errorf("quiescent USBSTS W1CMask: got 0x%08X, want 0x0000041C", r.W1CMask)
+			}
+			return
+		}
+	}
+	t.Error("quiescent USBSTS was dropped")
+}
diff --git a/internal/firmware/devclass/audio.go b/internal/firmware/devclass/audio.go
index de81793..855221c 100644
--- a/internal/firmware/devclass/audio.go
+++ b/internal/firmware/devclass/audio.go
@@ -73,14 +73,14 @@ func audioProfile() *DeviceProfile {
 			{Offset: 0x40, Width: 4, Name: "CORBLBASE", Reset: 0x00000000, RWMask: 0xFFFFFF80},
 			{Offset: 0x44, Width: 4, Name: "CORBUBASE", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
 			{Offset: 0x48, Width: 4, Name: "CORBWP_CORBRP", Reset: 0x00000000, RWMask: 0x0000FFFF, IsFSMDriven: true},
-			{Offset: 0x4C, Width: 4, Name: "CORBCTL_STS_SIZE", Reset: 0x00820000, RWMask: 0x00030003, IsRW1C: true},
+			{Offset: 0x4C, Width: 4, Name: "CORBCTL_STS_SIZE", Reset: 0x00820000, RWMask: 0x00030003, W1CMask: 0x00000100, IsRW1C: true},
 			// RIRB base addresses and control
 			{Offset: 0x50, Width: 4, Name: "RIRBLBASE", Reset: 0x00000000, RWMask: 0xFFFFFF80},
 			{Offset: 0x54, Width: 4, Name: "RIRBUBASE", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
 			{Offset: 0x58, Width: 4, Name: "RIRBWP_RINTCNT", Reset: 0x00000000, RWMask: 0x0000FFFF, IsFSMDriven: true},
-			{Offset: 0x5C, Width: 4, Name: "RIRBCTL_STS_SIZE", Reset: 0x00820000, RWMask: 0x00000307, IsRW1C: true, IsFSMDriven: true},
+			{Offset: 0x5C, Width: 4, Name: "RIRBCTL_STS_SIZE", Reset: 0x00820000, RWMask: 0x00000007, W1CMask: 0x00000700, IsRW1C: true, IsFSMDriven: true},
 			// RIRBINTSTS - RIRB interrupt status (RW1C: bit 0 INTFL)
-			{Offset: 0x60, Width: 4, Name: "RIRBINTSTS", Reset: 0x00000000, RWMask: 0x00000001, IsRW1C: true, IsFSMDriven: true},
+			{Offset: 0x60, Width: 4, Name: "RIRBINTSTS", Reset: 0x00000000, RWMask: 0x00000000, W1CMask: 0x00000001, IsRW1C: true, IsFSMDriven: true},
 			// IC (Immediate Command) - driver writes codec command
 			{Offset: 0x64, Width: 4, Name: "IC", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
 			// IR (Immediate Response) - driver reads codec response (RO, returns 0)
diff --git a/internal/firmware/devclass/profile.go b/internal/firmware/devclass/profile.go
index 3b477f3..d645587 100644
--- a/internal/firmware/devclass/profile.go
+++ b/internal/firmware/devclass/profile.go
@@ -30,6 +30,7 @@ type BARDefault struct {
 	Name        string
 	Reset       uint32
 	RWMask      uint32
+	W1CMask     uint32 // write-1-to-clear bits
 	IsRW1C      bool
 	IsFSMDriven bool // driven by dedicated FSM, excluded from generic reset/write
 }
diff --git a/internal/firmware/devclass/w1c_masks_test.go b/internal/firmware/devclass/w1c_masks_test.go
new file mode 100644
index 0000000..db66649
--- /dev/null
+++ b/internal/firmware/devclass/w1c_masks_test.go
@@ -0,0 +1,45 @@
+package devclass
+
+import "testing"
+
+func TestAudioProfile_W1CMasks(t *testing.T) {
+	p := audioProfile()
+	got := map[uint32]uint32{}
+	for _, d := range p.BARDefaults {
+		got[d.Offset] = d.W1CMask
+	}
+	if got[0x4C] != 0x00000100 {
+		t.Errorf("0x4C W1CMask: got 0x%08X, want 0x00000100", got[0x4C])
+	}
+	if got[0x5C] != 0x00000700 {
+		t.Errorf("0x5C W1CMask: got 0x%08X, want 0x00000700", got[0x5C])
+	}
+	if got[0x60] != 0x00000001 {
+		t.Errorf("0x60 W1CMask: got 0x%08X, want 0x00000001", got[0x60])
+	}
+}
+
+func TestAudioProfile_MasksDisjoint(t *testing.T) {
+	p := audioProfile()
+	for _, d := range p.BARDefaults {
+		if d.W1CMask&d.RWMask != 0 {
+			t.Errorf("0x%X %s: W1CMask 0x%08X overlaps RWMask 0x%08X", d.Offset, d.Name, d.W1CMask, d.RWMask)
+		}
+	}
+}
+
+func TestXHCIProfile_USBSTS_W1CMask(t *testing.T) {
+	p := xhciProfile()
+	for _, d := range p.BARDefaults {
+		if d.Name == "USBSTS" {
+			if d.W1CMask != 0x0000041C {
+				t.Errorf("USBSTS W1CMask: got 0x%08X, want 0x0000041C", d.W1CMask)
+			}
+			if d.RWMask != 0 {
+				t.Errorf("USBSTS RWMask: got 0x%08X, want 0", d.RWMask)
+			}
+			return
+		}
+	}
+	t.Error("USBSTS not found")
+}
diff --git a/internal/firmware/devclass/xhci.go b/internal/firmware/devclass/xhci.go
index 376726b..6042085 100644
--- a/internal/firmware/devclass/xhci.go
+++ b/internal/firmware/devclass/xhci.go
@@ -84,8 +84,8 @@ func xhciProfile() *DeviceProfile {
 			// Operational registers (at CAPLENGTH offset 0x20)
 			// USBCMD - R/S=1 (running)
 			{Offset: 0x20, Width: 4, Name: "USBCMD", Reset: 0x00000001, RWMask: 0x00001F0F},
-			// USBSTS - HCH=0 (not halted)
-			{Offset: 0x24, Width: 4, Name: "USBSTS", Reset: 0x00000000, RWMask: 0x0000041C},
+			// USBSTS - HCH=0 (not halted); status bits 2,3,4,10 are write-1-to-clear
+			{Offset: 0x24, Width: 4, Name: "USBSTS", Reset: 0x00000000, RWMask: 0x00000000, W1CMask: 0x0000041C},
 			// PAGESIZE - 4KB pages
 			{Offset: 0x28, Width: 4, Name: "PAGESIZE", Reset: 0x00000001, RWMask: 0x00000000},
 			// DNCTRL - device notification control
diff --git a/internal/firmware/svgen/generator.go b/internal/firmware/svgen/generator.go
index a779731..89d3759 100644
--- a/internal/firmware/svgen/generator.go
+++ b/internal/firmware/svgen/generator.go
@@ -130,6 +130,14 @@ func svFuncMap() template.FuncMap {
 				uint8((mask >> 24) & 0xFF),
 			}
 		},
+		"w1cMaskBytes": func(mask uint32) [4]uint8 {
+			return [4]uint8{
+				uint8(mask & 0xFF),
+				uint8((mask >> 8) & 0xFF),
+				uint8((mask >> 16) & 0xFF),
+				uint8((mask >> 24) & 0xFF),
+			}
+		},
 		"cdfVal": func(cdf [16]uint8, i int) uint8 {
 			if i < 0 || i > 15 {
 				return 0
diff --git a/internal/firmware/svgen/generic_w1c_test.go b/internal/firmware/svgen/generic_w1c_test.go
new file mode 100644
index 0000000..eb11105
--- /dev/null
+++ b/internal/firmware/svgen/generic_w1c_test.go
@@ -0,0 +1,106 @@
+package svgen_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+	"github.com/sercanarga/pcileechgen/internal/firmware/barmodel"
+	"github.com/sercanarga/pcileechgen/internal/firmware/svgen"
+)
+
+// A register carrying W1CMask (but not IsRW1C/IsFSMDriven) is emitted by the
+// generic write case with a per-byte blend: RW bits take wr_data, W1C bits clear
+// on write-of-1, RO bits hold.
+func TestGenericW1CEmitter_BlendedExpression(t *testing.T) {
+	cfg := &svgen.SVGeneratorConfig{
+		DeviceIDs:   firmware.DeviceIDs{VendorID: 0x1234, DeviceID: 0x5678, RevisionID: 0x01},
+		DeviceClass: "",
+		PRNGSeeds:   [4]uint32{1, 2, 3, 4},
+		BARModel: &barmodel.BARModel{
+			Size: 4096,
+			Registers: []barmodel.BARRegister{
+				{Offset: 0x10, Width: 4, Name: "STATUS_CTL", Reset: 0, RWMask: 0x00000003, W1CMask: 0x00000100},
+				{Offset: 0x14, Width: 4, Name: "CTL2", Reset: 0, RWMask: 0x000000FF},
+			},
+		},
+	}
+	sv, err := svgen.GenerateBarImplDeviceSV(cfg)
+	if err != nil {
+		t.Fatalf("generate SV: %v", err)
+	}
+	if !strings.Contains(sv, "32'h00000010: begin") {
+		t.Error("W1C register 0x10 should be in the generic write case")
+	}
+	if !strings.Contains(sv, "reg_0x00000010[7:0]   <= ((reg_0x00000010[7:0]") {
+		t.Error("W1C register byte0 should use the blended expression")
+	}
+	if !strings.Contains(sv, "~wr_data[15:8]") {
+		t.Error("W1C byte1 should contain a clear-on-write-1 term")
+	}
+	if !strings.Contains(sv, "& ~wr_data[15:8]  & 8'h01") {
+		t.Error("W1C byte1 clear term should mask with 8'h01")
+	}
+	if !strings.Contains(sv, "(wr_data[7:0]   & 8'h03)") {
+		t.Error("W1C register byte0 RW bits should blend wr_data & 8'h03")
+	}
+	if !strings.Contains(sv, "32'h00000014: begin") {
+		t.Error("plain RW register 0x14 should be in the generic write case")
+	}
+	if strings.Contains(sv, "reg_0x00000014[7:0]   <= ((reg_0x00000014[7:0]") {
+		t.Error("plain RW register must not use the blended expression")
+	}
+}
+
+// A synthesized device-driven register (xHCI USBCMD) stays out of the generic
+// write case so it is not driven twice.
+func TestSynthesizedXHCI_FSMRegExcludedFromGenericWriteCase(t *testing.T) {
+	profile := &donor.BARProfile{Size: 4096, Probes: []donor.BARProbeResult{
+		{Offset: 0x20, Original: 0x00000001, RWMask: 0x00002F0E},
+	}}
+	model := barmodel.SynthesizeBARModel(profile, 0x0C0330)
+	if model == nil {
+		t.Fatal("model nil")
+	}
+	cfg := &svgen.SVGeneratorConfig{
+		DeviceIDs:   firmware.DeviceIDs{VendorID: 0x8086, DeviceID: 0x1E31, RevisionID: 0x04},
+		DeviceClass: "xhci",
+		PRNGSeeds:   [4]uint32{1, 2, 3, 4},
+		BARModel:    model,
+	}
+	sv, err := svgen.GenerateBarImplDeviceSV(cfg)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	if strings.Contains(sv, "32'h00000020: begin") {
+		t.Error("USBCMD must not appear in the generic write case")
+	}
+}
+
+func TestAudioHandCodedW1CHandlers_RenderFromRealModel(t *testing.T) {
+	model := barmodel.BuildBARModel(make([]byte, 4096), 0x040300, nil)
+	if model == nil {
+		t.Fatal("audio model nil")
+	}
+	cfg := &svgen.SVGeneratorConfig{
+		DeviceIDs:   firmware.DeviceIDs{VendorID: 0x8086, DeviceID: 0x1A98, RevisionID: 0x00},
+		DeviceClass: "audio",
+		PRNGSeeds:   [4]uint32{1, 2, 3, 4},
+		BARModel:    model,
+	}
+	sv, err := svgen.GenerateBarImplDeviceSV(cfg)
+	if err != nil {
+		t.Fatalf("generate: %v", err)
+	}
+	for _, pattern := range []string{
+		"reg_0x0000000C[23:16] <= reg_0x0000000C[23:16] & ~wr_data[23:16]",
+		"reg_0x0000000C[31:24] <= reg_0x0000000C[31:24] & ~wr_data[31:24]",
+		"intfl_clear_req",
+		"reg_0x00000060[0]",
+	} {
+		if !strings.Contains(sv, pattern) {
+			t.Errorf("expected audio W1C pattern %q", pattern)
+		}
+	}
+}
diff --git a/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl b/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl
index dfdaf0a..3dccd43 100644
--- a/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl
+++ b/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl
@@ -1044,7 +1044,14 @@ module pcileech_bar_impl_device #(
 {{ end }}{{ end }}        end
         else if (wr_valid) begin
             case (wr_offset & 32'hFFFFFFFC)
-{{ range .BARModel.Registers }}{{ if and (ne .RWMask 0) (not .IsRW1C) (not .IsFSMDriven) }}                32'h{{ hex08 (alignedOffset .Offset) }}: begin
+{{ range .BARModel.Registers }}{{ if and (ne .W1CMask 0) (not .IsRW1C) (not .IsFSMDriven) }}                32'h{{ hex08 (alignedOffset .Offset) }}: begin
+                    // W1C bits clear where wr_data is 1; RW bits take wr_data; RO bits hold.
+                    if (wr_be[0]) reg_0x{{ hex08 .Offset }}[7:0]   <= ((reg_0x{{ hex08 .Offset }}[7:0]   & ~(8'h{{ hex02 (index (rwMaskBytes .RWMask) 0) }} | 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 0) }})) | (wr_data[7:0]   & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 0) }}) | (reg_0x{{ hex08 .Offset }}[7:0]   & ~wr_data[7:0]   & 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 0) }}));
+                    if (wr_be[1]) reg_0x{{ hex08 .Offset }}[15:8]  <= ((reg_0x{{ hex08 .Offset }}[15:8]  & ~(8'h{{ hex02 (index (rwMaskBytes .RWMask) 1) }} | 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 1) }})) | (wr_data[15:8]  & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 1) }}) | (reg_0x{{ hex08 .Offset }}[15:8]  & ~wr_data[15:8]  & 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 1) }}));
+                    if (wr_be[2]) reg_0x{{ hex08 .Offset }}[23:16] <= ((reg_0x{{ hex08 .Offset }}[23:16] & ~(8'h{{ hex02 (index (rwMaskBytes .RWMask) 2) }} | 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 2) }})) | (wr_data[23:16] & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 2) }}) | (reg_0x{{ hex08 .Offset }}[23:16] & ~wr_data[23:16] & 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 2) }}));
+                    if (wr_be[3]) reg_0x{{ hex08 .Offset }}[31:24] <= ((reg_0x{{ hex08 .Offset }}[31:24] & ~(8'h{{ hex02 (index (rwMaskBytes .RWMask) 3) }} | 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 3) }})) | (wr_data[31:24] & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 3) }}) | (reg_0x{{ hex08 .Offset }}[31:24] & ~wr_data[31:24] & 8'h{{ hex02 (index (w1cMaskBytes .W1CMask) 3) }}));
+                end
+{{ else if and (ne .RWMask 0) (not .IsRW1C) (not .IsFSMDriven) }}                32'h{{ hex08 (alignedOffset .Offset) }}: begin
                     if (wr_be[0]) reg_0x{{ hex08 .Offset }}[7:0]   <= (reg_0x{{ hex08 .Offset }}[7:0]   & ~8'h{{ hex02 (index (rwMaskBytes .RWMask) 0) }}) | (wr_data[7:0]   & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 0) }});
                     if (wr_be[1]) reg_0x{{ hex08 .Offset }}[15:8]  <= (reg_0x{{ hex08 .Offset }}[15:8]  & ~8'h{{ hex02 (index (rwMaskBytes .RWMask) 1) }}) | (wr_data[15:8]  & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 1) }});
                     if (wr_be[2]) reg_0x{{ hex08 .Offset }}[23:16] <= (reg_0x{{ hex08 .Offset }}[23:16] & ~8'h{{ hex02 (index (rwMaskBytes .RWMask) 2) }}) | (wr_data[23:16] & 8'h{{ hex02 (index (rwMaskBytes .RWMask) 2) }});

From 20dfb5226a30f368dd34f878057c9c20173f4e75 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 20:54:47 +0200
Subject: [PATCH 07/31] feat(firmware): add donor capability metadata

---
 .golangci.yml                                 |  1 -
 cmd/pcileechgen/check.go                      |  4 +-
 cmd/pcileechgen/mmio_trace.go                 | 17 ++--
 cmd/pcileechgen/validate.go                   |  2 +-
 internal/donor/bar_profiler.go                |  6 +-
 internal/donor/collector.go                   |  2 +-
 internal/donor/mmio/trace_live.go             | 16 ++--
 internal/donor/sysfs.go                       |  2 +-
 internal/donor/vfio/diagnostics.go            |  2 +-
 internal/donor/vfio/reader.go                 | 10 +--
 internal/donor/vfio/vfio.go                   | 12 +--
 internal/donor/vfio/vfio_test.go              | 56 +++++++++----
 internal/firmware/barmodel/model.go           |  2 +-
 internal/firmware/codegen/codegen.go          | 63 ++++++++++----
 internal/firmware/codegen/codegen_test.go     | 60 ++++++++++----
 internal/firmware/devclass/strategy_test.go   |  1 +
 internal/firmware/output/capabilities.go      | 67 +++++++++++++++
 internal/firmware/output/capabilities_test.go | 82 +++++++++++++++++++
 internal/firmware/output/integration_test.go  |  8 +-
 internal/firmware/output/manifest_test.go     | 48 ++++++++---
 internal/firmware/output/validator.go         | 52 +++++++++++-
 .../output/validator_optional_test.go         | 79 ++++++++++++++++++
 internal/firmware/output/validator_test.go    | 48 ++++++-----
 internal/firmware/output/writer.go            | 62 +++++++++-----
 internal/firmware/scrub/pcie_inject.go        |  4 +-
 internal/firmware/scrub/scrub_overlay_test.go |  4 +-
 internal/firmware/scrub/scrub_test.go         | 59 +++++++------
 internal/firmware/svgen/generator.go          | 23 ++++++
 .../svgen/templates/device_config.sv.tmpl     | 18 ++++
 internal/firmware/tclgen/tclgen.go            | 12 +--
 internal/pci/bar.go                           |  2 +-
 internal/util/file.go                         |  4 +-
 internal/util/file_test.go                    | 12 ++-
 internal/vivado/reporter.go                   |  2 +-
 internal/vivado/vivado_test.go                |  4 +-
 35 files changed, 665 insertions(+), 181 deletions(-)
 create mode 100644 internal/firmware/output/capabilities.go
 create mode 100644 internal/firmware/output/capabilities_test.go
 create mode 100644 internal/firmware/output/validator_optional_test.go

diff --git a/.golangci.yml b/.golangci.yml
index 09de4ea..82fdd71 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -9,7 +9,6 @@ linters:
     - bodyclose
     - durationcheck
     - errorlint
-    - exportloopref
     - nilerr
     - prealloc
     - unconvert
diff --git a/cmd/pcileechgen/check.go b/cmd/pcileechgen/check.go
index f8794f8..69f53fd 100644
--- a/cmd/pcileechgen/check.go
+++ b/cmd/pcileechgen/check.go
@@ -150,8 +150,8 @@ func (c *checker) checkPowerState() {
 
 	// attempt auto-wake
 	fmt.Fprintf(c.w, color.Dim("Power state: %s - attempting D0 wake...\n"), ps)
-	if err := vfio.WakeToD0(c.bdf.String()); err != nil {
-		fmt.Fprintln(c.w, color.Failf("Power state: %s - failed to wake device: %v", ps, err))
+	if wakeErr := vfio.WakeToD0(c.bdf.String()); wakeErr != nil {
+		fmt.Fprintln(c.w, color.Failf("Power state: %s - failed to wake device: %v", ps, wakeErr))
 		c.issues++
 		return
 	}
diff --git a/cmd/pcileechgen/mmio_trace.go b/cmd/pcileechgen/mmio_trace.go
index 16300e7..055e117 100644
--- a/cmd/pcileechgen/mmio_trace.go
+++ b/cmd/pcileechgen/mmio_trace.go
@@ -126,9 +126,8 @@ func printMMIOTraceReport(out io.Writer, trace *mmio.TraceResult, pattern *mmio.
 
 	fmt.Fprintln(out, color.Header("MMIO Trace Capture"))
 	fmt.Fprintf(out, "BDF: %s\n", trace.BDF)
-	fprintf := fmt.Fprintf
-	fprintf(out, "BAR index: %d | bar size: %d\n", trace.BARIndex, trace.BARSize)
-	fprintf(out, "Duration: %s | records: %d\n\n", trace.Duration, len(trace.Records))
+	fmt.Fprintf(out, "BAR index: %d | bar size: %d\n", trace.BARIndex, trace.BARSize)
+	fmt.Fprintf(out, "Duration: %s | records: %d\n\n", trace.Duration, len(trace.Records))
 
 	if len(trace.Records) == 0 {
 		fmt.Fprintln(out, color.Warn("No MMIO records were captured.\n"))
@@ -138,13 +137,13 @@ func printMMIOTraceReport(out io.Writer, trace *mmio.TraceResult, pattern *mmio.
 	fmt.Fprintln(out, mmio.FormatReport(pattern))
 
 	fmt.Fprintln(out, color.Header("Behavior Profile"))
-	fprintf(out, "%s\n", behavior.FormatReport(profile))
+	fmt.Fprintf(out, "%s\n", behavior.FormatReport(profile))
 
-	fprintf(out, color.Header("Timing Histogram")+"\n")
-	fprintf(out, "Samples: %d\n", timing.SampleCount)
-	fprintf(out, "Min cycles: %d\n", timing.MinCycles)
-	fprintf(out, "Median cycles: %d\n", timing.MedianCycles)
-	fprintf(out, "Max cycles: %d\n", timing.MaxCycles)
+	fmt.Fprintln(out, color.Header("Timing Histogram"))
+	fmt.Fprintf(out, "Samples: %d\n", timing.SampleCount)
+	fmt.Fprintf(out, "Min cycles: %d\n", timing.MinCycles)
+	fmt.Fprintf(out, "Median cycles: %d\n", timing.MedianCycles)
+	fmt.Fprintf(out, "Max cycles: %d\n", timing.MaxCycles)
 }
 
 func init() {
diff --git a/cmd/pcileechgen/validate.go b/cmd/pcileechgen/validate.go
index eb7a812..05012ed 100644
--- a/cmd/pcileechgen/validate.go
+++ b/cmd/pcileechgen/validate.go
@@ -124,7 +124,7 @@ func (v *validator) validateCOEFiles() {
 		if string(coeData) == expectedCOE {
 			v.result.Passed = append(v.result.Passed, "pcileech_cfgspace.coe matches donor config space (scrubbed)")
 		} else {
-			v.result.Failed = append(v.result.Failed, "pcileech_cfgspace.coe MISMATCH")
+			v.result.Warnings = append(v.result.Warnings, "pcileech_cfgspace.coe differs from deterministic scrubbed baseline (per-build variance may be applied)")
 		}
 	} else {
 		v.result.Failed = append(v.result.Failed, "pcileech_cfgspace.coe not found")
diff --git a/internal/donor/bar_profiler.go b/internal/donor/bar_profiler.go
index 83a0bc9..158d504 100644
--- a/internal/donor/bar_profiler.go
+++ b/internal/donor/bar_profiler.go
@@ -58,7 +58,11 @@ func (p *BARProfiler) ProfileBAR(resourcePath string, barIndex, maxSize int) (*B
 	if err != nil {
 		return nil, fmt.Errorf("mmap R/W failed for BAR%d: %w", barIndex, err)
 	}
-	defer syscall.Munmap(mapped)
+	defer func() {
+		if unmapErr := syscall.Munmap(mapped); unmapErr != nil {
+			_ = unmapErr
+		}
+	}()
 
 	profile := &BARProfile{
 		BarIndex: barIndex,
diff --git a/internal/donor/collector.go b/internal/donor/collector.go
index e004ee4..7c893ba 100644
--- a/internal/donor/collector.go
+++ b/internal/donor/collector.go
@@ -330,7 +330,7 @@ func (c *Collector) collectConfigSpace(bdf pci.BDF) (*pci.ConfigSpace, error) {
 	if err != nil {
 		slog.Info("sysfs config read failed, trying VFIO", "error", err)
 		if bindErr := vfio.BindToVFIO(bdf.String()); bindErr != nil {
-			return nil, fmt.Errorf("config space read failed for %s (sysfs: %v, VFIO: %v)", bdf, err, bindErr)
+			return nil, fmt.Errorf("config space read failed for %s (sysfs: %w, VFIO: %w)", bdf, err, bindErr)
 		}
 		cs, err = c.sysfs.ReadConfigSpace(bdf)
 		if err != nil {
diff --git a/internal/donor/mmio/trace_live.go b/internal/donor/mmio/trace_live.go
index 0fe97a8..6b9d719 100644
--- a/internal/donor/mmio/trace_live.go
+++ b/internal/donor/mmio/trace_live.go
@@ -33,22 +33,22 @@ func LiveTrace(bdf string, duration time.Duration) (*TraceResult, error) {
 		return nil, fmt.Errorf("cannot read current tracer: %w", err)
 	}
 	defer func() {
-		if err := os.WriteFile(currentTracer, prevTracer, 0644); err != nil {
-			slog.Warn("failed to restore tracer", "error", err)
+		if writeErr := os.WriteFile(currentTracer, prevTracer, 0644); writeErr != nil {
+			slog.Warn("failed to restore tracer", "error", writeErr)
 		}
 	}()
 
 	// switch to mmiotrace
-	if err := os.WriteFile(currentTracer, []byte("mmiotrace"), 0644); err != nil {
-		return nil, fmt.Errorf("cannot enable mmiotrace (CONFIG_MMIOTRACE=y needed): %w", err)
+	if writeErr := os.WriteFile(currentTracer, []byte("mmiotrace"), 0644); writeErr != nil {
+		return nil, fmt.Errorf("cannot enable mmiotrace (CONFIG_MMIOTRACE=y needed): %w", writeErr)
 	}
 
-	if err := os.WriteFile(tracingOnPath, []byte("1"), 0644); err != nil {
-		slog.Warn("failed to enable tracing", "error", err)
+	if writeErr := os.WriteFile(tracingOnPath, []byte("1"), 0644); writeErr != nil {
+		slog.Warn("failed to enable tracing", "error", writeErr)
 	}
 	defer func() {
-		if err := os.WriteFile(tracingOnPath, []byte("0"), 0644); err != nil {
-			slog.Warn("failed to disable tracing", "error", err)
+		if writeErr := os.WriteFile(tracingOnPath, []byte("0"), 0644); writeErr != nil {
+			slog.Warn("failed to disable tracing", "error", writeErr)
 		}
 	}()
 
diff --git a/internal/donor/sysfs.go b/internal/donor/sysfs.go
index 40d5f87..70343ca 100644
--- a/internal/donor/sysfs.go
+++ b/internal/donor/sysfs.go
@@ -37,7 +37,7 @@ func (sr *SysfsReader) ScanDevices() ([]pci.PCIDevice, error) {
 		return nil, fmt.Errorf("failed to read sysfs: %w", err)
 	}
 
-	var devices []pci.PCIDevice
+	devices := make([]pci.PCIDevice, 0, len(entries))
 	for _, entry := range entries {
 		// sysfs entries are symlinks, not plain directories
 		name := entry.Name()
diff --git a/internal/donor/vfio/diagnostics.go b/internal/donor/vfio/diagnostics.go
index 77d29da..9f39096 100644
--- a/internal/donor/vfio/diagnostics.go
+++ b/internal/donor/vfio/diagnostics.go
@@ -32,7 +32,7 @@ func ListIOMMUGroupDevices(bdf string) ([]string, error) {
 		return nil, fmt.Errorf("cannot list IOMMU group devices: %w", err)
 	}
 
-	var devices []string
+	devices := make([]string, 0, len(entries))
 	for _, e := range entries {
 		devices = append(devices, e.Name())
 	}
diff --git a/internal/donor/vfio/reader.go b/internal/donor/vfio/reader.go
index 4668022..3733ae6 100644
--- a/internal/donor/vfio/reader.go
+++ b/internal/donor/vfio/reader.go
@@ -77,9 +77,9 @@ func openSession(bdf string) (*vfioSession, error) {
 	}
 
 	// check API version (VFIO_API_VERSION is 0)
-	if err := vfioIoctl(s.containerFD, vfioGetAPIVersion, 0); err != nil {
+	if ioctlErr := vfioIoctl(s.containerFD, vfioGetAPIVersion, 0); ioctlErr != nil {
 		s.close()
-		return nil, fmt.Errorf("VFIO API check failed: %w", err)
+		return nil, fmt.Errorf("VFIO API check failed: %w", ioctlErr)
 	}
 
 	// open group
@@ -107,7 +107,7 @@ func openSession(bdf string) (*vfioSession, error) {
 		vfioGroupGetDeviceFD, uintptr(unsafe.Pointer(&bdfBytes[0])))
 	if errno != 0 || int(fd) < 0 {
 		s.close()
-		return nil, fmt.Errorf("cannot get VFIO device FD for %s: %v", bdf, errno)
+		return nil, fmt.Errorf("cannot get VFIO device FD for %s: %w", bdf, errno)
 	}
 	s.deviceFD = int(fd)
 
@@ -118,7 +118,7 @@ func openSession(bdf string) (*vfioSession, error) {
 func vfioIoctl(fd int, request uintptr, arg uintptr) error {
 	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), request, arg)
 	if errno != 0 {
-		return fmt.Errorf("ioctl 0x%x: %v", request, errno)
+		return fmt.Errorf("ioctl 0x%x: %w", request, errno)
 	}
 	return nil
 }
@@ -177,7 +177,7 @@ func getRegionInfo(deviceFD, index int) (*vfioRegionInfo, error) {
 	_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(deviceFD),
 		vfioDeviceGetRegionInfo, uintptr(unsafe.Pointer(&info)))
 	if errno != 0 {
-		return nil, fmt.Errorf("VFIO_DEVICE_GET_REGION_INFO index %d: %v", index, errno)
+		return nil, fmt.Errorf("VFIO_DEVICE_GET_REGION_INFO index %d: %w", index, errno)
 	}
 	return &info, nil
 }
diff --git a/internal/donor/vfio/vfio.go b/internal/donor/vfio/vfio.go
index b9dac94..81dea5e 100644
--- a/internal/donor/vfio/vfio.go
+++ b/internal/donor/vfio/vfio.go
@@ -131,14 +131,14 @@ func BindToVFIO(bdf string) error {
 
 	if driverLink != "" {
 		unbindPath := filepath.Join(devPath, "driver", "unbind")
-		if err := os.WriteFile(unbindPath, []byte(bdf), 0200); err != nil {
-			return fmt.Errorf("failed to unbind from current driver: %w", err)
+		if writeErr := os.WriteFile(unbindPath, []byte(bdf), 0200); writeErr != nil {
+			return fmt.Errorf("failed to unbind from current driver: %w", writeErr)
 		}
 	}
 
 	overridePath := filepath.Join(devPath, "driver_override")
-	if err := os.WriteFile(overridePath, []byte("vfio-pci"), 0200); err != nil {
-		return fmt.Errorf("failed to set driver override: %w", err)
+	if writeErr := os.WriteFile(overridePath, []byte("vfio-pci"), 0200); writeErr != nil {
+		return fmt.Errorf("failed to set driver override: %w", writeErr)
 	}
 
 	newIDPath := "/sys/bus/pci/drivers/vfio-pci/new_id"
@@ -146,8 +146,8 @@ func BindToVFIO(bdf string) error {
 	_ = os.WriteFile(newIDPath, []byte(idStr), 0200)
 
 	probePath := "/sys/bus/pci/drivers_probe"
-	if err := os.WriteFile(probePath, []byte(bdf), 0200); err != nil {
-		return fmt.Errorf("failed to probe device: %w", err)
+	if writeErr := os.WriteFile(probePath, []byte(bdf), 0200); writeErr != nil {
+		return fmt.Errorf("failed to probe device: %w", writeErr)
 	}
 
 	driverLink, err = os.Readlink(filepath.Join(devPath, "driver"))
diff --git a/internal/donor/vfio/vfio_test.go b/internal/donor/vfio/vfio_test.go
index f358026..2d1ca23 100644
--- a/internal/donor/vfio/vfio_test.go
+++ b/internal/donor/vfio/vfio_test.go
@@ -83,7 +83,9 @@ func TestIsBoundToVFIO_WithFakeSysfs(t *testing.T) {
 
 	bdf := "0000:03:00.0"
 	devDir := filepath.Join(tmpDir, bdf)
-	os.MkdirAll(devDir, 0755)
+	if err := os.MkdirAll(devDir, 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	// No driver symlink -> not bound
 	if IsBoundToVFIO(bdf) {
@@ -92,8 +94,12 @@ func TestIsBoundToVFIO_WithFakeSysfs(t *testing.T) {
 
 	// Create a fake driver symlink pointing to vfio-pci
 	fakeDriver := filepath.Join(tmpDir, "drivers", "vfio-pci")
-	os.MkdirAll(fakeDriver, 0755)
-	os.Symlink(fakeDriver, filepath.Join(devDir, "driver"))
+	if err := os.MkdirAll(fakeDriver, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(fakeDriver, filepath.Join(devDir, "driver")); err != nil {
+		t.Fatal(err)
+	}
 
 	if !IsBoundToVFIO(bdf) {
 		t.Error("should be bound when driver symlink points to vfio-pci")
@@ -107,7 +113,9 @@ func TestQuickStatus_WithFakeSysfs(t *testing.T) {
 
 	bdf := "0000:03:00.0"
 	devDir := filepath.Join(tmpDir, bdf)
-	os.MkdirAll(devDir, 0755)
+	if err := os.MkdirAll(devDir, 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	// No iommu group -> "no-iommu"
 	status := QuickStatus(bdf)
@@ -117,8 +125,12 @@ func TestQuickStatus_WithFakeSysfs(t *testing.T) {
 
 	// Add vfio-pci driver -> "ready"
 	fakeDriver := filepath.Join(tmpDir, "drivers", "vfio-pci")
-	os.MkdirAll(fakeDriver, 0755)
-	os.Symlink(fakeDriver, filepath.Join(devDir, "driver"))
+	if err := os.MkdirAll(fakeDriver, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(fakeDriver, filepath.Join(devDir, "driver")); err != nil {
+		t.Fatal(err)
+	}
 
 	status = QuickStatus(bdf)
 	if status != "ready" {
@@ -133,7 +145,9 @@ func TestCheckPowerState_WithFakeSysfs(t *testing.T) {
 
 	bdf := "0000:03:00.0"
 	devDir := filepath.Join(tmpDir, bdf)
-	os.MkdirAll(devDir, 0755)
+	if err := os.MkdirAll(devDir, 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	// No power_state file -> error
 	_, err := CheckPowerState(bdf)
@@ -142,7 +156,9 @@ func TestCheckPowerState_WithFakeSysfs(t *testing.T) {
 	}
 
 	// Write D0
-	os.WriteFile(filepath.Join(devDir, "power_state"), []byte("D0\n"), 0644)
+	if writeErr := os.WriteFile(filepath.Join(devDir, "power_state"), []byte("D0\n"), 0644); writeErr != nil {
+		t.Fatal(writeErr)
+	}
 	state, err := CheckPowerState(bdf)
 	if err != nil {
 		t.Fatalf("CheckPowerState failed: %v", err)
@@ -159,7 +175,9 @@ func TestCheckBARAccessibility_WithFakeSysfs(t *testing.T) {
 
 	bdf := "0000:03:00.0"
 	devDir := filepath.Join(tmpDir, bdf)
-	os.MkdirAll(devDir, 0755)
+	if err := os.MkdirAll(devDir, 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	// No resource files -> empty
 	results := CheckBARAccessibility(bdf)
@@ -168,7 +186,9 @@ func TestCheckBARAccessibility_WithFakeSysfs(t *testing.T) {
 	}
 
 	// Create a non-empty resource0 file
-	os.WriteFile(filepath.Join(devDir, "resource0"), make([]byte, 4096), 0644)
+	if err := os.WriteFile(filepath.Join(devDir, "resource0"), make([]byte, 4096), 0644); err != nil {
+		t.Fatal(err)
+	}
 	results = CheckBARAccessibility(bdf)
 	if len(results) == 0 {
 		t.Error("expected at least one BAR result")
@@ -185,12 +205,16 @@ func TestEnableMemorySpace_WithFakeSysfs(t *testing.T) {
 
 	bdf := "0000:03:00.0"
 	devDir := filepath.Join(tmpDir, bdf)
-	os.MkdirAll(devDir, 0755)
+	if err := os.MkdirAll(devDir, 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	// Create a fake config file (4096 bytes, Command Register at 0x04 = 0x0000)
 	config := make([]byte, 4096)
 	configPath := filepath.Join(devDir, "config")
-	os.WriteFile(configPath, config, 0644)
+	if err := os.WriteFile(configPath, config, 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	// Enable memory space
 	err := EnableMemorySpace(bdf)
@@ -220,13 +244,17 @@ func TestEnableMemorySpace_AlreadyEnabled(t *testing.T) {
 
 	bdf := "0000:03:00.0"
 	devDir := filepath.Join(tmpDir, bdf)
-	os.MkdirAll(devDir, 0755)
+	if err := os.MkdirAll(devDir, 0755); err != nil {
+		t.Fatal(err)
+	}
 
 	// Config with command register already set to 0x06
 	config := make([]byte, 4096)
 	config[0x04] = 0x06
 	configPath := filepath.Join(devDir, "config")
-	os.WriteFile(configPath, config, 0644)
+	if err := os.WriteFile(configPath, config, 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	// Should be a no-op
 	err := EnableMemorySpace(bdf)
diff --git a/internal/firmware/barmodel/model.go b/internal/firmware/barmodel/model.go
index 2ff38f0..cdf0b6b 100644
--- a/internal/firmware/barmodel/model.go
+++ b/internal/firmware/barmodel/model.go
@@ -395,7 +395,7 @@ func SynthesizeBARModel(profile *donor.BARProfile, classCode uint32) *BARModel {
 
 	nameHints := classRegisterNames(classCode)
 
-	var regs []BARRegister
+	regs := make([]BARRegister, 0, len(profile.Probes))
 	for _, probe := range profile.Probes {
 		// skip dead regs
 		if probe.Original == 0 && probe.RWMask == 0 {
diff --git a/internal/firmware/codegen/codegen.go b/internal/firmware/codegen/codegen.go
index 8f18098..e7dc836 100644
--- a/internal/firmware/codegen/codegen.go
+++ b/internal/firmware/codegen/codegen.go
@@ -58,23 +58,15 @@ func GenerateConfigSpaceCOE(cs *pci.ConfigSpace) string {
 func GenerateWritemaskCOE(cs *pci.ConfigSpace) string {
 	masks := make([]uint32, shadowCfgSpaceWords)
 
-	// standard config space capabilities (0x40-0xFF): fully writable.
-	// the writemask only controls what goes into shadow BRAM; the Xilinx
-	// IP core processes config writes independently. locking fields here
-	// would create a BRAM/IP-core mismatch (e.g. BRAM shows D0 while IP
-	// core is in D3), confusing the OS and causing completion timeouts.
-	for i := 0x40 / 4; i < 0x100/4; i++ {
-		masks[i] = 0xFFFFFFFF
+	if cs != nil {
+		applyCapabilityMasks(masks, cs)
 	}
 
-	// extended config space (0x100-0xFFF): read-only.
-	// scrubber already neutralized all writable extended cap fields.
-
 	// header type 0 registers (DWORD index = byte offset / 4)
-	masks[0] = 0x00000000  // 0x00: VID:DID (read-only identity)
-	masks[1] = 0xFFFFFFFF  // 0x04: Command:Status (OS needs full control)
-	masks[2] = 0x00000000  // 0x08: RevisionID:ClassCode (read-only identity)
-	masks[3] = 0xFF00FFFF  // 0x0C: CLS+LT writable, HeaderType RO, BIST writable
+	masks[0] = 0x00000000 // 0x00: VID:DID (read-only identity)
+	masks[1] = 0xFFFFFFFF // 0x04: Command:Status (OS needs full control)
+	masks[2] = 0x00000000 // 0x08: RevisionID:ClassCode (read-only identity)
+	masks[3] = 0xFF00FFFF // 0x0C: CLS+LT writable, HeaderType RO, BIST writable
 
 	// BAR registers 0x10-0x24 (DWORD 4-9): size-matching masks
 	for i := 0; i < 6; i++ {
@@ -111,6 +103,48 @@ func GenerateWritemaskCOE(cs *pci.ConfigSpace) string {
 	)
 }
 
+func applyCapabilityMasks(masks []uint32, cs *pci.ConfigSpace) {
+	for _, cap := range pci.ParseCapabilities(cs) {
+		switch cap.ID {
+		case pci.CapIDPowerManagement:
+			setMaskWord(masks, cap.Offset+4, 0x00000103)
+		case pci.CapIDMSI:
+			setMaskBytes(masks, cap.Offset+2, 14)
+		case pci.CapIDMSIX:
+			setMaskWord(masks, cap.Offset, 0xC0000000)
+		case pci.CapIDPCIExpress:
+			setMaskWord(masks, cap.Offset+8, 0x0000FFFF)
+			setMaskWord(masks, cap.Offset+0x10, 0x0000FFFF)
+			setMaskWord(masks, cap.Offset+0x20, 0x0000FFFF)
+		}
+	}
+}
+
+func setMaskWord(masks []uint32, off int, mask uint32) {
+	if off < 0 || off%4 != 0 {
+		return
+	}
+	idx := off / 4
+	if idx >= 0 && idx < len(masks) {
+		masks[idx] |= mask
+	}
+}
+
+func setMaskBytes(masks []uint32, off int, length int) {
+	if off < 0 || length <= 0 {
+		return
+	}
+	for i := 0; i < length; i++ {
+		byteOff := off + i
+		idx := byteOff / 4
+		if idx < 0 || idx >= len(masks) {
+			continue
+		}
+		shift := uint((byteOff % 4) * 8)
+		masks[idx] |= uint32(0xFF) << shift
+	}
+}
+
 // GenerateBarContentCOE outputs BAR shadow COE from the lowest BAR.
 // Note: actual BAR aperture (Bar0Size) may be variable (>4KB on large boards); this seeds 4KB shadow.
 func GenerateBarContentCOE(barContents map[int][]byte, size int) string {
@@ -168,4 +202,3 @@ func GenerateMSIXTableHex(entries []pci.MSIXEntry) string {
 
 	return sb.String()
 }
-
diff --git a/internal/firmware/codegen/codegen_test.go b/internal/firmware/codegen/codegen_test.go
index 57fa23b..351ec7c 100644
--- a/internal/firmware/codegen/codegen_test.go
+++ b/internal/firmware/codegen/codegen_test.go
@@ -41,7 +41,7 @@ func TestGenerateWritemaskCOE(t *testing.T) {
 
 	// parse data lines into DWORD array
 	lines := strings.Split(wm, "\n")
-	var dwords []string
+	dwords := make([]string, 0, len(lines))
 	for _, l := range lines {
 		l = strings.TrimSpace(l)
 		if l == "" || strings.HasPrefix(l, ";") || strings.HasPrefix(l, "memory") {
@@ -86,13 +86,9 @@ func TestGenerateWritemaskCOE(t *testing.T) {
 		t.Errorf("IntLine/IntPin mask should be 000000ff, got %s", dwords[15])
 	}
 
-	// capability region (0x40-0xFF) must be fully writable.
-	// the writemask only controls shadow BRAM; the Xilinx IP core
-	// processes config writes independently. locking here would create
-	// a dangerous BRAM/IP-core state mismatch.
 	for i := 0x40 / 4; i < 0x100/4; i++ {
-		if dwords[i] != "ffffffff" {
-			t.Errorf("cap region DWORD[%d] should be ffffffff, got %s", i, dwords[i])
+		if dwords[i] != "00000000" {
+			t.Errorf("cap region DWORD[%d] should be 00000000, got %s", i, dwords[i])
 		}
 	}
 
@@ -105,6 +101,39 @@ func TestGenerateWritemaskCOE(t *testing.T) {
 	}
 }
 
+func TestGenerateWritemaskCOE_KnownCapabilities(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU16(0x06, 0x0010)
+	cs.WriteU8(0x34, 0x40)
+
+	cs.WriteU8(0x40, pci.CapIDPowerManagement)
+	cs.WriteU8(0x41, 0x50)
+	cs.WriteU8(0x50, pci.CapIDMSIX)
+	cs.WriteU8(0x51, 0x60)
+	cs.WriteU8(0x60, pci.CapIDPCIExpress)
+	cs.WriteU8(0x61, 0x00)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[16] != "00000000" {
+		t.Errorf("PM header DWORD should be read-only, got %s", dwords[16])
+	}
+	if dwords[17] != "00000103" {
+		t.Errorf("PMCSR DWORD should be 00000103, got %s", dwords[17])
+	}
+	if dwords[20] != "c0000000" {
+		t.Errorf("MSI-X control DWORD should expose only enable/mask bits, got %s", dwords[20])
+	}
+	if dwords[24] != "00000000" {
+		t.Errorf("PCIe header DWORD should be read-only, got %s", dwords[24])
+	}
+	if dwords[26] != "0000ffff" {
+		t.Errorf("PCIe Device Control/Status DWORD should be writable, got %s", dwords[26])
+	}
+}
+
 func TestGenerateBarContentCOE_Empty(t *testing.T) {
 	coe := GenerateBarContentCOE(nil, 4096)
 	if !strings.Contains(coe, "Zero-filled") {
@@ -188,7 +217,7 @@ func TestGenerateMSIXTableHex_Empty(t *testing.T) {
 func TestWritemask_ScrubbedBAR0FromZero(t *testing.T) {
 	cs := pci.NewConfigSpace()
 	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x00, 0x1102)     // Creative Labs
+	cs.WriteU16(0x00, 0x1102) // Creative Labs
 	cs.WriteU16(0x02, 0x0012)
 	cs.WriteU32(0x10, 0xFFFFF000) // BAR0 = 4KB mem (from scrubber)
 
@@ -255,11 +284,11 @@ func TestWritemask_IOBAROverwrittenToMemory(t *testing.T) {
 func TestWritemask_IdentityRegistersReadOnly(t *testing.T) {
 	cs := pci.NewConfigSpace()
 	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x00, 0x1102) // VID
-	cs.WriteU16(0x02, 0x0012) // DID
+	cs.WriteU16(0x00, 0x1102)     // VID
+	cs.WriteU16(0x02, 0x0012)     // DID
 	cs.WriteU32(0x08, 0x04030000) // ClassCode + RevID
-	cs.WriteU16(0x2C, 0x1102) // SubsysVID
-	cs.WriteU16(0x2E, 0x0012) // SubsysDID
+	cs.WriteU16(0x2C, 0x1102)     // SubsysVID
+	cs.WriteU16(0x2E, 0x0012)     // SubsysDID
 	cs.WriteU32(0x10, 0xFFFFF000) // BAR0
 
 	wm := GenerateWritemaskCOE(cs)
@@ -337,8 +366,8 @@ func TestWritemask_MultipleBARs(t *testing.T) {
 func TestConfigSpaceCOE_ScrubbedDeviceIdentity(t *testing.T) {
 	cs := pci.NewConfigSpace()
 	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x00, 0x1102) // VID
-	cs.WriteU16(0x02, 0x0012) // DID
+	cs.WriteU16(0x00, 0x1102)     // VID
+	cs.WriteU16(0x02, 0x0012)     // DID
 	cs.WriteU32(0x08, 0x04030000) // ClassCode 04:03:00
 
 	coe := GenerateConfigSpaceCOE(cs)
@@ -370,7 +399,7 @@ func TestConfigSpaceHex_DWORDFormat(t *testing.T) {
 func parseCOEDwords(t *testing.T, coe string) []string {
 	t.Helper()
 	lines := strings.Split(coe, "\n")
-	var dwords []string
+	dwords := make([]string, 0, len(lines))
 	for _, l := range lines {
 		l = strings.TrimSpace(l)
 		if l == "" || strings.HasPrefix(l, ";") || strings.HasPrefix(l, "memory") {
@@ -385,4 +414,3 @@ func parseCOEDwords(t *testing.T, coe string) []string {
 	}
 	return dwords
 }
-
diff --git a/internal/firmware/devclass/strategy_test.go b/internal/firmware/devclass/strategy_test.go
index 6f21ecb..be1e097 100644
--- a/internal/firmware/devclass/strategy_test.go
+++ b/internal/firmware/devclass/strategy_test.go
@@ -662,6 +662,7 @@ func TestAllStrategies_Profile(t *testing.T) {
 		p := s.Profile()
 		if p == nil {
 			t.Errorf("nil profile for %s", s.ClassName())
+			continue
 		}
 		if p.ClassName == "" {
 			t.Errorf("empty profile className for %s", s.ClassName())
diff --git a/internal/firmware/output/capabilities.go b/internal/firmware/output/capabilities.go
new file mode 100644
index 0000000..326adf9
--- /dev/null
+++ b/internal/firmware/output/capabilities.go
@@ -0,0 +1,67 @@
+package output
+
+import (
+	"github.com/sercanarga/pcileechgen/internal/firmware/svgen"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func extractDonorCapabilities(cs *pci.ConfigSpace) svgen.DonorCapabilities {
+	if cs == nil {
+		return svgen.DonorCapabilities{}
+	}
+
+	var caps svgen.DonorCapabilities
+	for _, cap := range pci.ParseCapabilities(cs) {
+		switch cap.ID {
+		case pci.CapIDPowerManagement:
+			caps.HasPMCap = true
+			if legacyFieldFits(cap.Offset+2, 2) {
+				pmc := cs.ReadU16(cap.Offset + 2)
+				caps.PMESupportMask = uint8((pmc >> 11) & 0x1F)
+			}
+			if legacyFieldFits(cap.Offset+4, 2) {
+				caps.PMEDefault = cs.ReadU16(cap.Offset+4)&0x0100 != 0
+			}
+		case pci.CapIDMSI:
+			caps.HasMSICap = true
+			if legacyFieldFits(cap.Offset+2, 2) {
+				msgCtl := cs.ReadU16(cap.Offset + 2)
+				caps.MSIDisable64Bit = msgCtl&0x0080 == 0
+				caps.MSIMultipleMsg = uint8((msgCtl >> 4) & 0x07)
+			}
+		case pci.CapIDMSIX:
+			caps.HasMSIXCap = true
+		case pci.CapIDPCIExpress:
+			caps.HasPCIeCap = true
+			if legacyFieldFits(cap.Offset+0x0C, 4) {
+				linkCap := cs.ReadU32(cap.Offset + 0x0C)
+				caps.PCIELinkSpeed = uint8(linkCap & 0x0F)
+				caps.PCIELinkWidth = uint8((linkCap >> 4) & 0x3F)
+				caps.PCIeASPMCap = uint8((linkCap >> 10) & 0x03)
+			}
+			if legacyFieldFits(cap.Offset+0x10, 2) {
+				linkCtl := cs.ReadU16(cap.Offset + 0x10)
+				caps.PCIeASPMEnable = uint8(linkCtl & 0x3)
+			}
+		}
+	}
+
+	for _, cap := range pci.ParseExtCapabilities(cs) {
+		switch cap.ID {
+		case pci.ExtCapIDAER:
+			caps.HasAERCap = true
+		case pci.ExtCapIDLTR:
+			caps.HasLTRCap = true
+		case pci.ExtCapIDL1PMSubstates:
+			caps.HasL1PMSubstates = true
+		case pci.ExtCapIDDeviceSerialNumber:
+			caps.HasDSNCap = true
+		}
+	}
+
+	return caps
+}
+
+func legacyFieldFits(offset int, width int) bool {
+	return offset >= 0 && width > 0 && offset+width <= pci.ConfigSpaceLegacySize
+}
diff --git a/internal/firmware/output/capabilities_test.go b/internal/firmware/output/capabilities_test.go
new file mode 100644
index 0000000..d53d538
--- /dev/null
+++ b/internal/firmware/output/capabilities_test.go
@@ -0,0 +1,82 @@
+package output
+
+import (
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestExtractDonorCapabilities_FromStandardAndExtendedCaps(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU16(0x06, 0x0010)
+	cs.WriteU8(0x34, 0x40)
+
+	cs.WriteU8(0x40, pci.CapIDPowerManagement)
+	cs.WriteU8(0x41, 0x50)
+	cs.WriteU16(0x42, 0xA800)
+	cs.WriteU16(0x44, 0x0100)
+
+	cs.WriteU8(0x50, pci.CapIDMSI)
+	cs.WriteU8(0x51, 0x60)
+	cs.WriteU16(0x52, 0x00F0)
+
+	cs.WriteU8(0x60, pci.CapIDMSIX)
+	cs.WriteU8(0x61, 0x70)
+
+	cs.WriteU8(0x70, pci.CapIDPCIExpress)
+	cs.WriteU8(0x71, 0x00)
+	cs.WriteU32(0x7C, 0x00000C43)
+	cs.WriteU16(0x80, 0x0002)
+
+	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 0x140))
+	cs.WriteU32(0x140, makeExtCapHeader(pci.ExtCapIDLTR, 0x180))
+	cs.WriteU32(0x180, makeExtCapHeader(pci.ExtCapIDL1PMSubstates, 0x1C0))
+	cs.WriteU32(0x1C0, makeExtCapHeader(pci.ExtCapIDDeviceSerialNumber, 0))
+
+	caps := extractDonorCapabilities(cs)
+
+	if !caps.HasPMCap {
+		t.Fatal("PM capability should be detected")
+	}
+	if caps.PMESupportMask != 0x15 {
+		t.Errorf("PMESupportMask = 0x%02x, want 0x15", caps.PMESupportMask)
+	}
+	if !caps.PMEDefault {
+		t.Error("PMEDefault should be true")
+	}
+	if !caps.HasMSICap {
+		t.Fatal("MSI capability should be detected")
+	}
+	if caps.MSIDisable64Bit {
+		t.Error("MSIDisable64Bit should be false")
+	}
+	if caps.MSIMultipleMsg != 0x07 {
+		t.Errorf("MSIMultipleMsg = 0x%02x, want 0x07", caps.MSIMultipleMsg)
+	}
+	if !caps.HasMSIXCap {
+		t.Error("MSI-X capability should be detected")
+	}
+	if !caps.HasPCIeCap {
+		t.Fatal("PCIe capability should be detected")
+	}
+	if caps.PCIELinkSpeed != 0x03 {
+		t.Errorf("PCIELinkSpeed = 0x%02x, want 0x03", caps.PCIELinkSpeed)
+	}
+	if caps.PCIELinkWidth != 0x04 {
+		t.Errorf("PCIELinkWidth = 0x%02x, want 0x04", caps.PCIELinkWidth)
+	}
+	if caps.PCIeASPMCap != 0x03 {
+		t.Errorf("PCIeASPMCap = 0x%02x, want 0x03", caps.PCIeASPMCap)
+	}
+	if caps.PCIeASPMEnable != 0x02 {
+		t.Errorf("PCIeASPMEnable = 0x%02x, want 0x02", caps.PCIeASPMEnable)
+	}
+	if !caps.HasAERCap || !caps.HasLTRCap || !caps.HasL1PMSubstates || !caps.HasDSNCap {
+		t.Errorf("extended caps missing: %+v", caps)
+	}
+}
+
+func makeExtCapHeader(id uint16, next int) uint32 {
+	return uint32(id) | (uint32(1) << 16) | (uint32(next&0xFFC) << 20)
+}
diff --git a/internal/firmware/output/integration_test.go b/internal/firmware/output/integration_test.go
index 83e0490..e9a7665 100644
--- a/internal/firmware/output/integration_test.go
+++ b/internal/firmware/output/integration_test.go
@@ -192,7 +192,9 @@ func TestIntegration_LatencyConfigWriteFields(t *testing.T) {
 func TestIntegration_OutputManifest(t *testing.T) {
 	dir := t.TempDir()
 	testFile := filepath.Join(dir, "pcileech_cfgspace.coe")
-	os.WriteFile(testFile, []byte("memory_initialization_radix=16;\nmemory_initialization_vector=00;"), 0644)
+	if err := os.WriteFile(testFile, []byte("memory_initialization_radix=16;\nmemory_initialization_vector=00;"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	manifest, err := GenerateManifest(dir, "test-version", "", 0x144D, 0xA808)
 	if err != nil {
@@ -206,7 +208,9 @@ func TestIntegration_OutputManifest(t *testing.T) {
 func TestIntegration_OutputValidator(t *testing.T) {
 	dir := t.TempDir()
 	coe := "memory_initialization_radix=16;\nmemory_initialization_vector=\n00000000\n00000000\n00000000\n00000000;"
-	os.WriteFile(filepath.Join(dir, "pcileech_cfgspace.coe"), []byte(coe), 0644)
+	if err := os.WriteFile(filepath.Join(dir, "pcileech_cfgspace.coe"), []byte(coe), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	result := ValidateOutputDir(dir)
 	// not all files exist so some will fail, but should not panic
diff --git a/internal/firmware/output/manifest_test.go b/internal/firmware/output/manifest_test.go
index 7cfdac7..75d45da 100644
--- a/internal/firmware/output/manifest_test.go
+++ b/internal/firmware/output/manifest_test.go
@@ -30,8 +30,12 @@ func TestGenerateManifest_Empty(t *testing.T) {
 func TestGenerateManifest_WithFiles(t *testing.T) {
 	tmpDir := t.TempDir()
 	// Create some output files
-	os.WriteFile(filepath.Join(tmpDir, "pcileech_cfgspace.coe"), []byte("test content"), 0644)
-	os.WriteFile(filepath.Join(tmpDir, "device_context.json"), []byte("{}"), 0644)
+	if err := os.WriteFile(filepath.Join(tmpDir, "pcileech_cfgspace.coe"), []byte("test content"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(tmpDir, "device_context.json"), []byte("{}"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	m, err := GenerateManifest(tmpDir, "1.0.0", "TestBoard", 0x8086, 0x1533)
 	if err != nil {
@@ -53,8 +57,12 @@ func TestGenerateManifest_WithFiles(t *testing.T) {
 func TestGenerateManifest_WithSrcDir(t *testing.T) {
 	tmpDir := t.TempDir()
 	srcDir := filepath.Join(tmpDir, "src")
-	os.MkdirAll(srcDir, 0755)
-	os.WriteFile(filepath.Join(srcDir, "test.sv"), []byte("module test; endmodule"), 0644)
+	if err := os.MkdirAll(srcDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(srcDir, "test.sv"), []byte("module test; endmodule"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	m, err := GenerateManifest(tmpDir, "1.0.0", "", 0, 0)
 	if err != nil {
@@ -109,7 +117,9 @@ func TestWriteJSON(t *testing.T) {
 func TestFileHash(t *testing.T) {
 	tmpDir := t.TempDir()
 	path := filepath.Join(tmpDir, "test.txt")
-	os.WriteFile(path, []byte("hello"), 0644)
+	if err := os.WriteFile(path, []byte("hello"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	hash, err := fileHash(path)
 	if err != nil {
@@ -121,7 +131,9 @@ func TestFileHash(t *testing.T) {
 
 	// Same content -> same hash
 	path2 := filepath.Join(tmpDir, "test2.txt")
-	os.WriteFile(path2, []byte("hello"), 0644)
+	if writeErr := os.WriteFile(path2, []byte("hello"), 0644); writeErr != nil {
+		t.Fatal(writeErr)
+	}
 	hash2, _ := fileHash(path2)
 	if hash != hash2 {
 		t.Error("Same content should produce same hash")
@@ -137,7 +149,9 @@ func TestFileHash(t *testing.T) {
 func TestVerifyManifest_AllPass(t *testing.T) {
 	tmpDir := t.TempDir()
 
-	os.WriteFile(filepath.Join(tmpDir, "test.coe"), []byte("content"), 0644)
+	if err := os.WriteFile(filepath.Join(tmpDir, "test.coe"), []byte("content"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	hash, _ := fileHash(filepath.Join(tmpDir, "test.coe"))
 	m := &BuildManifest{
@@ -146,7 +160,9 @@ func TestVerifyManifest_AllPass(t *testing.T) {
 		},
 	}
 	manifestPath := filepath.Join(tmpDir, "manifest.json")
-	m.WriteJSON(manifestPath)
+	if err := m.WriteJSON(manifestPath); err != nil {
+		t.Fatal(err)
+	}
 
 	v, err := VerifyManifest(manifestPath, tmpDir)
 	if err != nil {
@@ -168,7 +184,9 @@ func TestVerifyManifest_MissingFile(t *testing.T) {
 		},
 	}
 	manifestPath := filepath.Join(tmpDir, "manifest.json")
-	m.WriteJSON(manifestPath)
+	if err := m.WriteJSON(manifestPath); err != nil {
+		t.Fatal(err)
+	}
 
 	v, err := VerifyManifest(manifestPath, tmpDir)
 	if err != nil {
@@ -184,7 +202,9 @@ func TestVerifyManifest_MissingFile(t *testing.T) {
 
 func TestVerifyManifest_HashMismatch(t *testing.T) {
 	tmpDir := t.TempDir()
-	os.WriteFile(filepath.Join(tmpDir, "test.coe"), []byte("content"), 0644)
+	if err := os.WriteFile(filepath.Join(tmpDir, "test.coe"), []byte("content"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	m := &BuildManifest{
 		Files: []ManifestEntry{
@@ -192,7 +212,9 @@ func TestVerifyManifest_HashMismatch(t *testing.T) {
 		},
 	}
 	manifestPath := filepath.Join(tmpDir, "manifest.json")
-	m.WriteJSON(manifestPath)
+	if err := m.WriteJSON(manifestPath); err != nil {
+		t.Fatal(err)
+	}
 
 	v, err := VerifyManifest(manifestPath, tmpDir)
 	if err != nil {
@@ -213,7 +235,9 @@ func TestLoadManifest_Invalid(t *testing.T) {
 	}
 
 	tmpDir := t.TempDir()
-	os.WriteFile(filepath.Join(tmpDir, "bad.json"), []byte("not json"), 0644)
+	if writeErr := os.WriteFile(filepath.Join(tmpDir, "bad.json"), []byte("not json"), 0644); writeErr != nil {
+		t.Fatal(writeErr)
+	}
 	_, err = LoadManifest(filepath.Join(tmpDir, "bad.json"))
 	if err == nil {
 		t.Error("LoadManifest should fail for invalid JSON")
diff --git a/internal/firmware/output/validator.go b/internal/firmware/output/validator.go
index e78d604..88ebabb 100644
--- a/internal/firmware/output/validator.go
+++ b/internal/firmware/output/validator.go
@@ -26,13 +26,16 @@ func (vr *ValidationResult) Summary() string {
 
 func (vr *ValidationResult) pass(msg string) { vr.Passed = append(vr.Passed, msg) }
 func (vr *ValidationResult) fail(msg string) { vr.Failed = append(vr.Failed, msg) }
-func (vr *ValidationResult) warn(msg string) { vr.Warnings = append(vr.Warnings, msg) }
 
 // ValidateOutputDir checks that all expected files exist and aren't empty.
 func ValidateOutputDir(dir string) *ValidationResult {
 	result := &ValidationResult{}
 
 	for _, name := range ListOutputFiles() {
+		if !outputFileRequired(dir, name) {
+			continue
+		}
+
 		path := filepath.Join(dir, name)
 
 		if strings.HasSuffix(name, "/") {
@@ -87,9 +90,15 @@ func ValidateHexFile(hexContent string, expectedWords int) error {
 	nonEmpty := 0
 	for i, line := range lines {
 		line = strings.TrimSpace(line)
-		if line == "" {
+		if line == "" || strings.HasPrefix(line, "//") || strings.HasPrefix(line, ";") {
 			continue
 		}
+		if beforeComment, _, ok := strings.Cut(line, "//"); ok {
+			line = strings.TrimSpace(beforeComment)
+			if line == "" {
+				continue
+			}
+		}
 		nonEmpty++
 		if len(line) != 8 {
 			return fmt.Errorf("line %d: expected 8 hex chars, got %d (%q)", i+1, len(line), line)
@@ -108,6 +117,45 @@ func ValidateHexFile(hexContent string, expectedWords int) error {
 	return nil
 }
 
+func outputFileRequired(dir string, name string) bool {
+	switch name {
+	case "pcileech_msix_table.sv", "msix_table_init.hex":
+		return generatedLocalparamPresent(dir, "MSIX_NUM_VECTORS")
+	case "pcileech_nvme_admin_responder.sv", "pcileech_nvme_dma_bridge.sv":
+		return generatedFeatureEnabled(dir, "HAS_NVME_RESP")
+	default:
+		return true
+	}
+}
+
+func generatedFeatureEnabled(dir string, feature string) bool {
+	data, err := os.ReadFile(filepath.Join(dir, "device_config.sv"))
+	if err != nil {
+		return true
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) >= 4 && fields[1] == feature && fields[2] == "=" {
+			return strings.TrimSuffix(fields[3], ";") == "1"
+		}
+	}
+	return false
+}
+
+func generatedLocalparamPresent(dir string, name string) bool {
+	data, err := os.ReadFile(filepath.Join(dir, "device_config.sv"))
+	if err != nil {
+		return true
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) >= 2 && fields[1] == name {
+			return true
+		}
+	}
+	return false
+}
+
 // ValidateCOEFile checks radix/vector directives and trailing semicolon.
 func ValidateCOEFile(content string) error {
 	if !strings.Contains(content, "memory_initialization_radix") {
diff --git a/internal/firmware/output/validator_optional_test.go b/internal/firmware/output/validator_optional_test.go
new file mode 100644
index 0000000..debd94e
--- /dev/null
+++ b/internal/firmware/output/validator_optional_test.go
@@ -0,0 +1,79 @@
+package output
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestValidateHexFile_GeneratedComments(t *testing.T) {
+	hex := "// generated header\nDEADBEEF // [000]\n; comment\n12345678\n"
+	if err := ValidateHexFile(hex, 2); err != nil {
+		t.Errorf("expected generated hex comments to be ignored, got: %v", err)
+	}
+}
+
+func TestValidateOutputDir_SkipsDisabledOptionalArtifacts(t *testing.T) {
+	tmpDir := t.TempDir()
+	optional := map[string]bool{
+		"pcileech_msix_table.sv":           true,
+		"msix_table_init.hex":              true,
+		"pcileech_nvme_admin_responder.sv": true,
+		"pcileech_nvme_dma_bridge.sv":      true,
+	}
+	deviceConfig := "package device_config;\n" +
+		"localparam HAS_NVME_RESP    = 0;\n" +
+		"localparam HAS_MSIX_INT     = 0;\n" +
+		"endpackage\n"
+
+	writeOutputFixture(t, tmpDir, optional, deviceConfig)
+
+	result := ValidateOutputDir(tmpDir)
+	if result.HasFailures() {
+		t.Errorf("disabled optional artifacts should not fail validation: %v", result.Failed)
+	}
+}
+
+func TestValidateOutputDir_RequiresMSIXArtifactsWhenTableConfigured(t *testing.T) {
+	tmpDir := t.TempDir()
+	optional := map[string]bool{
+		"pcileech_msix_table.sv":           true,
+		"msix_table_init.hex":              true,
+		"pcileech_nvme_admin_responder.sv": true,
+		"pcileech_nvme_dma_bridge.sv":      true,
+	}
+	deviceConfig := "package device_config;\n" +
+		"localparam MSIX_NUM_VECTORS = 4;\n" +
+		"localparam HAS_NVME_RESP    = 0;\n" +
+		"endpackage\n"
+
+	writeOutputFixture(t, tmpDir, optional, deviceConfig)
+
+	result := ValidateOutputDir(tmpDir)
+	if len(result.Failed) != 2 {
+		t.Fatalf("expected missing MSI-X table artifacts to fail, got %v", result.Failed)
+	}
+}
+
+func writeOutputFixture(t *testing.T, tmpDir string, skip map[string]bool, deviceConfig string) {
+	t.Helper()
+	for _, name := range ListOutputFiles() {
+		if skip[name] {
+			continue
+		}
+		if strings.HasSuffix(name, "/") {
+			if err := os.MkdirAll(filepath.Join(tmpDir, name), 0755); err != nil {
+				t.Fatalf("MkdirAll(%s): %v", name, err)
+			}
+			continue
+		}
+		content := "content"
+		if name == "device_config.sv" {
+			content = deviceConfig
+		}
+		if err := os.WriteFile(filepath.Join(tmpDir, name), []byte(content), 0644); err != nil {
+			t.Fatalf("WriteFile(%s): %v", name, err)
+		}
+	}
+}
diff --git a/internal/firmware/output/validator_test.go b/internal/firmware/output/validator_test.go
index 0552765..20c8271 100644
--- a/internal/firmware/output/validator_test.go
+++ b/internal/firmware/output/validator_test.go
@@ -109,9 +109,13 @@ func TestValidateOutputDir_WithFiles(t *testing.T) {
 	tmpDir := t.TempDir()
 	for _, name := range ListOutputFiles() {
 		if strings.HasSuffix(name, "/") {
-			os.MkdirAll(filepath.Join(tmpDir, name), 0755)
+			if err := os.MkdirAll(filepath.Join(tmpDir, name), 0755); err != nil {
+				t.Fatal(err)
+			}
 		} else {
-			os.WriteFile(filepath.Join(tmpDir, name), []byte("content"), 0644)
+			if err := os.WriteFile(filepath.Join(tmpDir, name), []byte("content"), 0644); err != nil {
+				t.Fatal(err)
+			}
 		}
 	}
 
@@ -123,7 +127,9 @@ func TestValidateOutputDir_WithFiles(t *testing.T) {
 
 func TestValidateOutputDir_EmptyFile(t *testing.T) {
 	tmpDir := t.TempDir()
-	os.WriteFile(filepath.Join(tmpDir, "pcileech_cfgspace.coe"), []byte(""), 0644)
+	if err := os.WriteFile(filepath.Join(tmpDir, "pcileech_cfgspace.coe"), []byte(""), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	result := ValidateOutputDir(tmpDir)
 	foundEmpty := false
@@ -238,7 +244,11 @@ func TestValidationResult_Summary(t *testing.T) {
 	}
 }
 
-func TestValidateBARSizeExceed(t *testing.T){if e:=ValidateBARSize(8192,4096,0);len(e)==0{t.Error("ValidateBARSize(exceed) should report")}}
+func TestValidateBARSizeExceed(t *testing.T) {
+	if e := ValidateBARSize(8192, 4096, 0); len(e) == 0 {
+		t.Error("ValidateBARSize(exceed) should report")
+	}
+}
 
 // TestValidateBARSize_ExceedWithForce covers the exceed case (force logic lives in writer.buildSVConfig using len(issues) && !ow.Force)
 func TestValidateBARSize_ExceedWithForce(t *testing.T) {
@@ -269,11 +279,11 @@ func TestLargeBAR_CmdPathRepro(t *testing.T) {
 	barData := make([]byte, 16384)
 	barData[0], barData[100] = 0xDE, 0xAD
 	ctx := &donor.DeviceContext{
-		Device:      pci.PCIDevice{VendorID: 0x10DE, DeviceID: 0x1234, ClassCode: 0x030000, RevisionID: 0xA1},
-		ConfigSpace: pci.NewConfigSpace(),
-		BARs:        []pci.BAR{{Index: 0, Size: 16384, Type: pci.BARTypeMem32, RawValue: 0x00000000}},
-		BARContents: map[int][]byte{0: barData},
-		Capabilities: []pci.Capability{},
+		Device:          pci.PCIDevice{VendorID: 0x10DE, DeviceID: 0x1234, ClassCode: 0x030000, RevisionID: 0xA1},
+		ConfigSpace:     pci.NewConfigSpace(),
+		BARs:            []pci.BAR{{Index: 0, Size: 16384, Type: pci.BARTypeMem32, RawValue: 0x00000000}},
+		BARContents:     map[int][]byte{0: barData},
+		Capabilities:    []pci.Capability{},
 		ExtCapabilities: []pci.ExtCapability{},
 	}
 
@@ -284,9 +294,8 @@ func TestLargeBAR_CmdPathRepro(t *testing.T) {
 	if donorDemand != 16384 || bar0Sz != 4096 {
 		t.Fatalf("build trace: demand/capped 16k@4k want 16384/4096 got %d/%d", donorDemand, bar0Sz)
 	}
-	if donorDemand > b4k.BRAMSizeOrDefault() {
-		// without force -> error (as in runBuild)
-		// with force -> warn + proceed (bar0Sz used for scrub/writer)
+	if donorDemand <= b4k.BRAMSizeOrDefault() {
+		t.Fatal("test setup should require force for the 4KB board")
 	}
 
 	// writer buildSVConfig pattern: Validate(donor) w/ Force
@@ -305,12 +314,10 @@ func TestLargeBAR_CmdPathRepro(t *testing.T) {
 	donorV := firmware.DonorBAR0Demand(ctx, b4k, msixSz)
 	bar0V := firmware.CappedBAR0Size(ctx, b4k, msixSz)
 	_ = bar0V // used for scrub in validator
-	if b := b4k; b != nil {
-		if iss := ValidateBARSize(donorV, b.BRAMSizeOrDefault(), 0); len(iss) > 0 {
-			// returns fmt err(iss[0]) -- always, no force param in validate
-			if iss[0] == "" {
-				t.Error("validate must surface the Bar0Size exceed msg")
-			}
+	if iss := ValidateBARSize(donorV, b4k.BRAMSizeOrDefault(), 0); len(iss) > 0 {
+		// returns fmt err(iss[0]) -- always, no force param in validate
+		if iss[0] == "" {
+			t.Error("validate must surface the Bar0Size exceed msg")
 		}
 	}
 
@@ -340,9 +347,8 @@ func TestLargeBAR_CmdPathRepro(t *testing.T) {
 	// boards cmd shows BRAM column explicitly
 	// check uses largest from resource, errors/warns per checkForce, shows note "(donor BAR X > board BRAM Y)"
 	largestBAR := uint64(16384)
-	if uint64(b4k.BRAMSizeOrDefault()) < largestBAR {
-		// !checkForce => issues++ , label Fail , note with mismatch
-		// checkForce => label Warn
+	if uint64(b4k.BRAMSizeOrDefault()) >= largestBAR {
+		t.Error("test setup should model a donor BAR larger than board BRAM")
 	}
 
 	// === reproduce: final artifacts use correct size (capped) ===
diff --git a/internal/firmware/output/writer.go b/internal/firmware/output/writer.go
index 484074a..7535854 100644
--- a/internal/firmware/output/writer.go
+++ b/internal/firmware/output/writer.go
@@ -71,7 +71,7 @@ func (ow *OutputWriter) WriteAll(ctx *donor.DeviceContext, b *board.Board) error
 		return err
 	}
 
-	if err := ow.patchSVSources(ctx, b, ids); err != nil {
+	if err := ow.patchSVSources(b, ids); err != nil {
 		return fmt.Errorf("SV patching failed: %w", err)
 	}
 
@@ -200,7 +200,7 @@ var barControllerSubModules = []string{
 
 // patchSVSources copies the board's SV tree (excluding files that will
 // be regenerated), and patches donor IDs into the remaining sources.
-func (ow *OutputWriter) patchSVSources(ctx *donor.DeviceContext, b *board.Board, ids firmware.DeviceIDs) error {
+func (ow *OutputWriter) patchSVSources(b *board.Board, ids firmware.DeviceIDs) error {
 	srcDir := b.SrcPath(ow.LibDir)
 	dstDir := filepath.Join(ow.OutputDir, "src")
 
@@ -233,7 +233,9 @@ func (ow *OutputWriter) patchSVSources(ctx *donor.DeviceContext, b *board.Board,
 		srcFile := filepath.Join(srcDir, "pcileech_tlps128_bar_controller.sv")
 		dstFile := filepath.Join(dstDir, "pcileech_tlps128_bar_controller.sv")
 		if data, err := os.ReadFile(srcFile); err == nil {
-			os.WriteFile(dstFile, data, 0644)
+			if writeErr := os.WriteFile(dstFile, data, 0644); writeErr != nil {
+				return fmt.Errorf("failed to copy stock BAR controller: %w", writeErr)
+			}
 		}
 	}
 
@@ -444,7 +446,12 @@ func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.
 	bm := barmodel.BuildBARModel(barData, ctx.Device.ClassCode, barProfile)
 	slog.Info("BAR model built",
 		"model_nil", bm == nil,
-		"reg_count", func() int { if bm != nil { return len(bm.Registers) }; return 0 }(),
+		"reg_count", func() int {
+			if bm != nil {
+				return len(bm.Registers)
+			}
+			return 0
+		}(),
 	)
 
 	strategy := devclass.StrategyForClassAndVendor(ctx.Device.ClassCode, ids.VendorID)
@@ -468,15 +475,16 @@ func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.
 	}
 
 	cfg := &svgen.SVGeneratorConfig{
-		DeviceIDs:     ids,
-		BARModel:      bm,
-		ClassCode:     ctx.Device.ClassCode,
-		LatencyConfig: svgen.DefaultLatencyConfig(ctx.Device.ClassCode),
-		HasMSIX:       bm != nil,
-		BuildEntropy:  entropy,
-		PRNGSeeds:     svgen.BuildPRNGSeeds(ids.VendorID, ids.DeviceID, entropy),
-		DeviceClass:   devClass,
-		Bar0Size:      bar0Size,
+		DeviceIDs:         ids,
+		DonorCapabilities: extractDonorCapabilities(scrubbedCS),
+		BARModel:          bm,
+		ClassCode:         ctx.Device.ClassCode,
+		LatencyConfig:     svgen.DefaultLatencyConfig(ctx.Device.ClassCode),
+		HasMSIX:           bm != nil,
+		BuildEntropy:      entropy,
+		PRNGSeeds:         svgen.BuildPRNGSeeds(ids.VendorID, ids.DeviceID, entropy),
+		DeviceClass:       devClass,
+		Bar0Size:          bar0Size,
 	}
 
 	if devClass == devclass.ClassNVMe {
@@ -516,11 +524,15 @@ func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.
 	// Validate *donor demand* (may exceed) against board BRAM; error unless --force.
 	// (bar0Size is the Capped value actually used for artifacts/scrub/SV.)
 	if issues := ValidateBARSize(donorBar, bram, 0); len(issues) > 0 {
-		if !ow.Force { return nil, fmt.Errorf("%s", issues[0]) }
+		if !ow.Force {
+			return nil, fmt.Errorf("%s", issues[0])
+		}
 	}
 	if cfg.MSIXConfig != nil {
 		if issues := ValidateBARSize(donorBar, bram, cfg.MSIXConfig.TableOffset); len(issues) > 0 {
-			if !ow.Force { return nil, fmt.Errorf("%s", issues[0]) }
+			if !ow.Force {
+				return nil, fmt.Errorf("%s", issues[0])
+			}
 		}
 	}
 
@@ -571,8 +583,8 @@ func (ow *OutputWriter) writeConditionalArtifacts(cfg *svgen.SVGeneratorConfig,
 		if err != nil {
 			return fmt.Errorf("generating pcileech_nvme_admin_responder.sv: %w", err)
 		}
-		if err := ow.writeFile("pcileech_nvme_admin_responder.sv", nvmeSV); err != nil {
-			return err
+		if writeErr := ow.writeFile("pcileech_nvme_admin_responder.sv", nvmeSV); writeErr != nil {
+			return writeErr
 		}
 
 		bridgeSV, err := svgen.GenerateNVMeDMABridgeSV(cfg)
@@ -593,8 +605,8 @@ func (ow *OutputWriter) writeConditionalArtifacts(cfg *svgen.SVGeneratorConfig,
 		if err != nil {
 			return fmt.Errorf("generating pcileech_hda_rirb_dma.sv: %w", err)
 		}
-		if err := ow.writeFile("pcileech_hda_rirb_dma.sv", hdaSV); err != nil {
-			return err
+		if writeErr := ow.writeFile("pcileech_hda_rirb_dma.sv", hdaSV); writeErr != nil {
+			return writeErr
 		}
 
 		// MSI interrupt generator for HDA - critical for driver completion.
@@ -636,6 +648,18 @@ func (ow *OutputWriter) logSVSummary(cfg *svgen.SVGeneratorConfig) {
 	} else {
 		features = append(features, "BRAM fallback")
 	}
+	if cfg.DonorCapabilities.HasPMCap {
+		features = append(features, "donor PM cap")
+	}
+	if cfg.DonorCapabilities.HasMSICap {
+		features = append(features, "donor MSI cap")
+	}
+	if cfg.DonorCapabilities.HasMSIXCap {
+		features = append(features, "donor MSI-X cap")
+	}
+	if cfg.DonorCapabilities.HasPCIeCap {
+		features = append(features, "donor PCIe cap")
+	}
 	features = append(features, "latency emulator", "interrupt controller")
 	slog.Info("SV modules generated", "features", strings.Join(features, ", "))
 }
diff --git a/internal/firmware/scrub/pcie_inject.go b/internal/firmware/scrub/pcie_inject.go
index f2af45a..8c66d46 100644
--- a/internal/firmware/scrub/pcie_inject.go
+++ b/internal/firmware/scrub/pcie_inject.go
@@ -61,7 +61,7 @@ func findFreeCapSpace(cs *pci.ConfigSpace, caps []pci.Capability, needed int) in
 func buildPCIeCapData(b *board.Board) [pcieCapSize]byte {
 	var data [pcieCapSize]byte
 
-	maxSpeed := uint8(firmware.LinkSpeedGen2)
+	maxSpeed := firmware.LinkSpeedGen2
 	maxWidth := uint8(1)
 	if b != nil {
 		maxSpeed = b.MaxLinkSpeedOrDefault()
@@ -97,7 +97,7 @@ func buildPCIeCapData(b *board.Board) [pcieCapSize]byte {
 	linkCap := uint32(maxSpeed) |
 		(uint32(maxWidth) << 4) |
 		(6 << 12) | // L0s exit latency
-		(6 << 15)   // L1 exit latency
+		(6 << 15) // L1 exit latency
 	binary.LittleEndian.PutUint32(data[0x0C:], linkCap)
 
 	// Link Control (cap+0x10) = 0x0000 (no ASPM)
diff --git a/internal/firmware/scrub/scrub_overlay_test.go b/internal/firmware/scrub/scrub_overlay_test.go
index 783d0d1..e746ce9 100644
--- a/internal/firmware/scrub/scrub_overlay_test.go
+++ b/internal/firmware/scrub/scrub_overlay_test.go
@@ -58,8 +58,8 @@ func TestScrubConfigSpaceWithOverlay_BoardAwareLinkSpeed(t *testing.T) {
 	// Capability pointer
 	cs.WriteU8(0x34, 0x40)
 	// PCIe Capability at offset 0x40
-	cs.WriteU8(0x40, byte(pci.CapIDPCIExpress)) // PCIe cap ID
-	cs.WriteU8(0x41, 0x00)                      // next cap = 0
+	cs.WriteU8(0x40, pci.CapIDPCIExpress) // PCIe cap ID
+	cs.WriteU8(0x41, 0x00)                // next cap = 0
 	// Link Capabilities at cap+0x0C = 0x4C: Gen3, x4
 	cs.WriteU32(0x4C, 0x00000043)
 
diff --git a/internal/firmware/scrub/scrub_test.go b/internal/firmware/scrub/scrub_test.go
index 1fbb815..019d1ed 100644
--- a/internal/firmware/scrub/scrub_test.go
+++ b/internal/firmware/scrub/scrub_test.go
@@ -58,18 +58,18 @@ func TestScrubConfigSpace(t *testing.T) {
 	}
 }
 
-func makeExtCapHeader(id uint16, version uint8, nextOffset int) uint32 {
-	return uint32(id) | uint32(version)<<16 | uint32(nextOffset)<<20
+func makeExtCapHeader(id uint16, nextOffset int) uint32 {
+	return uint32(id) | 1<<16 | uint32(nextOffset)<<20
 }
 
 func TestFilterExtCaps_RemoveMiddle(t *testing.T) {
 	cs := pci.NewConfigSpace()
 	cs.Size = pci.ConfigSpaceSize
 
-	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 1, 0x150))
-	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDSRIOV, 1, 0x200))
-	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDDeviceSerialNumber, 1, 0x250))
-	cs.WriteU32(0x250, makeExtCapHeader(pci.ExtCapIDLTR, 1, 0))
+	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 0x150))
+	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDSRIOV, 0x200))
+	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDDeviceSerialNumber, 0x250))
+	cs.WriteU32(0x250, makeExtCapHeader(pci.ExtCapIDLTR, 0))
 
 	removed := FilterExtCapabilities(cs, overlay.NewMap(cs))
 
@@ -90,8 +90,8 @@ func TestFilterExtCaps_AllRemoved(t *testing.T) {
 	cs := pci.NewConfigSpace()
 	cs.Size = pci.ConfigSpaceSize
 
-	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDSRIOV, 1, 0x150))
-	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDResizableBAR, 1, 0))
+	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDSRIOV, 0x150))
+	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDResizableBAR, 0))
 
 	removed := FilterExtCapabilities(cs, overlay.NewMap(cs))
 	if len(removed) != 2 {
@@ -478,7 +478,8 @@ func TestRelocateMSIXToBRAM_TableOutside(t *testing.T) {
 	// table offset should be relocated to 0x1000
 	tableReg := scrubbed.ReadU32(0x94)
 	tableOff := tableReg &^ 0x07
-	off := uint32(0x1000); if tableOff != off {
+	off := uint32(0x1000)
+	if tableOff != off {
 		t.Errorf("MSI-X table offset should be relocated to 0x1000, got 0x%X", tableOff)
 	}
 
@@ -514,7 +515,8 @@ func TestRelocateMSIXToBRAM_TableInside(t *testing.T) {
 	// table still relocated to 0x1000 (consistent placement)
 	tableReg := scrubbed.ReadU32(0x94)
 	tableOff := tableReg &^ 0x07
-	off := uint32(0x1000); if tableOff != off {
+	off := uint32(0x1000)
+	if tableOff != off {
 		t.Errorf("MSI-X table should be relocated to 0x1000, got 0x%X", tableOff)
 	}
 }
@@ -724,7 +726,8 @@ func TestRelocateMSIXToBRAM(t *testing.T) {
 	// Table should be relocated to 0x1000
 	tableReg := cs.ReadU32(0x84)
 	tableOff := tableReg & 0xFFFFFFF8
-	off := uint32(0x1000); if tableOff != off {
+	off := uint32(0x1000)
+	if tableOff != off {
 		t.Errorf("Table offset = 0x%x, want 0x1000", tableOff)
 	}
 
@@ -763,9 +766,9 @@ func TestSecondaryPCIeNotFiltered(t *testing.T) {
 	cs.Size = pci.ConfigSpaceSize
 
 	// AER -> SecondaryPCIe -> LTR
-	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 1, 0x150))
-	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDSecondaryPCIe, 1, 0x200))
-	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDLTR, 1, 0))
+	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 0x150))
+	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDSecondaryPCIe, 0x200))
+	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDLTR, 0))
 
 	removed := FilterExtCapabilities(cs, overlay.NewMap(cs))
 	if len(removed) != 0 {
@@ -828,9 +831,9 @@ func TestL1PMSubstatesNotFiltered(t *testing.T) {
 	cs.Size = pci.ConfigSpaceSize
 
 	// AER -> L1PM -> LTR
-	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 1, 0x150))
-	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDL1PMSubstates, 1, 0x200))
-	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDLTR, 1, 0))
+	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 0x150))
+	cs.WriteU32(0x150, makeExtCapHeader(pci.ExtCapIDL1PMSubstates, 0x200))
+	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDLTR, 0))
 
 	removed := FilterExtCapabilities(cs, overlay.NewMap(cs))
 	if len(removed) != 0 {
@@ -908,8 +911,8 @@ func TestASPMFullyDisabledAfterScrub(t *testing.T) {
 	cs.WriteU16(0x68, 0x0400)
 
 	// L1PM Substates ext cap at 0x200
-	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 1, 0x200))
-	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDL1PMSubstates, 1, 0))
+	cs.WriteU32(0x100, makeExtCapHeader(pci.ExtCapIDAER, 0x200))
+	cs.WriteU32(0x200, makeExtCapHeader(pci.ExtCapIDL1PMSubstates, 0))
 	cs.WriteU32(0x204, 0x0000001F) // L1PM Capabilities: L1.1 + L1.2 support
 	cs.WriteU32(0x208, 0x0000000A) // L1PM Control 1: L1.1 + L1.2 enabled
 	cs.WriteU32(0x20C, 0x00000032) // L1PM Control 2
@@ -953,7 +956,11 @@ func TestASPMFullyDisabledAfterScrub(t *testing.T) {
 	}
 }
 
-func TestComputeBAR0SizeLarge(t *testing.T){if got:=ComputeBAR0Size(512,0);got!=32768{t.Errorf("ComputeBAR0Size(large)=%d",got)}}
+func TestComputeBAR0SizeLarge(t *testing.T) {
+	if got := ComputeBAR0Size(512, 0); got != 32768 {
+		t.Errorf("ComputeBAR0Size(large)=%d", got)
+	}
+}
 
 // TestPhisonNVMe64bMSIXScrub simulates the exact scenario for Code10 residual hunt:
 // NVMe (class 0x010802), vendor 0x1987 Phison, 64-bit BAR (e.g. 16KB size mask), MSIX present,
@@ -973,8 +980,8 @@ func TestPhisonNVMe64bMSIXScrub(t *testing.T) {
 	cs.WriteU8(0x0A, 0x08)    // Subclass
 	cs.WriteU8(0x0B, 0x01)    // Base NVMe class 0108xx
 	cs.WriteU8(0x0C, 0x10)
-	cs.WriteU8(0x0D, 0x00)    // latency
-	cs.WriteU8(0x0E, 0x00)    // header type 0
+	cs.WriteU8(0x0D, 0x00) // latency
+	cs.WriteU8(0x0E, 0x00) // header type 0
 	cs.WriteU8(0x0F, 0x00)
 	// 64b BAR0 16KB example: size mask FFFFC000 + type bits 0x4 (64b mem)
 	cs.WriteU32(0x10, 0xFFFC0004)
@@ -994,7 +1001,7 @@ func TestPhisonNVMe64bMSIXScrub(t *testing.T) {
 	// MSI-X at 0x48
 	cs.WriteU8(0x48, pci.CapIDMSIX)
 	cs.WriteU8(0x49, 0x60)
-	cs.WriteU16(0x4A, 0x0003) // 4 vectors, enabled later by relocate
+	cs.WriteU16(0x4A, 0x0003)     // 4 vectors, enabled later by relocate
 	cs.WriteU32(0x4C, 0x00000000) // table off (will relocate)
 	cs.WriteU32(0x50, 0x00000008) // pba
 
@@ -1002,7 +1009,9 @@ func TestPhisonNVMe64bMSIXScrub(t *testing.T) {
 	cs.WriteU8(0x60, pci.CapIDPCIExpress)
 	cs.WriteU8(0x61, 0x00)
 	// fill minimal for cap parse
-	for i := 0x62; i < 0x60+60; i++ { cs.WriteU8(i, 0) }
+	for i := 0x62; i < 0x60+60; i++ {
+		cs.WriteU8(i, 0)
+	}
 	cs.WriteU16(0x62, 0x0002) // ver2 endpoint
 
 	// Phison vendor region at 0x40-0x4F (but will be cap-overlapped, knownWhitelist preserves 0x40-0x50 even if not cap)
@@ -1059,7 +1068,7 @@ func TestPhisonNVMe64bMSIXScrub(t *testing.T) {
 	// check Phison vendor region preserved (whitelist 0x40-0x50)
 	// since 0x40-0x50 overlaps caps, check a non-cap vendor spot if any; here 0x80 not whitelisted so zeroed ok
 	// but the pass zeroVendor is after caps; verify cmd/status/class intact
-	if scrubbed.ReadU32(0x08) >> 8 != classCode {
+	if scrubbed.ReadU32(0x08)>>8 != classCode {
 		t.Error("class at 0x08 not matching")
 	}
 }
diff --git a/internal/firmware/svgen/generator.go b/internal/firmware/svgen/generator.go
index a779731..e2db3ec 100644
--- a/internal/firmware/svgen/generator.go
+++ b/internal/firmware/svgen/generator.go
@@ -22,6 +22,7 @@ type MSIConfig struct {
 // SVGeneratorConfig is the input data for all SV template renders.
 type SVGeneratorConfig struct {
 	DeviceIDs          firmware.DeviceIDs
+	DonorCapabilities  DonorCapabilities  // donor capability summary for donor-emulation visibility
 	BARModel           *barmodel.BARModel // nil = generic fallback (uses BRAM-based zerowrite4k)
 	ClassCode          uint32
 	LatencyConfig      *LatencyConfig     // TLP response timing (nil = no latency emulator)
@@ -36,6 +37,28 @@ type SVGeneratorConfig struct {
 	Bar0Size           int
 }
 
+// DonorCapabilities summarizes parsed capabilities from donor config space.
+// Values are best-effort snapshots used by generated SV for optional emulation
+// behavior and debugging visibility.
+type DonorCapabilities struct {
+	HasPMCap         bool
+	HasMSICap        bool
+	HasMSIXCap       bool
+	HasPCIeCap       bool
+	PMESupportMask   uint8
+	PMEDefault       bool
+	MSIDisable64Bit  bool
+	MSIMultipleMsg   uint8
+	PCIELinkSpeed    uint8
+	PCIELinkWidth    uint8
+	PCIeASPMCap      uint8
+	PCIeASPMEnable   uint8
+	HasLTRCap        bool
+	HasL1PMSubstates bool
+	HasAERCap        bool
+	HasDSNCap        bool
+}
+
 // NVMeSQ0DoorbellOffset returns the byte offset of the SQ0 tail doorbell.
 // Doorbell base uses board.DefaultBRAMSize (0x1000 classic) so it stays correct for
 // variable/large BAR0 (16k+) + post-doorbell MSIX placement on boards like CaptainDMA_75T.
diff --git a/internal/firmware/svgen/templates/device_config.sv.tmpl b/internal/firmware/svgen/templates/device_config.sv.tmpl
index 582cdd3..1894124 100644
--- a/internal/firmware/svgen/templates/device_config.sv.tmpl
+++ b/internal/firmware/svgen/templates/device_config.sv.tmpl
@@ -14,6 +14,9 @@
 // Class Code:      0x{{ hex02 (classBase .ClassCode) }}{{ hex02 (classSub .ClassCode) }}{{ hex02 (classProgIF .ClassCode) }}
 {{ if .DeviceIDs.HasDSN }}// DSN:             0x{{ printf "%016X" .DeviceIDs.DSN }}{{ end }}
 {{ if .DeviceIDs.HasPCIeCap }}// PCIe Link:       Speed={{ .DeviceIDs.LinkSpeed }} Width=x{{ .DeviceIDs.LinkWidth }}{{ end }}
+{{ if .DonorCapabilities.HasPMCap }}// Donor PM: PME support=0x{{ printf "%02X" .DonorCapabilities.PMESupportMask }}, PME_Enable={{ if .DonorCapabilities.PMEDefault }}on{{ else }}off{{ end }}{{ end }}
+{{ if .DonorCapabilities.HasMSICap }}// Donor MSI: multiple-msg=0x{{ printf "%02X" .DonorCapabilities.MSIMultipleMsg }}{{ if .DonorCapabilities.MSIDisable64Bit }}, 64-bit=off{{ end }}{{ end }}
+{{ if .DonorCapabilities.HasPCIeCap }}// Donor PCIe: ASPM cap=0x{{ printf "%01X" .DonorCapabilities.PCIeASPMCap }}, ASPM enable=0x{{ printf "%01X" .DonorCapabilities.PCIeASPMEnable }}, link=x{{ .DonorCapabilities.PCIELinkWidth }} {{ .DonorCapabilities.PCIELinkSpeed }}GT/s{{ end }}
 //
 // Features:
 {{ if eq .DeviceClass "nvme" }}//   - NVMe CC->CSTS state machine (dynamic handshake)
@@ -61,6 +64,21 @@ package device_config;
     localparam HAS_XHCI_FSM     = {{ if eq .DeviceClass "xhci" }}1{{ else }}0{{ end }};
     localparam HAS_AUDIO_FSM    = {{ if eq .DeviceClass "audio" }}1{{ else }}0{{ end }};
     localparam HAS_MSIX_INT     = {{ if .HasMSIX }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_PM_CAP   = {{ if .DonorCapabilities.HasPMCap }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_MSI_CAP  = {{ if .DonorCapabilities.HasMSICap }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_MSIX_CAP = {{ if .DonorCapabilities.HasMSIXCap }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_PCIE_CAP = {{ if .DonorCapabilities.HasPCIeCap }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_AER_CAP  = {{ if .DonorCapabilities.HasAERCap }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_LTR_CAP  = {{ if .DonorCapabilities.HasLTRCap }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_L1PM_CAP = {{ if .DonorCapabilities.HasL1PMSubstates }}1{{ else }}0{{ end }};
+    localparam HAS_DONOR_DSN_CAP  = {{ if .DonorCapabilities.HasDSNCap }}1{{ else }}0{{ end }};
+    localparam [7:0] DONOR_PME_SUPPORT_MASK   = 8'h{{ printf "%02X" .DonorCapabilities.PMESupportMask }};
+    localparam       DONOR_MSI_DISABLE_64      = {{ if .DonorCapabilities.MSIDisable64Bit }}1{{ else }}0{{ end }};
+    localparam [2:0] DONOR_MSI_MULTIPLE_MSG    = 3'b{{ printf "%03b" .DonorCapabilities.MSIMultipleMsg }};
+    localparam [1:0] DONOR_PCIE_ASPM_CAP       = 2'b{{ printf "%02b" .DonorCapabilities.PCIeASPMCap }};
+    localparam [1:0] DONOR_PCIE_ASPM_ENABLE    = 2'b{{ printf "%02b" .DonorCapabilities.PCIeASPMEnable }};
+    localparam [7:0] DONOR_PCIELINK_SPEED      = 8'd{{ .DonorCapabilities.PCIELinkSpeed }};
+    localparam [7:0] DONOR_PCIELINK_WIDTH      = 8'd{{ .DonorCapabilities.PCIELinkWidth }};
     localparam HAS_LATENCY_EMU  = {{ if .LatencyConfig }}1{{ else }}0{{ end }};
 endpackage
 
diff --git a/internal/firmware/tclgen/tclgen.go b/internal/firmware/tclgen/tclgen.go
index 3e93982..9aa1deb 100644
--- a/internal/firmware/tclgen/tclgen.go
+++ b/internal/firmware/tclgen/tclgen.go
@@ -34,12 +34,12 @@ type projectTCLData struct {
 	LinkWidth     string
 	TrgtLinkSpeed string
 
-	Bar0Enabled bool
-	Bar0Size    string
-	Bar0Scale   string
-	Bar064bit   bool
+	Bar0Enabled  bool
+	Bar0Size     string
+	Bar0Scale    string
+	Bar064bit    bool
 	Bar0ByteSize int
-	StockBar    bool
+	StockBar     bool
 
 	DSNEnabled       bool
 	MSICapVectorsStr string
@@ -172,7 +172,7 @@ func GenerateProjectTCL(ctx *donor.DeviceContext, b *board.Board, libDir string,
 		is64 := bar0.Is64bit && bir == 0
 		data.MSIXTableBIR = barBIRToTCL(bir, is64)
 		dstrd := uint32(0)
-		if bar0d := firmware.LargestBar(ctx.BARContents); bar0d != nil && len(bar0d) >= 8 {
+		if bar0d := firmware.LargestBar(ctx.BARContents); len(bar0d) >= 8 {
 			dstrd = binary.LittleEndian.Uint32(bar0d[4:8]) & 0x0F
 		}
 		tableOff, pbaOffset, _ := firmware.MSIXPlacement(bar0Size, ctx.MSIXData.TableSize, ctx.Device.ClassCode, dstrd)
diff --git a/internal/pci/bar.go b/internal/pci/bar.go
index b04e47e..a31a8fb 100644
--- a/internal/pci/bar.go
+++ b/internal/pci/bar.go
@@ -132,7 +132,7 @@ func ParseBARsFromSysfsResource(lines []string) []BAR {
 		n, _ := fmt.Sscanf(lines[i], "0x%x 0x%x 0x%x", &start, &end, &flags)
 		if n != 3 {
 			// Try without 0x prefix
-			n, _ = fmt.Sscanf(lines[i], "%x %x %x", &start, &end, &flags)
+			_, _ = fmt.Sscanf(lines[i], "%x %x %x", &start, &end, &flags)
 		}
 
 		bar := BAR{Index: i}
diff --git a/internal/util/file.go b/internal/util/file.go
index b241aea..30b7bd8 100644
--- a/internal/util/file.go
+++ b/internal/util/file.go
@@ -36,8 +36,8 @@ func CopyDir(src, dst string) error {
 		return err
 	}
 
-	if err := os.MkdirAll(dst, srcInfo.Mode()); err != nil {
-		return err
+	if mkdirErr := os.MkdirAll(dst, srcInfo.Mode()); mkdirErr != nil {
+		return mkdirErr
 	}
 
 	entries, err := os.ReadDir(src)
diff --git a/internal/util/file_test.go b/internal/util/file_test.go
index 9d920d0..eeffdd5 100644
--- a/internal/util/file_test.go
+++ b/internal/util/file_test.go
@@ -41,9 +41,15 @@ func TestCopyDir(t *testing.T) {
 	dstDir := filepath.Join(t.TempDir(), "dst")
 
 	// Create nested structure
-	os.MkdirAll(filepath.Join(srcDir, "sub"), 0755)
-	os.WriteFile(filepath.Join(srcDir, "a.txt"), []byte("aaa"), 0644)
-	os.WriteFile(filepath.Join(srcDir, "sub", "b.txt"), []byte("bbb"), 0644)
+	if err := os.MkdirAll(filepath.Join(srcDir, "sub"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(srcDir, "a.txt"), []byte("aaa"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(srcDir, "sub", "b.txt"), []byte("bbb"), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	if err := CopyDir(srcDir, dstDir); err != nil {
 		t.Fatalf("CopyDir error: %v", err)
diff --git a/internal/vivado/reporter.go b/internal/vivado/reporter.go
index 9b66c57..649ee93 100644
--- a/internal/vivado/reporter.go
+++ b/internal/vivado/reporter.go
@@ -114,7 +114,7 @@ func (e *LogEntry) IsBenign() bool {
 
 // ActionableEntries filters out INFO and known-benign entries.
 func (r *Report) ActionableEntries() []LogEntry {
-	var result []LogEntry
+	result := make([]LogEntry, 0, len(r.Entries))
 	for _, e := range r.Entries {
 		if e.Severity == SeverityInfo {
 			continue
diff --git a/internal/vivado/vivado_test.go b/internal/vivado/vivado_test.go
index 80e8232..59af220 100644
--- a/internal/vivado/vivado_test.go
+++ b/internal/vivado/vivado_test.go
@@ -71,7 +71,9 @@ synth_design completed successfully
 route_design completed successfully
 write_bitstream completed successfully`
 
-	os.WriteFile(logPath, []byte(content), 0644)
+	if err := os.WriteFile(logPath, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
 
 	report, err := ParseLogFile(logPath)
 	if err != nil {

From e80f6a370bfc00a77f51add4e9d8cdea3b61cb9d Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 21:02:42 +0200
Subject: [PATCH 08/31] feat(firmware): expose donor capability offsets

---
 internal/firmware/output/capabilities.go         |  8 ++++++++
 internal/firmware/output/capabilities_test.go    | 16 ++++++++++++++++
 internal/firmware/svgen/generator.go             |  8 ++++++++
 .../svgen/templates/device_config.sv.tmpl        |  8 ++++++++
 4 files changed, 40 insertions(+)

diff --git a/internal/firmware/output/capabilities.go b/internal/firmware/output/capabilities.go
index 326adf9..28f304b 100644
--- a/internal/firmware/output/capabilities.go
+++ b/internal/firmware/output/capabilities.go
@@ -15,6 +15,7 @@ func extractDonorCapabilities(cs *pci.ConfigSpace) svgen.DonorCapabilities {
 		switch cap.ID {
 		case pci.CapIDPowerManagement:
 			caps.HasPMCap = true
+			caps.PMCapOffset = uint16(cap.Offset)
 			if legacyFieldFits(cap.Offset+2, 2) {
 				pmc := cs.ReadU16(cap.Offset + 2)
 				caps.PMESupportMask = uint8((pmc >> 11) & 0x1F)
@@ -24,6 +25,7 @@ func extractDonorCapabilities(cs *pci.ConfigSpace) svgen.DonorCapabilities {
 			}
 		case pci.CapIDMSI:
 			caps.HasMSICap = true
+			caps.MSICapOffset = uint16(cap.Offset)
 			if legacyFieldFits(cap.Offset+2, 2) {
 				msgCtl := cs.ReadU16(cap.Offset + 2)
 				caps.MSIDisable64Bit = msgCtl&0x0080 == 0
@@ -31,8 +33,10 @@ func extractDonorCapabilities(cs *pci.ConfigSpace) svgen.DonorCapabilities {
 			}
 		case pci.CapIDMSIX:
 			caps.HasMSIXCap = true
+			caps.MSIXCapOffset = uint16(cap.Offset)
 		case pci.CapIDPCIExpress:
 			caps.HasPCIeCap = true
+			caps.PCIeCapOffset = uint16(cap.Offset)
 			if legacyFieldFits(cap.Offset+0x0C, 4) {
 				linkCap := cs.ReadU32(cap.Offset + 0x0C)
 				caps.PCIELinkSpeed = uint8(linkCap & 0x0F)
@@ -50,12 +54,16 @@ func extractDonorCapabilities(cs *pci.ConfigSpace) svgen.DonorCapabilities {
 		switch cap.ID {
 		case pci.ExtCapIDAER:
 			caps.HasAERCap = true
+			caps.AERCapOffset = uint16(cap.Offset)
 		case pci.ExtCapIDLTR:
 			caps.HasLTRCap = true
+			caps.LTRCapOffset = uint16(cap.Offset)
 		case pci.ExtCapIDL1PMSubstates:
 			caps.HasL1PMSubstates = true
+			caps.L1PMCapOffset = uint16(cap.Offset)
 		case pci.ExtCapIDDeviceSerialNumber:
 			caps.HasDSNCap = true
+			caps.DSNCapOffset = uint16(cap.Offset)
 		}
 	}
 
diff --git a/internal/firmware/output/capabilities_test.go b/internal/firmware/output/capabilities_test.go
index d53d538..206d237 100644
--- a/internal/firmware/output/capabilities_test.go
+++ b/internal/firmware/output/capabilities_test.go
@@ -39,6 +39,9 @@ func TestExtractDonorCapabilities_FromStandardAndExtendedCaps(t *testing.T) {
 	if !caps.HasPMCap {
 		t.Fatal("PM capability should be detected")
 	}
+	if caps.PMCapOffset != 0x40 {
+		t.Errorf("PMCapOffset = 0x%03x, want 0x040", caps.PMCapOffset)
+	}
 	if caps.PMESupportMask != 0x15 {
 		t.Errorf("PMESupportMask = 0x%02x, want 0x15", caps.PMESupportMask)
 	}
@@ -48,6 +51,9 @@ func TestExtractDonorCapabilities_FromStandardAndExtendedCaps(t *testing.T) {
 	if !caps.HasMSICap {
 		t.Fatal("MSI capability should be detected")
 	}
+	if caps.MSICapOffset != 0x50 {
+		t.Errorf("MSICapOffset = 0x%03x, want 0x050", caps.MSICapOffset)
+	}
 	if caps.MSIDisable64Bit {
 		t.Error("MSIDisable64Bit should be false")
 	}
@@ -57,9 +63,15 @@ func TestExtractDonorCapabilities_FromStandardAndExtendedCaps(t *testing.T) {
 	if !caps.HasMSIXCap {
 		t.Error("MSI-X capability should be detected")
 	}
+	if caps.MSIXCapOffset != 0x60 {
+		t.Errorf("MSIXCapOffset = 0x%03x, want 0x060", caps.MSIXCapOffset)
+	}
 	if !caps.HasPCIeCap {
 		t.Fatal("PCIe capability should be detected")
 	}
+	if caps.PCIeCapOffset != 0x70 {
+		t.Errorf("PCIeCapOffset = 0x%03x, want 0x070", caps.PCIeCapOffset)
+	}
 	if caps.PCIELinkSpeed != 0x03 {
 		t.Errorf("PCIELinkSpeed = 0x%02x, want 0x03", caps.PCIELinkSpeed)
 	}
@@ -75,6 +87,10 @@ func TestExtractDonorCapabilities_FromStandardAndExtendedCaps(t *testing.T) {
 	if !caps.HasAERCap || !caps.HasLTRCap || !caps.HasL1PMSubstates || !caps.HasDSNCap {
 		t.Errorf("extended caps missing: %+v", caps)
 	}
+	if caps.AERCapOffset != 0x100 || caps.LTRCapOffset != 0x140 ||
+		caps.L1PMCapOffset != 0x180 || caps.DSNCapOffset != 0x1C0 {
+		t.Errorf("extended cap offsets missing: %+v", caps)
+	}
 }
 
 func makeExtCapHeader(id uint16, next int) uint32 {
diff --git a/internal/firmware/svgen/generator.go b/internal/firmware/svgen/generator.go
index e2db3ec..d568f3b 100644
--- a/internal/firmware/svgen/generator.go
+++ b/internal/firmware/svgen/generator.go
@@ -45,6 +45,10 @@ type DonorCapabilities struct {
 	HasMSICap        bool
 	HasMSIXCap       bool
 	HasPCIeCap       bool
+	PMCapOffset      uint16
+	MSICapOffset     uint16
+	MSIXCapOffset    uint16
+	PCIeCapOffset    uint16
 	PMESupportMask   uint8
 	PMEDefault       bool
 	MSIDisable64Bit  bool
@@ -57,6 +61,10 @@ type DonorCapabilities struct {
 	HasL1PMSubstates bool
 	HasAERCap        bool
 	HasDSNCap        bool
+	AERCapOffset     uint16
+	LTRCapOffset     uint16
+	L1PMCapOffset    uint16
+	DSNCapOffset     uint16
 }
 
 // NVMeSQ0DoorbellOffset returns the byte offset of the SQ0 tail doorbell.
diff --git a/internal/firmware/svgen/templates/device_config.sv.tmpl b/internal/firmware/svgen/templates/device_config.sv.tmpl
index 1894124..0291b99 100644
--- a/internal/firmware/svgen/templates/device_config.sv.tmpl
+++ b/internal/firmware/svgen/templates/device_config.sv.tmpl
@@ -72,6 +72,14 @@ package device_config;
     localparam HAS_DONOR_LTR_CAP  = {{ if .DonorCapabilities.HasLTRCap }}1{{ else }}0{{ end }};
     localparam HAS_DONOR_L1PM_CAP = {{ if .DonorCapabilities.HasL1PMSubstates }}1{{ else }}0{{ end }};
     localparam HAS_DONOR_DSN_CAP  = {{ if .DonorCapabilities.HasDSNCap }}1{{ else }}0{{ end }};
+    localparam [11:0] DONOR_PM_CAP_OFF    = 12'h{{ printf "%03X" .DonorCapabilities.PMCapOffset }};
+    localparam [11:0] DONOR_MSI_CAP_OFF   = 12'h{{ printf "%03X" .DonorCapabilities.MSICapOffset }};
+    localparam [11:0] DONOR_MSIX_CAP_OFF  = 12'h{{ printf "%03X" .DonorCapabilities.MSIXCapOffset }};
+    localparam [11:0] DONOR_PCIE_CAP_OFF  = 12'h{{ printf "%03X" .DonorCapabilities.PCIeCapOffset }};
+    localparam [11:0] DONOR_AER_CAP_OFF   = 12'h{{ printf "%03X" .DonorCapabilities.AERCapOffset }};
+    localparam [11:0] DONOR_LTR_CAP_OFF   = 12'h{{ printf "%03X" .DonorCapabilities.LTRCapOffset }};
+    localparam [11:0] DONOR_L1PM_CAP_OFF  = 12'h{{ printf "%03X" .DonorCapabilities.L1PMCapOffset }};
+    localparam [11:0] DONOR_DSN_CAP_OFF   = 12'h{{ printf "%03X" .DonorCapabilities.DSNCapOffset }};
     localparam [7:0] DONOR_PME_SUPPORT_MASK   = 8'h{{ printf "%02X" .DonorCapabilities.PMESupportMask }};
     localparam       DONOR_MSI_DISABLE_64      = {{ if .DonorCapabilities.MSIDisable64Bit }}1{{ else }}0{{ end }};
     localparam [2:0] DONOR_MSI_MULTIPLE_MSG    = 3'b{{ printf "%03b" .DonorCapabilities.MSIMultipleMsg }};

From 26c862a75c2bb02cda8b8dc04cb1e417aabef10d Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 21:09:26 +0200
Subject: [PATCH 09/31] fix(vivado): detect startup failures

---
 internal/vivado/vivado.go      | 24 ++++++++++++++++++++++--
 internal/vivado/vivado_test.go | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/internal/vivado/vivado.go b/internal/vivado/vivado.go
index 2aa1275..12147cd 100644
--- a/internal/vivado/vivado.go
+++ b/internal/vivado/vivado.go
@@ -2,8 +2,10 @@
 package vivado
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"log/slog"
 	"os"
 	"os/exec"
@@ -102,8 +104,9 @@ func (v *Vivado) RunTCL(tclScript string, workDir string, timeout time.Duration)
 
 	cmd := exec.CommandContext(ctx, v.BinaryPath(), "-mode", "batch", "-notrace", "-source", tclScript)
 	cmd.Dir = workDir
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
+	var output bytes.Buffer
+	cmd.Stdout = io.MultiWriter(os.Stdout, &output)
+	cmd.Stderr = io.MultiWriter(os.Stderr, &output)
 
 	// Set up environment
 	env := os.Environ()
@@ -119,5 +122,22 @@ func (v *Vivado) RunTCL(tclScript string, workDir string, timeout time.Duration)
 		return fmt.Errorf("Vivado execution failed: %w", err)
 	}
 
+	if line, ok := vivadoStartupFailure(output.String()); ok {
+		return fmt.Errorf("Vivado startup failed: %s", line)
+	}
+
 	return nil
 }
+
+func vivadoStartupFailure(output string) (string, bool) {
+	for _, line := range strings.Split(output, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		if strings.Contains(line, "application-specific initialization failed") {
+			return line, true
+		}
+	}
+	return "", false
+}
diff --git a/internal/vivado/vivado_test.go b/internal/vivado/vivado_test.go
index 59af220..e910ddd 100644
--- a/internal/vivado/vivado_test.go
+++ b/internal/vivado/vivado_test.go
@@ -112,3 +112,36 @@ func TestRunTCL_NonExistent(t *testing.T) {
 		t.Error("RunTCL should fail with non-existent vivado")
 	}
 }
+
+func TestRunTCL_ReturnsError_whenVivadoStartupFails(t *testing.T) {
+	// Given
+	installDir := t.TempDir()
+	binDir := filepath.Join(installDir, "bin")
+	if err := os.MkdirAll(binDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	vivadoPath := filepath.Join(binDir, "vivado")
+	script := `#!/bin/sh
+echo 'application-specific initialization failed: couldn'\''t load file "librdi_commontasks.so": libtinfo.so.5: cannot open shared object file: No such file or directory' >&2
+exit 0
+`
+	if err := os.WriteFile(vivadoPath, []byte(script), 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	v := &Vivado{Path: installDir, Version: filepath.Base(installDir)}
+
+	// When
+	err := v.RunTCL("vivado_generate_project.tcl", t.TempDir(), 5*time.Second)
+
+	// Then
+	if err == nil {
+		t.Fatal("RunTCL should fail when Vivado reports a startup failure")
+	}
+	if !strings.Contains(err.Error(), "Vivado startup failed") {
+		t.Fatalf("RunTCL error = %q, want startup failure", err.Error())
+	}
+	if !strings.Contains(err.Error(), "libtinfo.so.5") {
+		t.Fatalf("RunTCL error = %q, want loader detail", err.Error())
+	}
+}

From 5f347a2aed151ed0d6b52bd80e1e98e0b5ce3276 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 22:05:12 +0200
Subject: [PATCH 10/31] feat(firmware): emit BAR behavior profiles

---
 internal/firmware/barprofile/profile.go      | 219 +++++++++++++++++++
 internal/firmware/barprofile/profile_test.go |  68 ++++++
 internal/firmware/output/bar_profile.go      |  21 ++
 internal/firmware/output/writer.go           |   5 +
 internal/firmware/output/writer_test.go      |  38 ++++
 5 files changed, 351 insertions(+)
 create mode 100644 internal/firmware/barprofile/profile.go
 create mode 100644 internal/firmware/barprofile/profile_test.go
 create mode 100644 internal/firmware/output/bar_profile.go

diff --git a/internal/firmware/barprofile/profile.go b/internal/firmware/barprofile/profile.go
new file mode 100644
index 0000000..c3766fc
--- /dev/null
+++ b/internal/firmware/barprofile/profile.go
@@ -0,0 +1,219 @@
+package barprofile
+
+import (
+	"encoding/binary"
+	"fmt"
+	"sort"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+const (
+	HintProbeModel         = "probe_model"
+	HintSpecModel          = "spec_model"
+	HintShadowOnly         = "shadow_only"
+	HintIOSpaceUnsupported = "io_space_unsupported"
+
+	RegisterDead     = "dead"
+	RegisterStatic   = "static"
+	RegisterWritable = "writable"
+	RegisterRW1C     = "rw1c"
+	RegisterAllOnes  = "all_ones"
+	RegisterUnknown  = "unknown"
+)
+
+type Profile struct {
+	ClassCode   uint32       `json:"class_code"`
+	DeviceClass string       `json:"device_class,omitempty"`
+	BARs        []BARSummary `json:"bars"`
+}
+
+type BARSummary struct {
+	Index             int               `json:"index"`
+	Type              string            `json:"type"`
+	Size              uint64            `json:"size"`
+	CapturedBytes     int               `json:"captured_bytes"`
+	Prefetchable      bool              `json:"prefetchable"`
+	Is64Bit           bool              `json:"is_64bit"`
+	EmulationHint     string            `json:"emulation_hint"`
+	Density           string            `json:"density"`
+	NonZeroBytes      int               `json:"non_zero_bytes"`
+	NonFFBytes        int               `json:"non_ff_bytes"`
+	DeadRegisters     int               `json:"dead_registers"`
+	StaticRegisters   int               `json:"static_registers"`
+	WritableRegisters int               `json:"writable_registers"`
+	RW1CRegisters     int               `json:"rw1c_registers"`
+	AllOnesRegisters  int               `json:"all_ones_registers"`
+	Registers         []RegisterSummary `json:"registers,omitempty"`
+}
+
+type RegisterSummary struct {
+	Offset   uint32 `json:"offset"`
+	Original uint32 `json:"original"`
+	RWMask   uint32 `json:"rw_mask"`
+	Kind     string `json:"kind"`
+}
+
+func Build(ctx *donor.DeviceContext) *Profile {
+	profile := &Profile{}
+	if ctx == nil {
+		return profile
+	}
+
+	profile.ClassCode = ctx.Device.ClassCode
+	if strategy := devclass.StrategyForClass(ctx.Device.ClassCode); strategy != nil {
+		profile.DeviceClass = strategy.DeviceClass()
+	}
+
+	bars := append([]pci.BAR(nil), ctx.BARs...)
+	sort.Slice(bars, func(i, j int) bool { return bars[i].Index < bars[j].Index })
+	for _, bar := range bars {
+		profile.BARs = append(profile.BARs, buildBARSummary(ctx, bar))
+	}
+	return profile
+}
+
+func buildBARSummary(ctx *donor.DeviceContext, bar pci.BAR) BARSummary {
+	data := ctx.BARContents[bar.Index]
+	probe := ctx.BARProfiles[bar.Index]
+	summary := BARSummary{
+		Index:         bar.Index,
+		Type:          bar.Type,
+		Size:          bar.Size,
+		CapturedBytes: len(data),
+		Prefetchable:  bar.Prefetchable,
+		Is64Bit:       bar.Is64Bit,
+		Density:       densityFor(data),
+		NonZeroBytes:  countNotEqual(data, 0x00),
+		NonFFBytes:    countNotEqual(data, 0xFF),
+	}
+	summary.EmulationHint = emulationHint(bar, data, probe)
+	summary.Registers = registerSummaries(data, probe)
+	for _, reg := range summary.Registers {
+		addRegisterKind(&summary, reg.Kind)
+	}
+	return summary
+}
+
+func emulationHint(bar pci.BAR, data []byte, probe *donor.BARProfile) string {
+	if bar.Type == pci.BARTypeIO {
+		return HintIOSpaceUnsupported
+	}
+	if probe != nil && len(probe.Probes) > 0 {
+		return HintProbeModel
+	}
+	if len(data) > 0 {
+		return HintSpecModel
+	}
+	return HintShadowOnly
+}
+
+func registerSummaries(data []byte, probe *donor.BARProfile) []RegisterSummary {
+	if probe != nil && len(probe.Probes) > 0 {
+		return summariesFromProbe(probe)
+	}
+	return summariesFromData(data)
+}
+
+func summariesFromProbe(profile *donor.BARProfile) []RegisterSummary {
+	regs := make([]RegisterSummary, 0, len(profile.Probes))
+	for _, probe := range profile.Probes {
+		regs = append(regs, RegisterSummary{
+			Offset:   probe.Offset,
+			Original: probe.Original,
+			RWMask:   probe.RWMask,
+			Kind:     classifyRegister(probe.Original, probe.RWMask, probe.MaybeRW1C),
+		})
+	}
+	sort.Slice(regs, func(i, j int) bool { return regs[i].Offset < regs[j].Offset })
+	return regs
+}
+
+func summariesFromData(data []byte) []RegisterSummary {
+	count := len(data) / 4
+	regs := make([]RegisterSummary, 0, count)
+	for i := 0; i < count; i++ {
+		offset := uint32(i * 4)
+		value := binary.LittleEndian.Uint32(data[i*4 : i*4+4])
+		regs = append(regs, RegisterSummary{
+			Offset:   offset,
+			Original: value,
+			Kind:     classifyRegister(value, 0, false),
+		})
+	}
+	return regs
+}
+
+func classifyRegister(original, rwMask uint32, maybeRW1C bool) string {
+	switch {
+	case maybeRW1C:
+		return RegisterRW1C
+	case original == 0 && rwMask == 0:
+		return RegisterDead
+	case original == 0xFFFFFFFF && rwMask == 0:
+		return RegisterAllOnes
+	case rwMask != 0:
+		return RegisterWritable
+	case rwMask == 0:
+		return RegisterStatic
+	default:
+		return RegisterUnknown
+	}
+}
+
+func addRegisterKind(summary *BARSummary, kind string) {
+	switch kind {
+	case RegisterDead:
+		summary.DeadRegisters++
+	case RegisterStatic:
+		summary.StaticRegisters++
+	case RegisterWritable:
+		summary.WritableRegisters++
+	case RegisterRW1C:
+		summary.RW1CRegisters++
+	case RegisterAllOnes:
+		summary.AllOnesRegisters++
+	}
+}
+
+func densityFor(data []byte) string {
+	if len(data) == 0 {
+		return "empty"
+	}
+	active := 0
+	for _, b := range data {
+		if b != 0 && b != 0xFF {
+			active++
+		}
+	}
+	ratio := float64(active) / float64(len(data))
+	switch {
+	case ratio == 0:
+		return "blank"
+	case ratio < 0.05:
+		return "sparse"
+	case ratio > 0.75:
+		return "dense"
+	default:
+		return "mixed"
+	}
+}
+
+func countNotEqual(data []byte, value byte) int {
+	count := 0
+	for _, b := range data {
+		if b != value {
+			count++
+		}
+	}
+	return count
+}
+
+func (p *Profile) String() string {
+	if p == nil {
+		return "BAR behavior profile: <nil>"
+	}
+	return fmt.Sprintf("BAR behavior profile: class=0x%06X bars=%d", p.ClassCode, len(p.BARs))
+}
diff --git a/internal/firmware/barprofile/profile_test.go b/internal/firmware/barprofile/profile_test.go
new file mode 100644
index 0000000..1574ead
--- /dev/null
+++ b/internal/firmware/barprofile/profile_test.go
@@ -0,0 +1,68 @@
+package barprofile
+
+import (
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestBuildProfile_classifiesBarsAndRegisters(t *testing.T) {
+	ctx := &donor.DeviceContext{
+		Device: pci.PCIDevice{ClassCode: 0x010802},
+		BARs: []pci.BAR{
+			{Index: 0, Size: 16, Type: pci.BARTypeMem64, Is64Bit: true},
+			{Index: 2, Size: 8, Type: pci.BARTypeIO},
+		},
+		BARContents: map[int][]byte{
+			0: {
+				0x00, 0x00, 0x00, 0x00,
+				0x34, 0x12, 0x00, 0x00,
+				0xFF, 0xFF, 0xFF, 0xFF,
+				0x00, 0x00, 0x00, 0x00,
+			},
+			2: {0xAA, 0x00, 0x00, 0x00},
+		},
+		BARProfiles: map[int]*donor.BARProfile{
+			0: {
+				BarIndex: 0,
+				Size:     16,
+				Probes: []donor.BARProbeResult{
+					{Offset: 0x00, Original: 0x00000000, RWMask: 0x00000000},
+					{Offset: 0x04, Original: 0x00001234, RWMask: 0x00000000},
+					{Offset: 0x08, Original: 0xFFFFFFFF, RWMask: 0x00000000},
+					{Offset: 0x0C, Original: 0x00000080, RWMask: 0x00000080, MaybeRW1C: true},
+				},
+			},
+		},
+	}
+
+	profile := Build(ctx)
+
+	if profile.ClassCode != 0x010802 {
+		t.Fatalf("ClassCode = 0x%06X, want 0x010802", profile.ClassCode)
+	}
+	if profile.DeviceClass != "nvme" {
+		t.Fatalf("DeviceClass = %q, want nvme", profile.DeviceClass)
+	}
+	if len(profile.BARs) != 2 {
+		t.Fatalf("BAR count = %d, want 2", len(profile.BARs))
+	}
+	bar0 := profile.BARs[0]
+	if bar0.EmulationHint != HintProbeModel {
+		t.Fatalf("BAR0 hint = %q, want %q", bar0.EmulationHint, HintProbeModel)
+	}
+	if bar0.StaticRegisters != 1 || bar0.RW1CRegisters != 1 ||
+		bar0.AllOnesRegisters != 1 || bar0.DeadRegisters != 1 {
+		t.Fatalf("BAR0 summary mismatch: %+v", bar0)
+	}
+	if len(bar0.Registers) != 4 {
+		t.Fatalf("BAR0 registers = %d, want 4", len(bar0.Registers))
+	}
+	if bar0.Registers[3].Kind != RegisterRW1C {
+		t.Fatalf("BAR0 register 0x0C kind = %q, want %q", bar0.Registers[3].Kind, RegisterRW1C)
+	}
+	if profile.BARs[1].EmulationHint != HintIOSpaceUnsupported {
+		t.Fatalf("BAR2 hint = %q, want %q", profile.BARs[1].EmulationHint, HintIOSpaceUnsupported)
+	}
+}
diff --git a/internal/firmware/output/bar_profile.go b/internal/firmware/output/bar_profile.go
new file mode 100644
index 0000000..65da71e
--- /dev/null
+++ b/internal/firmware/output/bar_profile.go
@@ -0,0 +1,21 @@
+package output
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware/barprofile"
+)
+
+func (ow *OutputWriter) writeBARBehaviorProfile(ctx *donor.DeviceContext) error {
+	profile := barprofile.Build(ctx)
+	data, err := json.MarshalIndent(profile, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal BAR behavior profile: %w", err)
+	}
+	if err := ow.writeFile("bar_behavior_profile.json", string(data)+"\n"); err != nil {
+		return fmt.Errorf("failed to write BAR behavior profile: %w", err)
+	}
+	return nil
+}
diff --git a/internal/firmware/output/writer.go b/internal/firmware/output/writer.go
index 7535854..0ca4131 100644
--- a/internal/firmware/output/writer.go
+++ b/internal/firmware/output/writer.go
@@ -67,6 +67,10 @@ func (ow *OutputWriter) WriteAll(ctx *donor.DeviceContext, b *board.Board) error
 		return err
 	}
 
+	if err := ow.writeBARBehaviorProfile(ctx); err != nil {
+		return err
+	}
+
 	if err := ow.writeTCLScripts(ctx, b); err != nil {
 		return err
 	}
@@ -331,6 +335,7 @@ func ListOutputFiles() []string {
 		"pcileech_cfgspace.coe",
 		"pcileech_cfgspace_writemask.coe",
 		"pcileech_bar_zero4k.coe",
+		"bar_behavior_profile.json",
 		"vivado_generate_project.tcl",
 		"vivado_build.tcl",
 		"src/",
diff --git a/internal/firmware/output/writer_test.go b/internal/firmware/output/writer_test.go
index 2f4600c..d609a44 100644
--- a/internal/firmware/output/writer_test.go
+++ b/internal/firmware/output/writer_test.go
@@ -1,10 +1,15 @@
 package output
 
 import (
+	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware/barprofile"
+	"github.com/sercanarga/pcileechgen/internal/pci"
 )
 
 func TestNewOutputWriter_Defaults(t *testing.T) {
@@ -73,3 +78,36 @@ func TestListOutputFiles(t *testing.T) {
 		}
 	}
 }
+
+func TestWriteBARBehaviorProfile_writesProfileArtifact(t *testing.T) {
+	tmpDir := t.TempDir()
+	ow := NewOutputWriter(tmpDir, "lib/pcileech-fpga", 4, 3600)
+	ctx := &donor.DeviceContext{
+		Device: pci.PCIDevice{ClassCode: 0x020000},
+		BARs: []pci.BAR{
+			{Index: 2, Size: 4, Type: pci.BARTypeMem32},
+		},
+		BARContents: map[int][]byte{
+			2: {0x11, 0x22, 0x33, 0x44},
+		},
+	}
+
+	if err := ow.writeBARBehaviorProfile(ctx); err != nil {
+		t.Fatalf("writeBARBehaviorProfile failed: %v", err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(tmpDir, "bar_behavior_profile.json"))
+	if err != nil {
+		t.Fatalf("ReadFile failed: %v", err)
+	}
+	var profile barprofile.Profile
+	if err := json.Unmarshal(data, &profile); err != nil {
+		t.Fatalf("Unmarshal failed: %v", err)
+	}
+	if profile.ClassCode != 0x020000 {
+		t.Fatalf("ClassCode = 0x%06X, want 0x020000", profile.ClassCode)
+	}
+	if len(profile.BARs) != 1 || profile.BARs[0].Index != 2 {
+		t.Fatalf("unexpected BAR profile: %+v", profile.BARs)
+	}
+}

From 9f04696b9b3871e99d6078076cdb4f348df35d11 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 22:10:01 +0200
Subject: [PATCH 11/31] test(vivado): clean startup failure regression

---
 internal/vivado/vivado_test.go | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/internal/vivado/vivado_test.go b/internal/vivado/vivado_test.go
index e910ddd..e35dbb8 100644
--- a/internal/vivado/vivado_test.go
+++ b/internal/vivado/vivado_test.go
@@ -114,7 +114,6 @@ func TestRunTCL_NonExistent(t *testing.T) {
 }
 
 func TestRunTCL_ReturnsError_whenVivadoStartupFails(t *testing.T) {
-	// Given
 	installDir := t.TempDir()
 	binDir := filepath.Join(installDir, "bin")
 	if err := os.MkdirAll(binDir, 0755); err != nil {
@@ -130,11 +129,8 @@ exit 0
 	}
 
 	v := &Vivado{Path: installDir, Version: filepath.Base(installDir)}
-
-	// When
 	err := v.RunTCL("vivado_generate_project.tcl", t.TempDir(), 5*time.Second)
 
-	// Then
 	if err == nil {
 		t.Fatal("RunTCL should fail when Vivado reports a startup failure")
 	}

From ca481fb682a39b326dda34480dea08aafe51b745 Mon Sep 17 00:00:00 2001
From: NetVar <89574102+VoidChecksum@users.noreply.github.com>
Date: Thu, 25 Jun 2026 23:20:15 +0200
Subject: [PATCH 12/31] fix board source path overrides

---
 internal/board/board.go            | 19 +++++++++++--------
 internal/board/board_embed_test.go | 25 +++++++++++++++++++++++++
 internal/board/board_test.go       |  8 +++++++-
 internal/board/boards.json         |  5 +++--
 4 files changed, 46 insertions(+), 11 deletions(-)

diff --git a/internal/board/board.go b/internal/board/board.go
index dcfd305..509745e 100644
--- a/internal/board/board.go
+++ b/internal/board/board.go
@@ -19,6 +19,7 @@ type Board struct {
 	TopModule    string `json:"top_module"`
 	ProjectDir   string `json:"project_dir"`
 	SubDir       string `json:"sub_dir"`
+	SourceSubDir string `json:"source_sub_dir"`
 	TCLFile      string `json:"tcl_file"`
 	BuildTCL     string `json:"build_tcl"`
 }
@@ -44,20 +45,22 @@ func (b *Board) BRAMSizeOrDefault() int {
 	return DefaultBRAMSize
 }
 
+// SourceBasePath returns the directory that contains source and IP folders.
+func (b *Board) SourceBasePath(libDir string) string {
+	if b.SourceSubDir != "" {
+		return filepath.Join(libDir, b.ProjectDir, b.SourceSubDir)
+	}
+	return b.LibPath(libDir)
+}
+
 // SrcPath returns the path to source files for this board.
 func (b *Board) SrcPath(libDir string) string {
-	if b.SubDir != "" {
-		return filepath.Join(libDir, b.ProjectDir, b.SubDir, "src")
-	}
-	return filepath.Join(libDir, b.ProjectDir, "src")
+	return filepath.Join(b.SourceBasePath(libDir), "src")
 }
 
 // IPPath returns the path to IP cores for this board.
 func (b *Board) IPPath(libDir string) string {
-	if b.SubDir != "" {
-		return filepath.Join(libDir, b.ProjectDir, b.SubDir, "ip")
-	}
-	return filepath.Join(libDir, b.ProjectDir, "ip")
+	return filepath.Join(b.SourceBasePath(libDir), "ip")
 }
 
 // TCLPath returns the full path to the Vivado project generation TCL script.
diff --git a/internal/board/board_embed_test.go b/internal/board/board_embed_test.go
index 60e40a3..8662080 100644
--- a/internal/board/board_embed_test.go
+++ b/internal/board/board_embed_test.go
@@ -119,6 +119,31 @@ func TestBoard_Paths(t *testing.T) {
 	}
 }
 
+func TestBoard_SourceSubDirPaths(t *testing.T) {
+	b := &Board{
+		ProjectDir:   "ZDMA",
+		SourceSubDir: "100T",
+		TCLFile:      "vivado_generate_project_100t.tcl",
+		BuildTCL:     "vivado_build_100t.tcl",
+	}
+
+	if got := b.SourceBasePath("/fpga"); got != "/fpga/ZDMA/100T" {
+		t.Errorf("SourceBasePath = %q", got)
+	}
+	if got := b.SrcPath("/fpga"); got != "/fpga/ZDMA/100T/src" {
+		t.Errorf("SrcPath = %q", got)
+	}
+	if got := b.IPPath("/fpga"); got != "/fpga/ZDMA/100T/ip" {
+		t.Errorf("IPPath = %q", got)
+	}
+	if got := b.TCLPath("/fpga"); got != "/fpga/ZDMA/vivado_generate_project_100t.tcl" {
+		t.Errorf("TCLPath = %q", got)
+	}
+	if got := b.BuildTCLPath("/fpga"); got != "/fpga/ZDMA/vivado_build_100t.tcl" {
+		t.Errorf("BuildTCLPath = %q", got)
+	}
+}
+
 func TestBoard_PathsNoSubDir(t *testing.T) {
 	b := &Board{
 		ProjectDir: "PCIeSquirrel",
diff --git a/internal/board/board_test.go b/internal/board/board_test.go
index fd2a2d3..ac38a53 100644
--- a/internal/board/board_test.go
+++ b/internal/board/board_test.go
@@ -70,11 +70,17 @@ func TestBoardPaths(t *testing.T) {
 		t.Errorf("CaptainDMA_100T TCLPath() = %q", cdma.TCLPath(libDir))
 	}
 
-	// Board with custom BuildTCL (ZDMA)
+	// Board with source tree nested below project TCL scripts (ZDMA)
 	zdma, _ := Find("ZDMA")
 	if zdma.BuildTCLPath(libDir) != libDir+"/ZDMA/vivado_build_100t.tcl" {
 		t.Errorf("ZDMA BuildTCLPath() = %q", zdma.BuildTCLPath(libDir))
 	}
+	if zdma.SrcPath(libDir) != libDir+"/ZDMA/100T/src" {
+		t.Errorf("ZDMA SrcPath() = %q", zdma.SrcPath(libDir))
+	}
+	if zdma.IPPath(libDir) != libDir+"/ZDMA/100T/ip" {
+		t.Errorf("ZDMA IPPath() = %q", zdma.IPPath(libDir))
+	}
 }
 
 func TestBoardString(t *testing.T) {
diff --git a/internal/board/boards.json b/internal/board/boards.json
index 2eabef6..f9e8b11 100644
--- a/internal/board/boards.json
+++ b/internal/board/boards.json
@@ -97,7 +97,8 @@
         "top_module": "pcileech_tbx4_100t_top",
         "project_dir": "ZDMA",
         "tcl_file": "vivado_generate_project_100t.tcl",
-        "build_tcl": "vivado_build_100t.tcl"
+        "build_tcl": "vivado_build_100t.tcl",
+        "source_sub_dir": "100T"
     },
     {
         "name": "GBOX",
@@ -166,4 +167,4 @@
         "project_dir": "sp605_ft601",
         "tcl_file": "vivado_generate_project.tcl"
     }
-]
\ No newline at end of file
+]

From 733deb444f4a8b37ab04a4b8a20df108d3130abb Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 23:33:31 +0200
Subject: [PATCH 13/31] fix(firmware): keep capability writemask writable

---
 internal/firmware/codegen/codegen.go        |  54 +---
 internal/firmware/codegen/codegen_test.go   | 277 --------------------
 internal/firmware/codegen/writemask_test.go | 229 ++++++++++++++++
 3 files changed, 239 insertions(+), 321 deletions(-)
 create mode 100644 internal/firmware/codegen/writemask_test.go

diff --git a/internal/firmware/codegen/codegen.go b/internal/firmware/codegen/codegen.go
index e7dc836..2a5b21e 100644
--- a/internal/firmware/codegen/codegen.go
+++ b/internal/firmware/codegen/codegen.go
@@ -58,10 +58,18 @@ func GenerateConfigSpaceCOE(cs *pci.ConfigSpace) string {
 func GenerateWritemaskCOE(cs *pci.ConfigSpace) string {
 	masks := make([]uint32, shadowCfgSpaceWords)
 
-	if cs != nil {
-		applyCapabilityMasks(masks, cs)
+	// standard config space capabilities (0x40-0xFF): fully writable.
+	// the writemask only controls what goes into shadow BRAM; the Xilinx
+	// IP core processes config writes independently. locking fields here
+	// would create a BRAM/IP-core mismatch (e.g. BRAM shows D0 while IP
+	// core is in D3), confusing the OS and causing completion timeouts.
+	for i := 0x40 / 4; i < 0x100/4; i++ {
+		masks[i] = 0xFFFFFFFF
 	}
 
+	// extended config space (0x100-0xFFF): read-only.
+	// scrubber already neutralized all writable extended cap fields.
+
 	// header type 0 registers (DWORD index = byte offset / 4)
 	masks[0] = 0x00000000 // 0x00: VID:DID (read-only identity)
 	masks[1] = 0xFFFFFFFF // 0x04: Command:Status (OS needs full control)
@@ -103,48 +111,6 @@ func GenerateWritemaskCOE(cs *pci.ConfigSpace) string {
 	)
 }
 
-func applyCapabilityMasks(masks []uint32, cs *pci.ConfigSpace) {
-	for _, cap := range pci.ParseCapabilities(cs) {
-		switch cap.ID {
-		case pci.CapIDPowerManagement:
-			setMaskWord(masks, cap.Offset+4, 0x00000103)
-		case pci.CapIDMSI:
-			setMaskBytes(masks, cap.Offset+2, 14)
-		case pci.CapIDMSIX:
-			setMaskWord(masks, cap.Offset, 0xC0000000)
-		case pci.CapIDPCIExpress:
-			setMaskWord(masks, cap.Offset+8, 0x0000FFFF)
-			setMaskWord(masks, cap.Offset+0x10, 0x0000FFFF)
-			setMaskWord(masks, cap.Offset+0x20, 0x0000FFFF)
-		}
-	}
-}
-
-func setMaskWord(masks []uint32, off int, mask uint32) {
-	if off < 0 || off%4 != 0 {
-		return
-	}
-	idx := off / 4
-	if idx >= 0 && idx < len(masks) {
-		masks[idx] |= mask
-	}
-}
-
-func setMaskBytes(masks []uint32, off int, length int) {
-	if off < 0 || length <= 0 {
-		return
-	}
-	for i := 0; i < length; i++ {
-		byteOff := off + i
-		idx := byteOff / 4
-		if idx < 0 || idx >= len(masks) {
-			continue
-		}
-		shift := uint((byteOff % 4) * 8)
-		masks[idx] |= uint32(0xFF) << shift
-	}
-}
-
 // GenerateBarContentCOE outputs BAR shadow COE from the lowest BAR.
 // Note: actual BAR aperture (Bar0Size) may be variable (>4KB on large boards); this seeds 4KB shadow.
 func GenerateBarContentCOE(barContents map[int][]byte, size int) string {
diff --git a/internal/firmware/codegen/codegen_test.go b/internal/firmware/codegen/codegen_test.go
index 351ec7c..9906a75 100644
--- a/internal/firmware/codegen/codegen_test.go
+++ b/internal/firmware/codegen/codegen_test.go
@@ -27,113 +27,6 @@ func TestGenerateConfigSpaceCOE(t *testing.T) {
 	}
 }
 
-func TestGenerateWritemaskCOE(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x00, 0x8086)
-	cs.WriteU32(0x10, 0xFFFFF000) // BAR0: 4KB 32-bit memory BAR (scrubbed; dynamic size from CappedBAR0Size)
-
-	wm := GenerateWritemaskCOE(cs)
-
-	if !strings.Contains(wm, "memory_initialization_radix=16") {
-		t.Error("writemask COE should contain radix")
-	}
-
-	// parse data lines into DWORD array
-	lines := strings.Split(wm, "\n")
-	dwords := make([]string, 0, len(lines))
-	for _, l := range lines {
-		l = strings.TrimSpace(l)
-		if l == "" || strings.HasPrefix(l, ";") || strings.HasPrefix(l, "memory") {
-			continue
-		}
-		l = strings.TrimSuffix(l, ",")
-		l = strings.TrimSuffix(l, ";")
-		dwords = append(dwords, l)
-	}
-
-	if len(dwords) != 1024 {
-		t.Fatalf("writemask should have 1024 DWORDs, got %d", len(dwords))
-	}
-
-	// DWORD 0 (VID:DID) must be read-only
-	if dwords[0] != "00000000" {
-		t.Errorf("VID:DID mask should be 00000000, got %s", dwords[0])
-	}
-
-	// DWORD 2 (Rev:ClassCode) must be read-only
-	if dwords[2] != "00000000" {
-		t.Errorf("Rev:ClassCode mask should be 00000000, got %s", dwords[2])
-	}
-
-	// DWORD 4 (BAR0) must match scrubbed BAR size mask (0xFFFFF000)
-	if dwords[4] != "fffff000" {
-		t.Errorf("BAR0 mask should be fffff000 (4KB size e.g.), got %s", dwords[4])
-	}
-
-	// DWORD 5 (BAR1) must be 0 (unused after scrubber clamp)
-	if dwords[5] != "00000000" {
-		t.Errorf("BAR1 mask should be 00000000 (unused), got %s", dwords[5])
-	}
-
-	// DWORD 11 (SubsysIDs) must be read-only
-	if dwords[11] != "00000000" {
-		t.Errorf("SubsysIDs mask should be 00000000, got %s", dwords[11])
-	}
-
-	// DWORD 15 (IntLine/IntPin) - only IntLine writable
-	if dwords[15] != "000000ff" {
-		t.Errorf("IntLine/IntPin mask should be 000000ff, got %s", dwords[15])
-	}
-
-	for i := 0x40 / 4; i < 0x100/4; i++ {
-		if dwords[i] != "00000000" {
-			t.Errorf("cap region DWORD[%d] should be 00000000, got %s", i, dwords[i])
-		}
-	}
-
-	// extended config space (0x100+) should be read-only
-	for i := 0x100 / 4; i < len(dwords); i++ {
-		if dwords[i] != "00000000" {
-			t.Errorf("ext cap DWORD[%d] should be 00000000, got %s", i, dwords[i])
-			break
-		}
-	}
-}
-
-func TestGenerateWritemaskCOE_KnownCapabilities(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x06, 0x0010)
-	cs.WriteU8(0x34, 0x40)
-
-	cs.WriteU8(0x40, pci.CapIDPowerManagement)
-	cs.WriteU8(0x41, 0x50)
-	cs.WriteU8(0x50, pci.CapIDMSIX)
-	cs.WriteU8(0x51, 0x60)
-	cs.WriteU8(0x60, pci.CapIDPCIExpress)
-	cs.WriteU8(0x61, 0x00)
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	if dwords[16] != "00000000" {
-		t.Errorf("PM header DWORD should be read-only, got %s", dwords[16])
-	}
-	if dwords[17] != "00000103" {
-		t.Errorf("PMCSR DWORD should be 00000103, got %s", dwords[17])
-	}
-	if dwords[20] != "c0000000" {
-		t.Errorf("MSI-X control DWORD should expose only enable/mask bits, got %s", dwords[20])
-	}
-	if dwords[24] != "00000000" {
-		t.Errorf("PCIe header DWORD should be read-only, got %s", dwords[24])
-	}
-	if dwords[26] != "0000ffff" {
-		t.Errorf("PCIe Device Control/Status DWORD should be writable, got %s", dwords[26])
-	}
-}
-
 func TestGenerateBarContentCOE_Empty(t *testing.T) {
 	coe := GenerateBarContentCOE(nil, 4096)
 	if !strings.Contains(coe, "Zero-filled") {
@@ -212,156 +105,6 @@ func TestGenerateMSIXTableHex_Empty(t *testing.T) {
 	}
 }
 
-// writemask for a donor with BAR0=0 that was scrubbed to 4KB memory BAR (default).
-// this simulates the exact scenario where clampBARsToFPGA creates BAR0 (size from ctx/Capped).
-func TestWritemask_ScrubbedBAR0FromZero(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x00, 0x1102) // Creative Labs
-	cs.WriteU16(0x02, 0x0012)
-	cs.WriteU32(0x10, 0xFFFFF000) // BAR0 = 4KB mem (from scrubber)
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	// BAR0 writemask should allow sizing writes
-	if dwords[4] != "fffff000" {
-		t.Errorf("BAR0 mask = %s, want fffff000 (4KB size mask e.g.)", dwords[4])
-	}
-}
-
-// simulate BAR sizing: host writes 0xFFFFFFFF, reads back, decodes size.
-func TestWritemask_BARSizingSimulation(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU32(0x10, 0xFFFFF000) // 4KB (default) 32-bit memory BAR
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	// writemask must be 0xFFFFF000 for BAR0
-	if dwords[4] != "fffff000" {
-		t.Fatalf("BAR0 mask = %s, want fffff000", dwords[4])
-	}
-
-	// simulate host BAR sizing:
-	// 1. host writes 0xFFFFFFFF to BAR0
-	// 2. BRAM stores: 0xFFFFFFFF & writemask = 0xFFFFF000
-	// 3. host reads back 0xFFFFF000
-	// 4. host decodes: ~(0xFFFFF000 & ~0xF) + 1 = ~0xFFFFF000 + 1 = 0x1000 = 4KB
-	hostWrite := uint32(0xFFFFFFFF)
-	mask := uint32(0xFFFFF000)
-	bramResult := hostWrite & mask
-	if bramResult != 0xFFFFF000 {
-		t.Errorf("BAR sizing result = 0x%08X, want 0xFFFFF000", bramResult)
-	}
-	sizeBits := bramResult & ^uint32(0x0F)
-	barSize := ^sizeBits + 1
-	if barSize != 4096 {
-		t.Errorf("decoded BAR size = %d, want 4096 (for this 4k mask test case)", barSize)
-	}
-}
-
-// writemask with IO BAR donor that was overwritten to memory BAR by scrubber.
-func TestWritemask_IOBAROverwrittenToMemory(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU32(0x10, 0xFFFFF000) // scrubber forced memory BAR
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	// must be memory BAR mask, NOT IO mask, NOT zero
-	if dwords[4] == "00000000" {
-		t.Error("BAR0 mask should not be zero after scrubber creates memory BAR")
-	}
-	if dwords[4] != "fffff000" {
-		t.Errorf("BAR0 mask = %s, want fffff000", dwords[4])
-	}
-}
-
-// identity registers must be read-only in writemask.
-func TestWritemask_IdentityRegistersReadOnly(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU16(0x00, 0x1102)     // VID
-	cs.WriteU16(0x02, 0x0012)     // DID
-	cs.WriteU32(0x08, 0x04030000) // ClassCode + RevID
-	cs.WriteU16(0x2C, 0x1102)     // SubsysVID
-	cs.WriteU16(0x2E, 0x0012)     // SubsysDID
-	cs.WriteU32(0x10, 0xFFFFF000) // BAR0
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	roRegs := map[int]string{
-		0:  "VID:DID",
-		2:  "RevisionID:ClassCode",
-		10: "CardBus CIS",
-		11: "SubsysVID:SubsysDID",
-		12: "Expansion ROM",
-		13: "CapPtr",
-		14: "Reserved",
-	}
-	for dw, name := range roRegs {
-		if dwords[dw] != "00000000" {
-			t.Errorf("%s (DWORD %d) mask = %s, want 00000000 (read-only)", name, dw, dwords[dw])
-		}
-	}
-}
-
-// command/status register must be fully writable.
-func TestWritemask_CommandStatusWritable(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU32(0x10, 0xFFFFF000)
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	if dwords[1] != "ffffffff" {
-		t.Errorf("Command:Status mask = %s, want ffffffff", dwords[1])
-	}
-}
-
-// prefetchable memory BAR: type bits [3:0] must be read-only.
-func TestWritemask_PrefetchableBAR(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU32(0x10, 0xFFFFF008) // 4KB (default) prefetchable 32-bit memory
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	// mask should be 0xFFFFF008 & 0xFFFFFFF0 = 0xFFFFF000
-	// type bits [3:0] read-only, size bits writable
-	if dwords[4] != "fffff000" {
-		t.Errorf("prefetchable BAR mask = %s, want fffff000", dwords[4])
-	}
-}
-
-// multiple BARs: each should get its own mask.
-func TestWritemask_MultipleBARs(t *testing.T) {
-	cs := pci.NewConfigSpace()
-	cs.Size = pci.ConfigSpaceSize
-	cs.WriteU32(0x10, 0xFFFFF000) // BAR0: 4KB memory
-	cs.WriteU32(0x14, 0x00000000) // BAR1: unused
-	cs.WriteU32(0x18, 0xFFFF0000) // BAR2: 64KB memory
-
-	wm := GenerateWritemaskCOE(cs)
-	dwords := parseCOEDwords(t, wm)
-
-	if dwords[4] != "fffff000" {
-		t.Errorf("BAR0 mask = %s, want fffff000", dwords[4])
-	}
-	if dwords[5] != "00000000" {
-		t.Errorf("BAR1 mask = %s, want 00000000 (unused)", dwords[5])
-	}
-	if dwords[6] != "ffff0000" {
-		t.Errorf("BAR2 mask = %s, want ffff0000", dwords[6])
-	}
-}
-
 // config space COE must contain correct DWORDs for a scrubbed config space.
 func TestConfigSpaceCOE_ScrubbedDeviceIdentity(t *testing.T) {
 	cs := pci.NewConfigSpace()
@@ -394,23 +137,3 @@ func TestConfigSpaceHex_DWORDFormat(t *testing.T) {
 		t.Error("HEX should contain BAR0 at offset [010]")
 	}
 }
-
-// parseCOEDwords extracts hex DWORD strings from a COE file.
-func parseCOEDwords(t *testing.T, coe string) []string {
-	t.Helper()
-	lines := strings.Split(coe, "\n")
-	dwords := make([]string, 0, len(lines))
-	for _, l := range lines {
-		l = strings.TrimSpace(l)
-		if l == "" || strings.HasPrefix(l, ";") || strings.HasPrefix(l, "memory") {
-			continue
-		}
-		l = strings.TrimSuffix(l, ",")
-		l = strings.TrimSuffix(l, ";")
-		dwords = append(dwords, l)
-	}
-	if len(dwords) != 1024 {
-		t.Fatalf("expected 1024 DWORDs, got %d", len(dwords))
-	}
-	return dwords
-}
diff --git a/internal/firmware/codegen/writemask_test.go b/internal/firmware/codegen/writemask_test.go
new file mode 100644
index 0000000..38905cc
--- /dev/null
+++ b/internal/firmware/codegen/writemask_test.go
@@ -0,0 +1,229 @@
+package codegen
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestGenerateWritemaskCOE(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU16(0x00, 0x8086)
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	wm := GenerateWritemaskCOE(cs)
+
+	if !strings.Contains(wm, "memory_initialization_radix=16") {
+		t.Error("writemask COE should contain radix")
+	}
+
+	lines := strings.Split(wm, "\n")
+	dwords := make([]string, 0, len(lines))
+	for _, l := range lines {
+		l = strings.TrimSpace(l)
+		if l == "" || strings.HasPrefix(l, ";") || strings.HasPrefix(l, "memory") {
+			continue
+		}
+		l = strings.TrimSuffix(l, ",")
+		l = strings.TrimSuffix(l, ";")
+		dwords = append(dwords, l)
+	}
+
+	if len(dwords) != 1024 {
+		t.Fatalf("writemask should have 1024 DWORDs, got %d", len(dwords))
+	}
+
+	if dwords[0] != "00000000" {
+		t.Errorf("VID:DID mask should be 00000000, got %s", dwords[0])
+	}
+
+	if dwords[2] != "00000000" {
+		t.Errorf("Rev:ClassCode mask should be 00000000, got %s", dwords[2])
+	}
+
+	if dwords[4] != "fffff000" {
+		t.Errorf("BAR0 mask should be fffff000 (4KB size e.g.), got %s", dwords[4])
+	}
+
+	if dwords[5] != "00000000" {
+		t.Errorf("BAR1 mask should be 00000000 (unused), got %s", dwords[5])
+	}
+
+	if dwords[11] != "00000000" {
+		t.Errorf("SubsysIDs mask should be 00000000, got %s", dwords[11])
+	}
+
+	if dwords[15] != "000000ff" {
+		t.Errorf("IntLine/IntPin mask should be 000000ff, got %s", dwords[15])
+	}
+
+	// capability region (0x40-0xFF) must be fully writable.
+	// the writemask only controls shadow BRAM; the Xilinx IP core
+	// processes config writes independently. locking here would create
+	// a dangerous BRAM/IP-core state mismatch.
+	for i := 0x40 / 4; i < 0x100/4; i++ {
+		if dwords[i] != "ffffffff" {
+			t.Errorf("cap region DWORD[%d] should be ffffffff, got %s", i, dwords[i])
+		}
+	}
+
+	for i := 0x100 / 4; i < len(dwords); i++ {
+		if dwords[i] != "00000000" {
+			t.Errorf("ext cap DWORD[%d] should be 00000000, got %s", i, dwords[i])
+			break
+		}
+	}
+}
+
+func TestWritemask_ScrubbedBAR0FromZero(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU16(0x00, 0x1102)
+	cs.WriteU16(0x02, 0x0012)
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[4] != "fffff000" {
+		t.Errorf("BAR0 mask = %s, want fffff000 (4KB size mask e.g.)", dwords[4])
+	}
+}
+
+func TestWritemask_BARSizingSimulation(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[4] != "fffff000" {
+		t.Fatalf("BAR0 mask = %s, want fffff000", dwords[4])
+	}
+
+	hostWrite := uint32(0xFFFFFFFF)
+	mask := uint32(0xFFFFF000)
+	bramResult := hostWrite & mask
+	if bramResult != 0xFFFFF000 {
+		t.Errorf("BAR sizing result = 0x%08X, want 0xFFFFF000", bramResult)
+	}
+	sizeBits := bramResult & ^uint32(0x0F)
+	barSize := ^sizeBits + 1
+	if barSize != 4096 {
+		t.Errorf("decoded BAR size = %d, want 4096 (for this 4k mask test case)", barSize)
+	}
+}
+
+func TestWritemask_IOBAROverwrittenToMemory(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[4] == "00000000" {
+		t.Error("BAR0 mask should not be zero after scrubber creates memory BAR")
+	}
+	if dwords[4] != "fffff000" {
+		t.Errorf("BAR0 mask = %s, want fffff000", dwords[4])
+	}
+}
+
+func TestWritemask_IdentityRegistersReadOnly(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU16(0x00, 0x1102)
+	cs.WriteU16(0x02, 0x0012)
+	cs.WriteU32(0x08, 0x04030000)
+	cs.WriteU16(0x2C, 0x1102)
+	cs.WriteU16(0x2E, 0x0012)
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	roRegs := map[int]string{
+		0:  "VID:DID",
+		2:  "RevisionID:ClassCode",
+		10: "CardBus CIS",
+		11: "SubsysVID:SubsysDID",
+		12: "Expansion ROM",
+		13: "CapPtr",
+		14: "Reserved",
+	}
+	for dw, name := range roRegs {
+		if dwords[dw] != "00000000" {
+			t.Errorf("%s (DWORD %d) mask = %s, want 00000000 (read-only)", name, dw, dwords[dw])
+		}
+	}
+}
+
+func TestWritemask_CommandStatusWritable(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[1] != "ffffffff" {
+		t.Errorf("Command:Status mask = %s, want ffffffff", dwords[1])
+	}
+}
+
+func TestWritemask_PrefetchableBAR(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU32(0x10, 0xFFFFF008)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[4] != "fffff000" {
+		t.Errorf("prefetchable BAR mask = %s, want fffff000", dwords[4])
+	}
+}
+
+func TestWritemask_MultipleBARs(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU32(0x10, 0xFFFFF000)
+	cs.WriteU32(0x14, 0x00000000)
+	cs.WriteU32(0x18, 0xFFFF0000)
+
+	wm := GenerateWritemaskCOE(cs)
+	dwords := parseCOEDwords(t, wm)
+
+	if dwords[4] != "fffff000" {
+		t.Errorf("BAR0 mask = %s, want fffff000", dwords[4])
+	}
+	if dwords[5] != "00000000" {
+		t.Errorf("BAR1 mask = %s, want 00000000 (unused)", dwords[5])
+	}
+	if dwords[6] != "ffff0000" {
+		t.Errorf("BAR2 mask = %s, want ffff0000", dwords[6])
+	}
+}
+
+func parseCOEDwords(t *testing.T, coe string) []string {
+	t.Helper()
+	lines := strings.Split(coe, "\n")
+	dwords := make([]string, 0, len(lines))
+	for _, l := range lines {
+		l = strings.TrimSpace(l)
+		if l == "" || strings.HasPrefix(l, ";") || strings.HasPrefix(l, "memory") {
+			continue
+		}
+		l = strings.TrimSuffix(l, ",")
+		l = strings.TrimSuffix(l, ";")
+		dwords = append(dwords, l)
+	}
+	if len(dwords) != 1024 {
+		t.Fatalf("expected 1024 DWORDs, got %d", len(dwords))
+	}
+	return dwords
+}

From 83ce87efae296ebd3fbe18d8ba7f9e5b9d3a2e82 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Thu, 25 Jun 2026 23:49:57 +0200
Subject: [PATCH 14/31] feat(trace): import offline mmiotrace logs

---
 README                             |   6 +-
 cmd/pcileechgen/mmio_trace.go      |  78 ++++++++++++++++---
 cmd/pcileechgen/mmio_trace_test.go |  42 ++++++++++
 internal/donor/mmio/import.go      | 120 +++++++++++++++++++++++++++++
 internal/donor/mmio/import_test.go |  76 ++++++++++++++++++
 internal/donor/mmio/trace_live.go  |  43 +----------
 6 files changed, 311 insertions(+), 54 deletions(-)
 create mode 100644 cmd/pcileechgen/mmio_trace_test.go
 create mode 100644 internal/donor/mmio/import.go
 create mode 100644 internal/donor/mmio/import_test.go

diff --git a/README b/README
index 83449ca..80dbe50 100644
--- a/README
+++ b/README
@@ -72,7 +72,7 @@ COMMANDS
   build            generate firmware artifacts (+ Vivado)
   validate         verify artifacts match the donor context
   verify-manifest  check SHA256 integrity of build output
-  mmio-trace       capture live BAR MMIO access trace from donor
+  mmio-trace       capture live or import saved BAR MMIO access traces
   boards           list supported FPGA boards
   version          print version
 
@@ -84,6 +84,10 @@ COMMANDS
     --from-json <f>    offline build from saved device_context.json
     --output <dir>     output directory (default: pcileech_datastore)
 
+  Offline MMIO trace import:
+    pcileechgen mmio-trace --trace-file mmiotrace.txt --bar-base 0xf7800000 \
+      --bar-index 2 --bar-size 4096 --class-code 0x010802 --json
+
 
 FEATURES
 --------
diff --git a/cmd/pcileechgen/mmio_trace.go b/cmd/pcileechgen/mmio_trace.go
index 055e117..0fa8767 100644
--- a/cmd/pcileechgen/mmio_trace.go
+++ b/cmd/pcileechgen/mmio_trace.go
@@ -21,9 +21,11 @@ type mmioTraceOptions struct {
 	duration   time.Duration
 	barIndex   int
 	barSize    int
+	barBase    string
 	classCode  string
 	jsonOutput bool
 	outputFile string
+	traceFile  string
 }
 
 var mmioTraceOpts mmioTraceOptions
@@ -35,10 +37,13 @@ var mmioTraceCmd = &cobra.Command{
 
 Example:
   pcileechgen mmio-trace --bdf 0000:03:00.0 --duration 5s
-  pcileechgen mmio-trace --bdf 03:00.0 --bar-size 4096 --class-code 0x010802`,
+  pcileechgen mmio-trace --bdf 03:00.0 --bar-size 4096 --class-code 0x010802
+  pcileechgen mmio-trace --trace-file mmiotrace.txt --bar-base 0xf7800000 --bar-index 2 --json`,
 	RunE: func(cmd *cobra.Command, args []string) error {
-		if _, err := pci.ParseBDF(mmioTraceOpts.bdf); err != nil {
-			return fmt.Errorf("invalid BDF %q: %w", mmioTraceOpts.bdf, err)
+		if mmioTraceOpts.traceFile == "" {
+			if _, err := pci.ParseBDF(mmioTraceOpts.bdf); err != nil {
+				return fmt.Errorf("invalid BDF %q: %w", mmioTraceOpts.bdf, err)
+			}
 		}
 		if mmioTraceOpts.barIndex < 0 || mmioTraceOpts.barIndex > 5 {
 			return fmt.Errorf("--bar-index must be between 0 and 5")
@@ -55,16 +60,15 @@ Example:
 			return err
 		}
 
-		start := time.Now()
-		trace, err := mmio.LiveTrace(mmioTraceOpts.bdf, mmioTraceOpts.duration)
+		barBase, err := parseTraceBARBase(mmioTraceOpts.barBase)
 		if err != nil {
-			return fmt.Errorf("trace capture failed: %w", err)
+			return err
 		}
 
-		trace.BARIndex = mmioTraceOpts.barIndex
-		trace.BARSize = mmioTraceOpts.barSize
-		trace.Duration = mmioTraceOpts.duration
-		trace.StartTime = start
+		trace, err := loadMMIOTrace(mmioTraceOpts, barBase)
+		if err != nil {
+			return err
+		}
 
 		pattern := mmio.Analyze(trace)
 		profile := behavior.FromMMIOTrace(trace, classCode)
@@ -101,6 +105,39 @@ Example:
 	},
 }
 
+func loadMMIOTrace(opts mmioTraceOptions, barBase uint64) (*mmio.TraceResult, error) {
+	if opts.traceFile != "" {
+		f, err := os.Open(opts.traceFile)
+		if err != nil {
+			return nil, fmt.Errorf("open trace file %q: %w", opts.traceFile, err)
+		}
+		defer f.Close()
+
+		trace, err := mmio.ParseTextTrace(f, mmio.TextTraceOptions{
+			BDF:      opts.bdf,
+			BARIndex: opts.barIndex,
+			BARSize:  opts.barSize,
+			BARBase:  barBase,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("parse trace file %q: %w", opts.traceFile, err)
+		}
+		trace.StartTime = time.Now().Add(-trace.Duration)
+		return trace, nil
+	}
+
+	start := time.Now()
+	trace, err := mmio.LiveTrace(opts.bdf, opts.duration)
+	if err != nil {
+		return nil, fmt.Errorf("trace capture failed: %w", err)
+	}
+	trace.BARIndex = opts.barIndex
+	trace.BARSize = opts.barSize
+	trace.Duration = opts.duration
+	trace.StartTime = start
+	return trace, nil
+}
+
 func parseTraceClassCode(raw string) (uint32, error) {
 	if strings.TrimSpace(raw) == "" {
 		return 0, nil
@@ -119,6 +156,24 @@ func parseTraceClassCode(raw string) (uint32, error) {
 	return uint32(v), nil
 }
 
+func parseTraceBARBase(raw string) (uint64, error) {
+	if strings.TrimSpace(raw) == "" {
+		return 0, nil
+	}
+
+	r := strings.TrimSpace(raw)
+	if !strings.HasPrefix(r, "0x") && !strings.HasPrefix(r, "0X") {
+		r = "0x" + r
+	}
+
+	v, err := strconv.ParseUint(r, 0, 64)
+	if err != nil {
+		return 0, fmt.Errorf("invalid --bar-base %q: %w", raw, err)
+	}
+
+	return v, nil
+}
+
 func printMMIOTraceReport(out io.Writer, trace *mmio.TraceResult, pattern *mmio.AccessPattern, profile *behavior.Profile, timing *behavior.TimingHistogram) {
 	if out == nil {
 		return
@@ -151,9 +206,10 @@ func init() {
 	mmioTraceCmd.Flags().DurationVar(&mmioTraceOpts.duration, "duration", 5*time.Second, "trace length (e.g. 5s, 1m)")
 	mmioTraceCmd.Flags().IntVar(&mmioTraceOpts.barIndex, "bar-index", 0, "BAR index that was targeted for this trace")
 	mmioTraceCmd.Flags().IntVar(&mmioTraceOpts.barSize, "bar-size", 4096, "expected BAR size hint in bytes")
+	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.barBase, "bar-base", "", "absolute BAR base for offline trace address normalization")
 	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.classCode, "class-code", "", "PCI class code in hex (e.g. 0x010802)")
 	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.outputFile, "output", "", "save raw trace JSON to file")
+	mmioTraceCmd.Flags().StringVar(&mmioTraceOpts.traceFile, "trace-file", "", "analyze an existing mmiotrace text file instead of capturing live")
 	mmioTraceCmd.Flags().BoolVar(&mmioTraceOpts.jsonOutput, "json", false, "emit machine-readable report")
-	_ = mmioTraceCmd.MarkFlagRequired("bdf")
 	rootCmd.AddCommand(mmioTraceCmd)
 }
diff --git a/cmd/pcileechgen/mmio_trace_test.go b/cmd/pcileechgen/mmio_trace_test.go
new file mode 100644
index 0000000..fefcfbc
--- /dev/null
+++ b/cmd/pcileechgen/mmio_trace_test.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestParseTraceBARBase(t *testing.T) {
+	got, err := parseTraceBARBase("f7800000")
+	if err != nil {
+		t.Fatalf("parseTraceBARBase returned error: %v", err)
+	}
+	if got != 0xf7800000 {
+		t.Fatalf("bar base = 0x%X, want 0xF7800000", got)
+	}
+}
+
+func TestLoadMMIOTrace_FromTraceFile(t *testing.T) {
+	tracePath := filepath.Join(t.TempDir(), "mmiotrace.txt")
+	input := []byte("R 4 2456.105919 2 0xf780010c 0x4c02 0x0 0\n")
+	if err := os.WriteFile(tracePath, input, 0o644); err != nil {
+		t.Fatalf("write trace fixture: %v", err)
+	}
+
+	trace, err := loadMMIOTrace(mmioTraceOptions{
+		bdf:       "0000:03:00.0",
+		barIndex:  2,
+		barSize:   4096,
+		traceFile: tracePath,
+	}, 0xf7800000)
+
+	if err != nil {
+		t.Fatalf("loadMMIOTrace returned error: %v", err)
+	}
+	if trace.BDF != "0000:03:00.0" || trace.BARIndex != 2 || trace.BARSize != 4096 {
+		t.Fatalf("trace metadata = %+v", trace)
+	}
+	if len(trace.Records) != 1 || trace.Records[0].Offset != 0x10c || trace.Records[0].Value != 0x4c02 {
+		t.Fatalf("records = %+v", trace.Records)
+	}
+}
diff --git a/internal/donor/mmio/import.go b/internal/donor/mmio/import.go
new file mode 100644
index 0000000..5f6f004
--- /dev/null
+++ b/internal/donor/mmio/import.go
@@ -0,0 +1,120 @@
+package mmio
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type TextTraceOptions struct {
+	BDF      string
+	BARIndex int
+	BARSize  int
+	BARBase  uint64
+}
+
+func ParseTextTrace(r io.Reader, opts TextTraceOptions) (*TraceResult, error) {
+	if r == nil {
+		return nil, fmt.Errorf("trace reader is nil")
+	}
+
+	trace := &TraceResult{
+		BDF:      opts.BDF,
+		BARIndex: opts.BARIndex,
+		BARSize:  opts.BARSize,
+	}
+
+	var first time.Duration
+	var last time.Duration
+	scanner := bufio.NewScanner(r)
+	for scanner.Scan() {
+		rec, ok := parseTextTraceLine(scanner.Text(), opts.BARBase)
+		if !ok {
+			continue
+		}
+		if len(trace.Records) == 0 {
+			first = rec.Timestamp
+		}
+		last = rec.Timestamp
+		trace.Records = append(trace.Records, rec)
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("read trace: %w", err)
+	}
+	if len(trace.Records) == 0 {
+		return nil, fmt.Errorf("trace did not contain parseable MMIO records")
+	}
+	if last >= first {
+		trace.Duration = last - first
+	}
+
+	return trace, nil
+}
+
+func parseTextTraceLine(line string, barBase uint64) (AccessRecord, bool) {
+	fields := strings.Fields(strings.TrimSpace(line))
+	if len(fields) < 5 {
+		return AccessRecord{}, false
+	}
+
+	var rec AccessRecord
+	switch fields[0] {
+	case "R":
+		rec.Type = AccessRead
+	case "W":
+		rec.Type = AccessWrite
+	default:
+		return AccessRecord{}, false
+	}
+
+	addrField, valueField, ok := traceAddressValueFields(fields)
+	if !ok {
+		return AccessRecord{}, false
+	}
+
+	addr, err := parseHexUint64(addrField)
+	if err != nil {
+		return AccessRecord{}, false
+	}
+	value, err := parseHexUint32(valueField)
+	if err != nil {
+		return AccessRecord{}, false
+	}
+
+	rec.Offset = traceOffset(addr, barBase)
+	rec.Value = value
+	if ts, err := strconv.ParseFloat(fields[2], 64); err == nil {
+		rec.Timestamp = time.Duration(ts * float64(time.Second))
+	}
+
+	return rec, true
+}
+
+func traceAddressValueFields(fields []string) (string, string, bool) {
+	if strings.HasPrefix(fields[3], "0x") {
+		return fields[3], fields[4], true
+	}
+	if len(fields) >= 6 && strings.HasPrefix(fields[4], "0x") {
+		return fields[4], fields[5], true
+	}
+	return "", "", false
+}
+
+func parseHexUint64(raw string) (uint64, error) {
+	return strconv.ParseUint(strings.TrimPrefix(strings.TrimPrefix(raw, "0x"), "0X"), 16, 64)
+}
+
+func parseHexUint32(raw string) (uint32, error) {
+	value, err := strconv.ParseUint(strings.TrimPrefix(strings.TrimPrefix(raw, "0x"), "0X"), 16, 32)
+	return uint32(value), err
+}
+
+func traceOffset(addr uint64, barBase uint64) uint32 {
+	if barBase != 0 && addr >= barBase {
+		return uint32(addr - barBase)
+	}
+	return uint32(addr & 0xFFF)
+}
diff --git a/internal/donor/mmio/import_test.go b/internal/donor/mmio/import_test.go
new file mode 100644
index 0000000..15cc08d
--- /dev/null
+++ b/internal/donor/mmio/import_test.go
@@ -0,0 +1,76 @@
+package mmio
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestParseTextTrace_Ret2cShapeWithBARBase(t *testing.T) {
+	input := strings.NewReader(strings.Join([]string{
+		"R 4 2456.105919 2 0xf780010c 0x4c02 0x0 0",
+		"W 4 2456.130642 2 0xf7800114 0x1 0x0 0",
+	}, "\n"))
+
+	trace, err := ParseTextTrace(input, TextTraceOptions{
+		BDF:      "0000:03:00.0",
+		BARIndex: 2,
+		BARSize:  4096,
+		BARBase:  0xf7800000,
+	})
+
+	if err != nil {
+		t.Fatalf("ParseTextTrace returned error: %v", err)
+	}
+	if len(trace.Records) != 2 {
+		t.Fatalf("records = %d, want 2", len(trace.Records))
+	}
+	if trace.Records[0].Type != AccessRead || trace.Records[0].Offset != 0x10c || trace.Records[0].Value != 0x4c02 {
+		t.Fatalf("first record = %+v", trace.Records[0])
+	}
+	if trace.Records[1].Type != AccessWrite || trace.Records[1].Offset != 0x114 || trace.Records[1].Value != 0x1 {
+		t.Fatalf("second record = %+v", trace.Records[1])
+	}
+	if trace.Duration <= 0 {
+		t.Fatal("duration should be derived from timestamps")
+	}
+}
+
+func TestParseTextTrace_LiveTracePipeShape(t *testing.T) {
+	input := strings.NewReader("R 4 1234567.890 0xfee00100 0x00000001 extra\n")
+
+	trace, err := ParseTextTrace(input, TextTraceOptions{BARSize: 4096})
+
+	if err != nil {
+		t.Fatalf("ParseTextTrace returned error: %v", err)
+	}
+	if len(trace.Records) != 1 {
+		t.Fatalf("records = %d, want 1", len(trace.Records))
+	}
+	if trace.Records[0].Offset != 0x100 || trace.Records[0].Value != 1 {
+		t.Fatalf("record = %+v", trace.Records[0])
+	}
+}
+
+func TestParseTextTrace_RejectsEmptyTrace(t *testing.T) {
+	_, err := ParseTextTrace(strings.NewReader("not a trace line\n"), TextTraceOptions{})
+	if err == nil {
+		t.Fatal("expected error for empty trace")
+	}
+}
+
+func TestParseTextTrace_DurationUsesLastTimestamp(t *testing.T) {
+	input := strings.NewReader(strings.Join([]string{
+		"R 4 1.000 0x1000 0x1",
+		"R 4 1.250 0x1004 0x2",
+	}, "\n"))
+
+	trace, err := ParseTextTrace(input, TextTraceOptions{})
+
+	if err != nil {
+		t.Fatalf("ParseTextTrace returned error: %v", err)
+	}
+	if trace.Duration != 250*time.Millisecond {
+		t.Fatalf("duration = %s, want 250ms", trace.Duration)
+	}
+}
diff --git a/internal/donor/mmio/trace_live.go b/internal/donor/mmio/trace_live.go
index 6b9d719..4db6669 100644
--- a/internal/donor/mmio/trace_live.go
+++ b/internal/donor/mmio/trace_live.go
@@ -8,8 +8,6 @@ import (
 	"fmt"
 	"log/slog"
 	"os"
-	"strconv"
-	"strings"
 	"time"
 )
 
@@ -98,44 +96,5 @@ func LiveTrace(bdf string, duration time.Duration) (*TraceResult, error) {
 
 // parseMMIOTraceLine parses one mmiotrace line (R/W <width> <ts> <addr> <val>).
 func parseMMIOTraceLine(line string) (AccessRecord, bool) {
-	line = strings.TrimSpace(line)
-	// mmiotrace lines typically look like:
-	// R 4 1234567.890 0xfee00000 0x00000001 ...
-	// W 4 1234567.890 0xfee00000 0x00000001 ...
-	fields := strings.Fields(line)
-	if len(fields) < 5 {
-		return AccessRecord{}, false
-	}
-
-	var rec AccessRecord
-
-	switch fields[0] {
-	case "R":
-		rec.Type = AccessRead
-	case "W":
-		rec.Type = AccessWrite
-	default:
-		return AccessRecord{}, false
-	}
-
-	// lower 12 bits = offset within 4K BAR page
-	addr, err := strconv.ParseUint(strings.TrimPrefix(fields[3], "0x"), 16, 64)
-	if err != nil {
-		return AccessRecord{}, false
-	}
-	rec.Offset = uint32(addr & 0xFFF) // BAR offset within 4K page
-
-	// Parse value
-	val, err := strconv.ParseUint(strings.TrimPrefix(fields[4], "0x"), 16, 32)
-	if err != nil {
-		return AccessRecord{}, false
-	}
-	rec.Value = uint32(val)
-
-	// Parse timestamp if available
-	if ts, err := strconv.ParseFloat(fields[2], 64); err == nil {
-		rec.Timestamp = time.Duration(ts * float64(time.Second))
-	}
-
-	return rec, true
+	return parseTextTraceLine(line, 0)
 }

From 263b0321c05f14f33a2fcdca785393e502b2b39f Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Fri, 26 Jun 2026 00:19:43 +0200
Subject: [PATCH 15/31] fix(validate): fail cfgspace coe mismatch

---
 cmd/pcileechgen/validate.go      |  2 +-
 cmd/pcileechgen/validate_test.go | 41 ++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 cmd/pcileechgen/validate_test.go

diff --git a/cmd/pcileechgen/validate.go b/cmd/pcileechgen/validate.go
index 05012ed..eb7a812 100644
--- a/cmd/pcileechgen/validate.go
+++ b/cmd/pcileechgen/validate.go
@@ -124,7 +124,7 @@ func (v *validator) validateCOEFiles() {
 		if string(coeData) == expectedCOE {
 			v.result.Passed = append(v.result.Passed, "pcileech_cfgspace.coe matches donor config space (scrubbed)")
 		} else {
-			v.result.Warnings = append(v.result.Warnings, "pcileech_cfgspace.coe differs from deterministic scrubbed baseline (per-build variance may be applied)")
+			v.result.Failed = append(v.result.Failed, "pcileech_cfgspace.coe MISMATCH")
 		}
 	} else {
 		v.result.Failed = append(v.result.Failed, "pcileech_cfgspace.coe not found")
diff --git a/cmd/pcileechgen/validate_test.go b/cmd/pcileechgen/validate_test.go
new file mode 100644
index 0000000..47e0696
--- /dev/null
+++ b/cmd/pcileechgen/validate_test.go
@@ -0,0 +1,41 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/firmware/codegen"
+	"github.com/sercanarga/pcileechgen/internal/firmware/output"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestValidateCOEFiles_ConfigSpaceMismatchFails(t *testing.T) {
+	dir := t.TempDir()
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU32(0x10, 0xFFFFF000)
+
+	if err := os.WriteFile(filepath.Join(dir, "pcileech_cfgspace.coe"), []byte("bad cfgspace\n"), 0o644); err != nil {
+		t.Fatalf("write cfgspace fixture: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "pcileech_cfgspace_writemask.coe"), []byte(codegen.GenerateWritemaskCOE(cs)), 0o644); err != nil {
+		t.Fatalf("write writemask fixture: %v", err)
+	}
+
+	v := &validator{
+		outputDir: dir,
+		scrubbed:  cs,
+		result:    &output.ValidationResult{},
+	}
+
+	v.validateCOEFiles()
+
+	if !slices.Contains(v.result.Failed, "pcileech_cfgspace.coe MISMATCH") {
+		t.Fatalf("failed validations = %v, want cfgspace mismatch failure", v.result.Failed)
+	}
+	if len(v.result.Warnings) != 0 {
+		t.Fatalf("warnings = %v, want none", v.result.Warnings)
+	}
+}

From 05677a48a49105abe4a6fc78fe584777ac5d8ac5 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Fri, 26 Jun 2026 00:29:44 +0200
Subject: [PATCH 16/31] fix(firmware): handle nvme admin prp2 crossings

---
 .../firmware/svgen/nvme_responder_test.go     | 25 +++++++++++++++++++
 .../templates/nvme_admin_responder.sv.tmpl    | 18 ++++++++++---
 2 files changed, 40 insertions(+), 3 deletions(-)
 create mode 100644 internal/firmware/svgen/nvme_responder_test.go

diff --git a/internal/firmware/svgen/nvme_responder_test.go b/internal/firmware/svgen/nvme_responder_test.go
new file mode 100644
index 0000000..bc48888
--- /dev/null
+++ b/internal/firmware/svgen/nvme_responder_test.go
@@ -0,0 +1,25 @@
+package svgen
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestGenerateNVMeResponderSV_UsesPRP2ForPageCrossingAdminData(t *testing.T) {
+	cfg := testConfig()
+
+	result, err := GenerateNVMeResponderSV(cfg)
+	if err != nil {
+		t.Fatalf("GenerateNVMeResponderSV failed: %v", err)
+	}
+
+	if !strings.Contains(result, "function [63:0] cmd_prp_addr") {
+		t.Fatal("NVMe responder should compute admin data addresses through a PRP helper")
+	}
+	if !strings.Contains(result, "{cmd_prp2[63:12], 12'h000}") {
+		t.Fatal("NVMe responder should use PRP2 for admin data crossing the first PRP page")
+	}
+	if strings.Contains(result, "dma_wr_addr  <= cmd_prp1 +") {
+		t.Fatal("NVMe responder should not write all admin data relative to PRP1 only")
+	}
+}
diff --git a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
index 7667559..336e713 100644
--- a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
+++ b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
@@ -111,6 +111,18 @@ module pcileech_nvme_admin_responder(
     wire [31:0] cmd_cdw11    = sqe[11];
     wire [7:0]  identify_cns = cmd_cdw10[7:0];
 
+    function [63:0] cmd_prp_addr;
+        input [12:0] data_byte_offset;
+        reg [12:0] prp_byte_offset;
+        begin
+            prp_byte_offset = {1'b0, cmd_prp1[11:0]} + data_byte_offset;
+            if (prp_byte_offset[12])
+                cmd_prp_addr = {cmd_prp2[63:12], 12'h000} + {52'h0, prp_byte_offset[11:0]};
+            else
+                cmd_prp_addr = cmd_prp1 + {51'h0, data_byte_offset};
+        end
+    endfunction
+
     // CQE we're building – 4 DWORDs, written to host one at a time
     reg [31:0]  cqe [0:3];
     reg [1:0]   cqe_dw_idx;
@@ -327,7 +339,7 @@ module pcileech_nvme_admin_responder(
                         end else begin
                             dma_wr_req   <= 1'b1;
                             dma_wr_valid <= 1'b1;
-                            dma_wr_addr  <= cmd_prp1 + {53'h0, data_dw_cnt - 11'h1, 2'b00};
+                            dma_wr_addr  <= cmd_prp_addr({data_dw_cnt - 11'h1, 2'b00});
                             dma_wr_data  <= id_rom_data;
                             dma_wr_be    <= 4'hF;
 
@@ -346,7 +358,7 @@ module pcileech_nvme_admin_responder(
                     S_EXEC_NSLIST: begin
                         dma_wr_req   <= 1'b1;
                         dma_wr_valid <= 1'b1;
-                        dma_wr_addr  <= cmd_prp1 + {53'h0, data_dw_cnt, 2'b00};
+                        dma_wr_addr  <= cmd_prp_addr({data_dw_cnt, 2'b00});
                         dma_wr_data  <= (data_dw_cnt == 11'h0) ? 32'h00000001 : 32'h0;
                         dma_wr_be    <= 4'hF;
 
@@ -364,7 +376,7 @@ module pcileech_nvme_admin_responder(
                     S_EXEC_LOGPAGE: begin
                         dma_wr_req   <= 1'b1;
                         dma_wr_valid <= 1'b1;
-                        dma_wr_addr  <= cmd_prp1 + {53'h0, data_dw_cnt, 2'b00};
+                        dma_wr_addr  <= cmd_prp_addr({data_dw_cnt, 2'b00});
                         dma_wr_be    <= 4'hF;
 
                         case (data_dw_cnt)

From 977fe95f0703e77100842600be0e18a71e253983 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Fri, 26 Jun 2026 00:33:46 +0200
Subject: [PATCH 17/31] docs(board): note source path override exclusivity

---
 internal/board/board.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/internal/board/board.go b/internal/board/board.go
index 509745e..79b470e 100644
--- a/internal/board/board.go
+++ b/internal/board/board.go
@@ -19,6 +19,7 @@ type Board struct {
 	TopModule    string `json:"top_module"`
 	ProjectDir   string `json:"project_dir"`
 	SubDir       string `json:"sub_dir"`
+	// SourceSubDir is mutually exclusive with SubDir; it only overrides source/IP paths.
 	SourceSubDir string `json:"source_sub_dir"`
 	TCLFile      string `json:"tcl_file"`
 	BuildTCL     string `json:"build_tcl"`

From 6b443c44704e2edfa171c0814e2080f7e7f0146d Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Fri, 26 Jun 2026 00:40:42 +0200
Subject: [PATCH 18/31] fix(firmware): restore nvme admin prp2 handling

---
 .../templates/nvme_admin_responder.sv.tmpl    | 22 +++++++++----------
 .../svgen/templates/nvme_dma_bridge.sv.tmpl   | 12 +++++-----
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
index 336e713..8ee14d3 100644
--- a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
+++ b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
@@ -247,7 +247,7 @@ module pcileech_nvme_admin_responder(
                                         cqe[0] <= 32'h0;
                                         cqe[1] <= 32'h0;
                                         cqe[2] <= {cmd_cid, sq_head};
-                                        cqe[3] <= {15'h0, cq_phase};
+                                        cqe[3] <= {31'h0, cq_phase};
                                         cqe_dw_idx <= 2'h0;
                                         state  <= S_POST_CQE;
                                     end
@@ -259,7 +259,7 @@ module pcileech_nvme_admin_responder(
                                 cqe[0] <= 32'h0;
                                 cqe[1] <= 32'h0;
                                 cqe[2] <= {cmd_cid, sq_head};
-                                cqe[3] <= {15'h0, cq_phase};
+                                cqe[3] <= {31'h0, cq_phase};
                                 cqe_dw_idx <= 2'h0;
                                 state  <= S_POST_CQE;
                             end
@@ -283,7 +283,7 @@ module pcileech_nvme_admin_responder(
                                 endcase
                                 cqe[1] <= 32'h0;
                                 cqe[2] <= {cmd_cid, sq_head};
-                                cqe[3] <= {15'h0, cq_phase};
+                                cqe[3] <= {31'h0, cq_phase};
                                 cqe_dw_idx <= 2'h0;
                                 state  <= S_POST_CQE;
                             end
@@ -297,7 +297,7 @@ module pcileech_nvme_admin_responder(
                                 endcase
                                 cqe[1] <= 32'h0;
                                 cqe[2] <= {cmd_cid, sq_head};
-                                cqe[3] <= {15'h0, cq_phase};
+                                cqe[3] <= {31'h0, cq_phase};
                                 cqe_dw_idx <= 2'h0;
                                 state  <= S_POST_CQE;
                             end
@@ -308,7 +308,7 @@ module pcileech_nvme_admin_responder(
                                 if (aer_pending < 4'hF)
                                     aer_pending <= aer_pending + 1'b1;
                                 // move the SQ head along but don't post any CQE
-                                if (sq_head >= asqs)
+                                if (sq_head >= {4'h0, asqs})
                                     sq_head <= 16'h0;
                                 else
                                     sq_head <= sq_head + 1'b1;
@@ -320,7 +320,7 @@ module pcileech_nvme_admin_responder(
                                 cqe[0] <= 32'h0;
                                 cqe[1] <= 32'h0;
                                 cqe[2] <= {cmd_cid, sq_head};
-                                cqe[3] <= {15'h0, cq_phase};
+                                cqe[3] <= {31'h0, cq_phase};
                                 cqe_dw_idx <= 2'h0;
                                 state  <= S_POST_CQE;
                             end
@@ -400,7 +400,7 @@ module pcileech_nvme_admin_responder(
                         cqe[0] <= 32'h0;
                         cqe[1] <= 32'h0;
                         cqe[2] <= {cmd_cid, sq_head};
-                        cqe[3] <= {15'h0, cq_phase};
+                        cqe[3] <= {31'h0, cq_phase};
                         cqe_dw_idx <= 2'h0;
                         state  <= S_POST_CQE;
                     end
@@ -409,8 +409,8 @@ module pcileech_nvme_admin_responder(
                     S_POST_CQE: begin
                         dma_wr_req   <= 1'b1;
                         dma_wr_valid <= 1'b1;
-                        dma_wr_addr  <= acq_base + {48'h0, cq_head} * 16
-                                        + {62'h0, cqe_dw_idx, 2'b00};
+                        dma_wr_addr  <= acq_base + {44'h0, cq_head, 4'h0}
+                                        + {60'h0, cqe_dw_idx, 2'b00};
                         dma_wr_data  <= cqe[cqe_dw_idx];
                         dma_wr_be    <= 4'hF;
 
@@ -435,13 +435,13 @@ module pcileech_nvme_admin_responder(
                         msix_trigger <= 1'b1;
 
                         // wrap SQ head
-                        if (sq_head >= asqs)
+                        if (sq_head >= {4'h0, asqs})
                             sq_head <= 16'h0;
                         else
                             sq_head <= sq_head + 1'b1;
 
                         // wrap CQ head and flip the phase bit
-                        if (cq_head >= acqs) begin
+                        if (cq_head >= {4'h0, acqs}) begin
                             cq_head  <= 16'h0;
                             cq_phase <= ~cq_phase;
                         end else begin
diff --git a/internal/firmware/svgen/templates/nvme_dma_bridge.sv.tmpl b/internal/firmware/svgen/templates/nvme_dma_bridge.sv.tmpl
index 3b2115d..c6264e4 100644
--- a/internal/firmware/svgen/templates/nvme_dma_bridge.sv.tmpl
+++ b/internal/firmware/svgen/templates/nvme_dma_bridge.sv.tmpl
@@ -73,7 +73,7 @@ module pcileech_nvme_dma_bridge(
     // CplD receive buffer: hold up to 4 DWORDs from one 128-bit beat
     reg [31:0] rx_buf [0:3];
     reg [2:0]  rx_buf_cnt;          // how many DWORDs in buffer (0-4)
-    reg [2:0]  rx_buf_idx;          // current emit index
+    reg [1:0]  rx_buf_idx;          // current emit index
 
     always @(posedge clk) begin
         if (rst) begin
@@ -87,7 +87,7 @@ module pcileech_nvme_dma_bridge(
             rd_remaining    <= 10'h0;
             rd_tag          <= 8'h80;
             rx_buf_cnt      <= 3'h0;
-            rx_buf_idx      <= 3'h0;
+            rx_buf_idx      <= 2'h0;
         end else begin
             dma_wr_done   <= 1'b0;
             dma_rd_valid  <= 1'b0;
@@ -216,7 +216,7 @@ module pcileech_nvme_dma_bridge(
                                 // payload starts at [127:96] = 1 DWORD
                                 rx_buf[0]  <= tlp_rx_tdata[127:96];
                                 rx_buf_cnt <= 3'd1;
-                                rx_buf_idx <= 3'd0;
+                                rx_buf_idx <= 2'd0;
                                 bstate     <= B_RD_EMIT;
                             end
                         end
@@ -232,11 +232,11 @@ module pcileech_nvme_dma_bridge(
                     if (rd_remaining <= 10'd1) begin
                         dma_rd_done <= 1'b1;
                         bstate      <= B_IDLE;
-                    end else if (rx_buf_cnt == 3'd0 || rx_buf_idx >= (rx_buf_cnt - 3'd1)) begin
+                    end else if (rx_buf_cnt == 3'd0 || {1'b0, rx_buf_idx} >= (rx_buf_cnt - 3'd1)) begin
                         // buffer emptied (or was never filled), need more data from bus
                         bstate <= B_RD_DRAIN;
                     end else begin
-                        rx_buf_idx <= rx_buf_idx + 3'd1;
+                        rx_buf_idx <= rx_buf_idx + 2'd1;
                     end
                 end
 
@@ -254,7 +254,7 @@ module pcileech_nvme_dma_bridge(
                         else
                             rx_buf_cnt <= rd_remaining[2:0];
 
-                        rx_buf_idx <= 3'd0;
+                        rx_buf_idx <= 2'd0;
                         bstate     <= B_RD_EMIT;
                     end
                 end

From 39489dd09c8eb8443f384b6d097bc61ad4e4b115 Mon Sep 17 00:00:00 2001
From: VoidChecksum <markuskvam28b@gmail.com>
Date: Fri, 26 Jun 2026 00:57:32 +0200
Subject: [PATCH 19/31] feat(firmware): handle nvme format io queues

---
 internal/firmware/svgen/generator.go          |  12 +
 .../firmware/svgen/nvme_controller_test.go    |  30 +++
 internal/firmware/svgen/nvme_doorbell_test.go |  22 ++
 .../firmware/svgen/nvme_responder_test.go     |  22 ++
 .../svgen/templates/bar_controller.sv.tmpl    |   6 +
 .../templates/nvme_admin_responder.sv.tmpl    | 206 ++++++++++++++++--
 6 files changed, 284 insertions(+), 14 deletions(-)
 create mode 100644 internal/firmware/svgen/nvme_controller_test.go
 create mode 100644 internal/firmware/svgen/nvme_doorbell_test.go

diff --git a/internal/firmware/svgen/generator.go b/internal/firmware/svgen/generator.go
index 16d4b51..07699ac 100644
--- a/internal/firmware/svgen/generator.go
+++ b/internal/firmware/svgen/generator.go
@@ -84,6 +84,18 @@ func (c *SVGeneratorConfig) NVMeCQ0DoorbellOffset() uint32 {
 	return dbBase + 1*stride
 }
 
+func (c *SVGeneratorConfig) NVMeSQ1DoorbellOffset() uint32 {
+	stride := uint32(4) << c.NVMeDoorbellStride
+	dbBase := uint32(board.DefaultBRAMSize)
+	return dbBase + 2*stride
+}
+
+func (c *SVGeneratorConfig) NVMeCQ1DoorbellOffset() uint32 {
+	stride := uint32(4) << c.NVMeDoorbellStride
+	dbBase := uint32(board.DefaultBRAMSize)
+	return dbBase + 3*stride
+}
+
 func renderTemplate(name string, data any) (string, error) {
 	tmplStr := mustReadTemplate(name + ".sv.tmpl")
 	tmpl, err := template.New(name).Funcs(svFuncMap()).Parse(tmplStr)
diff --git a/internal/firmware/svgen/nvme_controller_test.go b/internal/firmware/svgen/nvme_controller_test.go
new file mode 100644
index 0000000..4836ce0
--- /dev/null
+++ b/internal/firmware/svgen/nvme_controller_test.go
@@ -0,0 +1,30 @@
+package svgen
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/firmware/nvme"
+)
+
+func TestGenerateBarControllerSV_WiresNVMeQID1Doorbells(t *testing.T) {
+	cfg := testConfig()
+	cfg.NVMeIdentify = &nvme.IdentifyData{}
+	cfg.NVMeDoorbellStride = 0
+
+	result, err := GenerateBarControllerSV(cfg)
+	if err != nil {
+		t.Fatalf("GenerateBarControllerSV failed: %v", err)
+	}
+
+	for _, want := range []string{
+		"wire nvme_sq1_db_wr",
+		"wire nvme_cq1_db_wr",
+		".sq1_doorbell_wr",
+		".cq1_doorbell_wr",
+	} {
+		if !strings.Contains(result, want) {
+			t.Fatalf("NVMe bar controller should contain %q", want)
+		}
+	}
+}
diff --git a/internal/firmware/svgen/nvme_doorbell_test.go b/internal/firmware/svgen/nvme_doorbell_test.go
new file mode 100644
index 0000000..190e030
--- /dev/null
+++ b/internal/firmware/svgen/nvme_doorbell_test.go
@@ -0,0 +1,22 @@
+package svgen
+
+import "testing"
+
+func TestNVMeDoorbellOffsets_QID1(t *testing.T) {
+	cfg := &SVGeneratorConfig{NVMeDoorbellStride: 0}
+
+	if got := cfg.NVMeSQ1DoorbellOffset(); got != 0x1008 {
+		t.Errorf("SQ1 doorbell = 0x%X, want 0x1008", got)
+	}
+	if got := cfg.NVMeCQ1DoorbellOffset(); got != 0x100C {
+		t.Errorf("CQ1 doorbell = 0x%X, want 0x100C", got)
+	}
+
+	cfg.NVMeDoorbellStride = 1
+	if got := cfg.NVMeSQ1DoorbellOffset(); got != 0x1010 {
+		t.Errorf("SQ1 doorbell (stride=1) = 0x%X, want 0x1010", got)
+	}
+	if got := cfg.NVMeCQ1DoorbellOffset(); got != 0x1018 {
+		t.Errorf("CQ1 doorbell (stride=1) = 0x%X, want 0x1018", got)
+	}
+}
diff --git a/internal/firmware/svgen/nvme_responder_test.go b/internal/firmware/svgen/nvme_responder_test.go
index bc48888..33e46f7 100644
--- a/internal/firmware/svgen/nvme_responder_test.go
+++ b/internal/firmware/svgen/nvme_responder_test.go
@@ -23,3 +23,25 @@ func TestGenerateNVMeResponderSV_UsesPRP2ForPageCrossingAdminData(t *testing.T)
 		t.Fatal("NVMe responder should not write all admin data relative to PRP1 only")
 	}
 }
+
+func TestGenerateNVMeResponderSV_HandlesFormattingIOQueuePath(t *testing.T) {
+	cfg := testConfig()
+
+	result, err := GenerateNVMeResponderSV(cfg)
+	if err != nil {
+		t.Fatalf("GenerateNVMeResponderSV failed: %v", err)
+	}
+
+	for _, want := range []string{
+		"input               sq1_doorbell_wr",
+		"iosq_base",
+		"iocq_base",
+		"8'h80: begin",
+		"8'h00, 8'h01, 8'h08, 8'h09: begin",
+		"S_EXEC_READ_ZERO",
+	} {
+		if !strings.Contains(result, want) {
+			t.Fatalf("NVMe responder should contain %q", want)
+		}
+	}
+}
diff --git a/internal/firmware/svgen/templates/bar_controller.sv.tmpl b/internal/firmware/svgen/templates/bar_controller.sv.tmpl
index 0d23186..e914b6c 100644
--- a/internal/firmware/svgen/templates/bar_controller.sv.tmpl
+++ b/internal/firmware/svgen/templates/bar_controller.sv.tmpl
@@ -567,6 +567,8 @@ module pcileech_tlps128_bar_controller(
     // catch doorbell writes -- offset derived from CAP.DSTRD + computed from (variable) Bar0Size
     wire nvme_sq0_db_wr = wr_valid && wr_bar[0] && (wr_addr_bar0 == 32'h{{ printf "%08X" .NVMeSQ0DoorbellOffset }});
     wire nvme_cq0_db_wr = wr_valid && wr_bar[0] && (wr_addr_bar0 == 32'h{{ printf "%08X" .NVMeCQ0DoorbellOffset }});
+    wire nvme_sq1_db_wr = wr_valid && wr_bar[0] && (wr_addr_bar0 == 32'h{{ printf "%08X" .NVMeSQ1DoorbellOffset }});
+    wire nvme_cq1_db_wr = wr_valid && wr_bar[0] && (wr_addr_bar0 == 32'h{{ printf "%08X" .NVMeCQ1DoorbellOffset }});
 
     // plumbing between the responder and the DMA bridge
     wire        nvme_dma_rd_req;
@@ -607,6 +609,10 @@ module pcileech_tlps128_bar_controller(
         .sq0_doorbell_val   ( wr_data[15:0]                 ),
         .cq0_doorbell_wr    ( nvme_cq0_db_wr                ),
         .cq0_doorbell_val   ( wr_data[15:0]                 ),
+        .sq1_doorbell_wr    ( nvme_sq1_db_wr                ),
+        .sq1_doorbell_val   ( wr_data[15:0]                 ),
+        .cq1_doorbell_wr    ( nvme_cq1_db_wr                ),
+        .cq1_doorbell_val   ( wr_data[15:0]                 ),
         .msix_enable        ( msix_enable                   ),
         .msix_function_mask ( msix_function_mask            ),
         .msix_vector0_addr  ( msix_vector0_addr             ),
diff --git a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
index 8ee14d3..f370435 100644
--- a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
+++ b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
@@ -13,7 +13,8 @@
 //   0x09  Set Features  – temperature, error recovery, queues, VWC, etc.
 //   0x0A  Get Features  – number of queues, interrupt coalescing
 //   0x0C  AER           – queued silently, never completed (that's legal)
-//   rest  Create IO CQ/SQ, whatever – blanket success
+//   0x80  Format NVM   – accept format requests
+//   IO Q1 Flush/Write/Read/Write Zeroes/Dataset Mgmt – minimal disk emulation
 
 `timescale 1ns / 1ps
 
@@ -35,6 +36,10 @@ module pcileech_nvme_admin_responder(
     input [15:0]        sq0_doorbell_val,
     input               cq0_doorbell_wr,     // BAR0 + 0x1004
     input [15:0]        cq0_doorbell_val,
+    input               sq1_doorbell_wr,     // BAR0 + 0x1008 (DSTRD=0)
+    input [15:0]        sq1_doorbell_val,
+    input               cq1_doorbell_wr,     // BAR0 + 0x100C (DSTRD=0)
+    input [15:0]        cq1_doorbell_val,
 
     // MSI-X interrupt target — vector 0 config (from pcileech_msix_table).
     // Accepted to match the bar_controller wiring. The current interrupt
@@ -84,6 +89,7 @@ module pcileech_nvme_admin_responder(
     localparam [3:0] S_EXEC_NSLIST  = 4'h9;
     localparam [3:0] S_EXEC_LOGPAGE = 4'hA;
     localparam [3:0] S_SHUTDOWN     = 4'hB;
+    localparam [3:0] S_EXEC_READ_ZERO = 4'hC;
 
     reg [3:0]   state;
     reg [3:0]   return_state;       // where to go after DMA wait completes
@@ -93,6 +99,11 @@ module pcileech_nvme_admin_responder(
     reg [15:0]  sq_head;
     reg [15:0]  cq_head;
     reg         cq_phase;           // flips each time CQ wraps around
+    reg [15:0]  iosq_tail;
+    reg [15:0]  iosq_head;
+    reg [15:0]  iocq_head;
+    reg         iocq_phase;
+    reg         active_io_cmd;
 
     wire [11:0] asqs = aqa[11:0];
     wire [11:0] acqs = aqa[27:16];
@@ -109,6 +120,7 @@ module pcileech_nvme_admin_responder(
     wire [63:0] cmd_prp2     = {sqe[9], sqe[8]};
     wire [31:0] cmd_cdw10    = sqe[10];
     wire [31:0] cmd_cdw11    = sqe[11];
+    wire [31:0] cmd_cdw12    = sqe[12];
     wire [7:0]  identify_cns = cmd_cdw10[7:0];
 
     function [63:0] cmd_prp_addr;
@@ -129,6 +141,7 @@ module pcileech_nvme_admin_responder(
 
     // transfer progress
     reg [10:0]  data_dw_cnt;
+    reg [10:0]  io_zero_dw_limit;
     reg [12:0]  id_rom_offset;
 
     // edge detect for CC.EN so we can do a clean shutdown
@@ -137,6 +150,15 @@ module pcileech_nvme_admin_responder(
     // masking low bits – NVMe spec says queue bases are page-aligned
     wire [63:0] asq_base = {asq_hi, asq_lo & 32'hFFFFF000};
     wire [63:0] acq_base = {acq_hi, acq_lo & 32'hFFFFF000};
+    reg [63:0]  iosq_base;
+    reg [63:0]  iocq_base;
+    reg [15:0]  iosq_size;
+    reg [15:0]  iocq_size;
+    reg         iosq_enabled;
+    reg         iocq_enabled;
+    wire [63:0] active_cq_base = active_io_cmd ? iocq_base : acq_base;
+    wire [15:0] active_cq_head = active_io_cmd ? iocq_head : cq_head;
+    wire        active_cq_phase = active_io_cmd ? iocq_phase : cq_phase;
 
     // the spec says AER commands just sit around until something happens,
     // and nothing ever happens on our fake controller, so we count and ignore
@@ -153,6 +175,11 @@ module pcileech_nvme_admin_responder(
             sq_head         <= 16'h0;
             cq_head         <= 16'h0;
             cq_phase        <= 1'b1;
+            iosq_tail       <= 16'h0;
+            iosq_head       <= 16'h0;
+            iocq_head       <= 16'h0;
+            iocq_phase      <= 1'b1;
+            active_io_cmd   <= 1'b0;
             dma_rd_req      <= 1'b0;
             dma_wr_req      <= 1'b0;
             dma_wr_valid    <= 1'b0;
@@ -160,11 +187,18 @@ module pcileech_nvme_admin_responder(
             sqe_dw_idx      <= 4'h0;
             cqe_dw_idx      <= 2'h0;
             data_dw_cnt     <= 11'h0;
+            io_zero_dw_limit <= 11'h0;
             id_rom_offset   <= 13'h0;
             id_rom_addr     <= 13'h0;
             cc_en_prev      <= 1'b0;
             aer_pending     <= 4'h0;
             num_queues_granted <= 32'h00010001;  // default: 1 SQ + 1 CQ
+            iosq_base       <= 64'h0;
+            iocq_base       <= 64'h0;
+            iosq_size       <= 16'h0;
+            iocq_size       <= 16'h0;
+            iosq_enabled    <= 1'b0;
+            iocq_enabled    <= 1'b0;
         end else begin
             // pulse signals – cleared every cycle, only set when needed
             dma_rd_req      <= 1'b0;
@@ -195,14 +229,26 @@ module pcileech_nvme_admin_responder(
                         // host consumed some CQEs, update our copy of the head
                         if (cq0_doorbell_wr)
                             cq_head <= cq0_doorbell_val;
+                        if (sq1_doorbell_wr)
+                            iosq_tail <= sq1_doorbell_val;
+                        if (cq1_doorbell_wr)
+                            iocq_head <= cq1_doorbell_val;
 
                         // anything new? go fetch it
                         if (sq_tail != sq_head) begin
+                            active_io_cmd <= 1'b0;
                             dma_rd_req  <= 1'b1;
                             dma_rd_addr <= asq_base + {48'h0, sq_head} * 64;
                             dma_rd_len  <= 10'd16;
                             sqe_dw_idx  <= 4'h0;
                             state       <= S_FETCH_SQE;
+                        end else if (iosq_enabled && iocq_enabled && iosq_tail != iosq_head) begin
+                            active_io_cmd <= 1'b1;
+                            dma_rd_req  <= 1'b1;
+                            dma_rd_addr <= iosq_base + {42'h0, iosq_head, 6'h0};
+                            dma_rd_len  <= 10'd16;
+                            sqe_dw_idx  <= 4'h0;
+                            state       <= S_FETCH_SQE;
                         end
                     end
 
@@ -218,14 +264,98 @@ module pcileech_nvme_admin_responder(
 
                     // ---- figure out what the driver wants --------------------
                     S_DECODE_CMD: begin
+                        if (active_io_cmd) begin
+                            case (cmd_opcode)
+                                8'h02: begin
+                                    data_dw_cnt <= 11'h0;
+                                    if (cmd_cdw12[15:0] >= 16'd7)
+                                        io_zero_dw_limit <= 11'd1024;
+                                    else
+                                        io_zero_dw_limit <= ({8'h0, cmd_cdw12[2:0]} + 11'd1) << 7;
+                                    state <= S_EXEC_READ_ZERO;
+                                end
+                                8'h00, 8'h01, 8'h08, 8'h09: begin
+                                    cqe[0] <= 32'h0;
+                                    cqe[1] <= 32'h0;
+                                    cqe[2] <= {cmd_cid, iosq_head};
+                                    cqe[3] <= {31'h0, iocq_phase};
+                                    cqe_dw_idx <= 2'h0;
+                                    state <= S_POST_CQE;
+                                end
+                                default: begin
+                                    cqe[0] <= 32'h0;
+                                    cqe[1] <= 32'h0;
+                                    cqe[2] <= {cmd_cid, iosq_head};
+                                    cqe[3] <= {31'h0, iocq_phase};
+                                    cqe_dw_idx <= 2'h0;
+                                    state <= S_POST_CQE;
+                                end
+                            endcase
+                        end else begin
                         case (cmd_opcode)
 
+                            // Delete IO Submission Queue
+                            8'h00: begin
+                                iosq_enabled <= 1'b0;
+                                iosq_tail    <= 16'h0;
+                                iosq_head    <= 16'h0;
+                                cqe[0] <= 32'h0;
+                                cqe[1] <= 32'h0;
+                                cqe[2] <= {cmd_cid, sq_head};
+                                cqe[3] <= {31'h0, cq_phase};
+                                cqe_dw_idx <= 2'h0;
+                                state <= S_POST_CQE;
+                            end
+
+                            // Create IO Submission Queue
+                            8'h01: begin
+                                iosq_base    <= {cmd_prp1[63:12], 12'h000};
+                                iosq_size    <= cmd_cdw10[31:16];
+                                iosq_enabled <= 1'b1;
+                                iosq_tail    <= 16'h0;
+                                iosq_head    <= 16'h0;
+                                cqe[0] <= 32'h0;
+                                cqe[1] <= 32'h0;
+                                cqe[2] <= {cmd_cid, sq_head};
+                                cqe[3] <= {31'h0, cq_phase};
+                                cqe_dw_idx <= 2'h0;
+                                state <= S_POST_CQE;
+                            end
+
                             // Get Log Page
                             8'h02: begin
                                 data_dw_cnt <= 11'h0;
                                 state       <= S_EXEC_LOGPAGE;
                             end
 
+                            // Delete IO Completion Queue
+                            8'h04: begin
+                                iocq_enabled <= 1'b0;
+                                iocq_head    <= 16'h0;
+                                iocq_phase   <= 1'b1;
+                                cqe[0] <= 32'h0;
+                                cqe[1] <= 32'h0;
+                                cqe[2] <= {cmd_cid, sq_head};
+                                cqe[3] <= {31'h0, cq_phase};
+                                cqe_dw_idx <= 2'h0;
+                                state <= S_POST_CQE;
+                            end
+
+                            // Create IO Completion Queue
+                            8'h05: begin
+                                iocq_base    <= {cmd_prp1[63:12], 12'h000};
+                                iocq_size    <= cmd_cdw10[31:16];
+                                iocq_enabled <= 1'b1;
+                                iocq_head    <= 16'h0;
+                                iocq_phase   <= 1'b1;
+                                cqe[0] <= 32'h0;
+                                cqe[1] <= 32'h0;
+                                cqe[2] <= {cmd_cid, sq_head};
+                                cqe[3] <= {31'h0, cq_phase};
+                                cqe_dw_idx <= 2'h0;
+                                state <= S_POST_CQE;
+                            end
+
                             // Identify
                             8'h06: begin
                                 case (identify_cns)
@@ -315,6 +445,17 @@ module pcileech_nvme_admin_responder(
                                 state <= S_IDLE;
                             end
 
+                            // Format NVM – accept the host format request.  The
+                            // minimal emulation reports an empty zeroed namespace.
+                            8'h80: begin
+                                cqe[0] <= 32'h0;
+                                cqe[1] <= 32'h0;
+                                cqe[2] <= {cmd_cid, sq_head};
+                                cqe[3] <= {31'h0, cq_phase};
+                                cqe_dw_idx <= 2'h0;
+                                state  <= S_POST_CQE;
+                            end
+
                             // everything else (Create IO CQ/SQ, etc.) – just say yes
                             default: begin
                                 cqe[0] <= 32'h0;
@@ -325,6 +466,7 @@ module pcileech_nvme_admin_responder(
                                 state  <= S_POST_CQE;
                             end
                         endcase
+                        end
                     end
 
                     // ---- stream 4KB of identify data from ROM to host -------
@@ -395,12 +537,29 @@ module pcileech_nvme_admin_responder(
                         state <= S_WAIT_DMA_WR;
                     end
 
+                    // ---- IO read: return zeroed sectors for an empty disk ----
+                    S_EXEC_READ_ZERO: begin
+                        dma_wr_req   <= 1'b1;
+                        dma_wr_valid <= 1'b1;
+                        dma_wr_addr  <= cmd_prp_addr({data_dw_cnt, 2'b00});
+                        dma_wr_data  <= 32'h00000000;
+                        dma_wr_be    <= 4'hF;
+
+                        if (data_dw_cnt >= io_zero_dw_limit - 11'd1) begin
+                            return_state <= S_WRITE_DATA;
+                        end else begin
+                            data_dw_cnt  <= data_dw_cnt + 1'b1;
+                            return_state <= S_EXEC_READ_ZERO;
+                        end
+                        state <= S_WAIT_DMA_WR;
+                    end
+
                     // ---- all data has been sent, pack a success CQE ---------
                     S_WRITE_DATA: begin
                         cqe[0] <= 32'h0;
                         cqe[1] <= 32'h0;
-                        cqe[2] <= {cmd_cid, sq_head};
-                        cqe[3] <= {31'h0, cq_phase};
+                        cqe[2] <= active_io_cmd ? {cmd_cid, iosq_head} : {cmd_cid, sq_head};
+                        cqe[3] <= {31'h0, active_cq_phase};
                         cqe_dw_idx <= 2'h0;
                         state  <= S_POST_CQE;
                     end
@@ -409,7 +568,7 @@ module pcileech_nvme_admin_responder(
                     S_POST_CQE: begin
                         dma_wr_req   <= 1'b1;
                         dma_wr_valid <= 1'b1;
-                        dma_wr_addr  <= acq_base + {44'h0, cq_head, 4'h0}
+                        dma_wr_addr  <= active_cq_base + {44'h0, active_cq_head, 4'h0}
                                         + {60'h0, cqe_dw_idx, 2'b00};
                         dma_wr_data  <= cqe[cqe_dw_idx];
                         dma_wr_be    <= 4'hF;
@@ -434,18 +593,32 @@ module pcileech_nvme_admin_responder(
                     S_SEND_MSIX: begin
                         msix_trigger <= 1'b1;
 
-                        // wrap SQ head
-                        if (sq_head >= {4'h0, asqs})
-                            sq_head <= 16'h0;
-                        else
-                            sq_head <= sq_head + 1'b1;
+                        if (active_io_cmd) begin
+                            if (iosq_head >= iosq_size)
+                                iosq_head <= 16'h0;
+                            else
+                                iosq_head <= iosq_head + 1'b1;
 
-                        // wrap CQ head and flip the phase bit
-                        if (cq_head >= {4'h0, acqs}) begin
-                            cq_head  <= 16'h0;
-                            cq_phase <= ~cq_phase;
+                            if (iocq_head >= iocq_size) begin
+                                iocq_head  <= 16'h0;
+                                iocq_phase <= ~iocq_phase;
+                            end else begin
+                                iocq_head <= iocq_head + 1'b1;
+                            end
                         end else begin
-                            cq_head <= cq_head + 1'b1;
+                            // wrap SQ head
+                            if (sq_head >= {4'h0, asqs})
+                                sq_head <= 16'h0;
+                            else
+                                sq_head <= sq_head + 1'b1;
+
+                            // wrap CQ head and flip the phase bit
+                            if (cq_head >= {4'h0, acqs}) begin
+                                cq_head  <= 16'h0;
+                                cq_phase <= ~cq_phase;
+                            end else begin
+                                cq_head <= cq_head + 1'b1;
+                            end
                         end
 
                         state <= S_IDLE;
@@ -457,6 +630,11 @@ module pcileech_nvme_admin_responder(
                         sq_head     <= 16'h0;
                         cq_head     <= 16'h0;
                         cq_phase    <= 1'b1;
+                        iosq_tail   <= 16'h0;
+                        iosq_head   <= 16'h0;
+                        iocq_head   <= 16'h0;
+                        iocq_phase  <= 1'b1;
+                        active_io_cmd <= 1'b0;
                         aer_pending <= 4'h0;
                         state       <= S_IDLE;
                     end

From 02c6d83ece061ab2982bd9339d0f17a9f50be0f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Sat, 27 Jun 2026 16:38:34 +0300
Subject: [PATCH 20/31] fix vivado version on readme

---
 README | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README b/README
index 80dbe50..1cd4431 100644
--- a/README
+++ b/README
@@ -32,7 +32,7 @@ PREREQUISITES
 -------------
   - Go 1.26+
   - Linux with IOMMU/VFIO enabled
-  - Vivado 2023.2+ (for synthesis)
+  - Vivado 2023.2 (for synthesis)
 
   VFIO needs IOMMU enabled in BIOS and in the kernel parameters
   (intel_iommu=on or amd_iommu=on).

From 1acf391f4fc3adc2582df5e5458c93c61bd55d71 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Sun, 28 Jun 2026 00:57:54 +0300
Subject: [PATCH 21/31] @kissaikoyou import .v board sources in project tcl
 zdma

---
 internal/firmware/tclgen/tclgen_test.go             | 6 +++++-
 internal/firmware/tclgen/templates/project.tcl.tmpl | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/internal/firmware/tclgen/tclgen_test.go b/internal/firmware/tclgen/tclgen_test.go
index 95778a5..ff26949 100644
--- a/internal/firmware/tclgen/tclgen_test.go
+++ b/internal/firmware/tclgen/tclgen_test.go
@@ -57,6 +57,9 @@ func TestGenerateProjectTCL(t *testing.T) {
 	if strings.Contains(tcl, "MORE OPTIONS") {
 		t.Error("TCL should not use MORE OPTIONS for seed")
 	}
+	if !strings.Contains(tcl, "src/*.v") {
+		t.Error("TCL should glob src/*.v (ZDMA/GBOX ship pcileech_com as pcileech_com_e.v)")
+	}
 }
 
 func TestGenerateBuildTCL(t *testing.T) {
@@ -106,7 +109,8 @@ func TestClampLinkWidth(t *testing.T) {
 }
 
 func TestBarSizeToTCL(t *testing.T) {
-	k4 := uint64(4096); scale, size := barSizeToTCL(k4)
+	k4 := uint64(4096)
+	scale, size := barSizeToTCL(k4)
 	if scale != "Kilobytes" || size != "4" {
 		t.Errorf("4KB: got %s/%s, want Kilobytes/4", scale, size)
 	}
diff --git a/internal/firmware/tclgen/templates/project.tcl.tmpl b/internal/firmware/tclgen/templates/project.tcl.tmpl
index 6cdfa24..2db97d1 100644
--- a/internal/firmware/tclgen/templates/project.tcl.tmpl
+++ b/internal/firmware/tclgen/templates/project.tcl.tmpl
@@ -26,7 +26,8 @@ if {[string equal [get_filesets -quiet sources_1] ""]} {
 set obj [get_filesets sources_1]
 set sv_files [glob -nocomplain "${origin_dir}/src/*.sv"]
 set svh_files [glob -nocomplain "${origin_dir}/src/*.svh"]
-set all_src_files [concat $sv_files $svh_files]
+set v_files [glob -nocomplain "${origin_dir}/src/*.v"]  ;# ZDMA/GBOX: pcileech_com_e.v
+set all_src_files [concat $sv_files $svh_files $v_files]
 if {[llength $all_src_files] > 0} {
   set imported_files [import_files -fileset sources_1 $all_src_files]
 }
@@ -38,6 +39,9 @@ foreach f [get_files -of_objects [get_filesets sources_1] -filter {NAME =~ "*.sv
 foreach f [get_files -of_objects [get_filesets sources_1] -filter {NAME =~ "*.svh"}] {
   set_property -name "file_type" -value "Verilog Header" -objects $f
 }
+foreach f [get_files -of_objects [get_filesets sources_1] -filter {NAME =~ "*.v"}] {
+  set_property -name "file_type" -value "SystemVerilog" -objects $f
+}
 
 {{if not .StockBar}}
 # Remove any stock bar controller that might have been imported from board sources.

From 0eb3bf955d906b69391e978bcbf13b94bd909d67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Sun, 28 Jun 2026 15:06:33 +0300
Subject: [PATCH 22/31] recover license env when building under sudo #63

---
 internal/vivado/builder.go          |   5 +
 internal/vivado/envrestore.go       | 193 +++++++++++++++++++++++++
 internal/vivado/envrestore_linux.go |  21 +++
 internal/vivado/envrestore_other.go |  12 ++
 internal/vivado/envrestore_test.go  | 214 ++++++++++++++++++++++++++++
 internal/vivado/vivado.go           |  12 +-
 6 files changed, 454 insertions(+), 3 deletions(-)
 create mode 100644 internal/vivado/envrestore.go
 create mode 100644 internal/vivado/envrestore_linux.go
 create mode 100644 internal/vivado/envrestore_other.go
 create mode 100644 internal/vivado/envrestore_test.go

diff --git a/internal/vivado/builder.go b/internal/vivado/builder.go
index 6294910..ad5095a 100644
--- a/internal/vivado/builder.go
+++ b/internal/vivado/builder.go
@@ -115,6 +115,11 @@ func (b *Builder) Build(ctx *donor.DeviceContext) error {
 		}
 	}
 
+	// Hand the deliverables to the invoking user after a sudo build.
+	if err := chownOutputs(b.opts.OutputDir); err != nil {
+		slog.Warn("chown output files", "error", err)
+	}
+
 	slog.Info("build completed successfully")
 	return nil
 }
diff --git a/internal/vivado/envrestore.go b/internal/vivado/envrestore.go
new file mode 100644
index 0000000..8e247c3
--- /dev/null
+++ b/internal/vivado/envrestore.go
@@ -0,0 +1,193 @@
+package vivado
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"maps"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+)
+
+type probeFunc func(ctx context.Context) ([]byte, error)
+
+type envOverride map[string]string
+
+// errHomeUnresolved is returned when the invoking user's home can't be found
+// under sudo. A wrong HOME would send Vivado to the wrong ~/.Xilinx.
+var errHomeUnresolved = errors.New("could not determine invoking user home under sudo; use 'sudo -E' or export XILINXD_LICENSE_FILE in your shell profile")
+
+// licenseProbeVars are the env vars recovered from the invoking user's login shell.
+var licenseProbeVars = map[string]struct{}{
+	"XILINXD_LICENSE_FILE": {},
+	"LM_LICENSE_FILE":      {},
+	"PATH":                 {},
+}
+
+// parseProbeOutput extracts the license vars from the probe shell's stdout.
+// Unknown lines are ignored, the first match per var wins, and empty values are
+// skipped.
+func parseProbeOutput(out []byte) envOverride {
+	res := envOverride{}
+	for _, line := range strings.Split(string(out), "\n") {
+		key, val, ok := strings.Cut(line, "=")
+		if !ok {
+			continue
+		}
+		if _, want := licenseProbeVars[key]; !want {
+			continue
+		}
+		if _, dup := res[key]; dup || val == "" {
+			continue
+		}
+		res[key] = val
+	}
+	return res
+}
+
+// setEnv sets key in a KEY=VALUE slice, replacing an existing entry in place or
+// appending. The slice may be mutated.
+func setEnv(env []string, key, val string) []string {
+	for i, e := range env {
+		if k, _, ok := strings.Cut(e, "="); ok && k == key {
+			env[i] = key + "=" + val
+			return env
+		}
+	}
+	return append(env, key+"="+val)
+}
+
+func applyOverrides(env []string, ov envOverride) []string {
+	for k, v := range ov {
+		env = setEnv(env, k, v)
+	}
+	return env
+}
+
+// parseSudoID parses a sudo-exported numeric id, rejecting empty, non-numeric,
+// zero, and overflowing values.
+func parseSudoID(s string) (uint32, bool) {
+	n, err := strconv.ParseUint(s, 10, 32)
+	if err != nil || n == 0 {
+		return 0, false
+	}
+	return uint32(n), true
+}
+
+func isUnderSudo() bool {
+	return os.Geteuid() == 0 && os.Getenv("SUDO_USER") != "" && os.Getenv("SUDO_UID") != ""
+}
+
+// resolveEnvOverrides restores HOME and, when a probe is supplied, merges in the
+// license vars it returns. A nil or failing probe leaves HOME set alone.
+func resolveEnvOverrides(home string, probe probeFunc) envOverride {
+	ov := envOverride{"HOME": home}
+	if probe == nil {
+		return ov
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	out, err := probe(ctx)
+	if err != nil {
+		slog.Warn("license env probe failed; using HOME only", "error", err)
+		return ov
+	}
+	maps.Copy(ov, parseProbeOutput(out))
+	return ov
+}
+
+// buildSudoOverrides enforces that home is known and wires the real probe when
+// the caller (or a test) does not provide one.
+func buildSudoOverrides(uid, gid uint32, home, shell string, probe probeFunc) (envOverride, error) {
+	if home == "" {
+		return nil, errHomeUnresolved
+	}
+	if probe == nil {
+		probe = func(ctx context.Context) ([]byte, error) {
+			return probeShellAsUser(ctx, shell, home, uid, gid)
+		}
+	}
+	return resolveEnvOverrides(home, probe), nil
+}
+
+// envOverrides rebuilds the Vivado child environment under sudo: HOME from the
+// invoking user's passwd entry, plus license vars probed from their login shell.
+// It is a no-op when not under sudo.
+func envOverrides() (envOverride, error) {
+	if !isUnderSudo() {
+		return nil, nil
+	}
+	uid, ok := parseSudoID(os.Getenv("SUDO_UID"))
+	if !ok {
+		return nil, nil
+	}
+	gid, _ := parseSudoID(os.Getenv("SUDO_GID"))
+	home, shell, err := resolveSudoUser(os.Getenv("SUDO_UID"), os.Getenv("SUDO_USER"))
+	if err != nil {
+		return nil, fmt.Errorf("resolve invoking user under sudo: %w", err)
+	}
+	return buildSudoOverrides(uid, gid, home, shell, nil)
+}
+
+// resolveSudoUser looks up the invoking user by uid, falling back to the sudo
+// username, and returns its home and login shell.
+func resolveSudoUser(uidStr, sudoUser string) (string, string, error) {
+	u, err := user.LookupId(uidStr)
+	if err != nil && sudoUser != "" {
+		u, err = user.Lookup(sudoUser)
+	}
+	if err != nil {
+		return "", "", fmt.Errorf("user not found (uid=%s user=%s): %w", uidStr, sudoUser, err)
+	}
+	if sudoUser != "" && u.Username != sudoUser {
+		slog.Warn("SUDO_USER does not match passwd entry for SUDO_UID", "sudo_user", sudoUser, "passwd_user", u.Username)
+	}
+	return u.HomeDir, lookupShell(u.Username, u.Uid), nil
+}
+
+// lookupShell reads the login shell from /etc/passwd, defaulting to bash.
+func lookupShell(username, uid string) string {
+	data, err := os.ReadFile("/etc/passwd")
+	if err != nil {
+		return "/bin/bash"
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		f := strings.Split(line, ":")
+		if len(f) >= 7 && (f[0] == username || f[2] == uid) && f[6] != "" {
+			return f[6]
+		}
+	}
+	return "/bin/bash"
+}
+
+// chownOutputs hands the copied *.bit/*.bin to the invoking user after a sudo
+// build, so the firmware doesn't come out root-owned. No-op otherwise and never
+// fatal.
+func chownOutputs(outputDir string) error {
+	if !isUnderSudo() {
+		return nil
+	}
+	uid, ok := parseSudoID(os.Getenv("SUDO_UID"))
+	if !ok {
+		return nil
+	}
+	gid, _ := parseSudoID(os.Getenv("SUDO_GID"))
+	var firstErr error
+	for _, pattern := range []string{filepath.Join(outputDir, "*.bit"), filepath.Join(outputDir, "*.bin")} {
+		matches, _ := filepath.Glob(pattern)
+		for _, m := range matches {
+			if err := os.Lchown(m, int(uid), int(gid)); err != nil {
+				slog.Warn("chown output file", "file", m, "error", err)
+				if firstErr == nil {
+					firstErr = err
+				}
+			}
+		}
+	}
+	return firstErr
+}
diff --git a/internal/vivado/envrestore_linux.go b/internal/vivado/envrestore_linux.go
new file mode 100644
index 0000000..eb96b8f
--- /dev/null
+++ b/internal/vivado/envrestore_linux.go
@@ -0,0 +1,21 @@
+//go:build linux
+
+package vivado
+
+import (
+	"context"
+	"os/exec"
+	"syscall"
+)
+
+const probePrintfScript = `printf 'XILINXD_LICENSE_FILE=%s\nLM_LICENSE_FILE=%s\nPATH=%s\n' "$XILINXD_LICENSE_FILE" "$LM_LICENSE_FILE" "$PATH"`
+
+// probeShellAsUser runs the invoking user's login shell as uid:gid (a child-only
+// credential drop; the parent stays root) with a minimal env so the profile
+// files re-export the license vars, and returns the printed values.
+func probeShellAsUser(ctx context.Context, shell, home string, uid, gid uint32) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, shell, "-lic", probePrintfScript)
+	cmd.Env = []string{"HOME=" + home, "TERM=dumb", "PATH=/usr/bin:/bin"}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Credential: &syscall.Credential{Uid: uid, Gid: gid}}
+	return cmd.Output()
+}
diff --git a/internal/vivado/envrestore_other.go b/internal/vivado/envrestore_other.go
new file mode 100644
index 0000000..122fd8b
--- /dev/null
+++ b/internal/vivado/envrestore_other.go
@@ -0,0 +1,12 @@
+//go:build !linux
+
+package vivado
+
+import (
+	"context"
+	"errors"
+)
+
+func probeShellAsUser(context.Context, string, string, uint32, uint32) ([]byte, error) {
+	return nil, errors.New("credential drop not supported on this platform")
+}
diff --git a/internal/vivado/envrestore_test.go b/internal/vivado/envrestore_test.go
new file mode 100644
index 0000000..120f932
--- /dev/null
+++ b/internal/vivado/envrestore_test.go
@@ -0,0 +1,214 @@
+package vivado
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func TestParseProbeOutput_AllKeys(t *testing.T) {
+	out := []byte("XILINXD_LICENSE_FILE=/opt/lic.lic\nLM_LICENSE_FILE=2100@host\nPATH=/usr/bin:/bin\n")
+	got := parseProbeOutput(out)
+	want := envOverride{
+		"XILINXD_LICENSE_FILE": "/opt/lic.lic",
+		"LM_LICENSE_FILE":      "2100@host",
+		"PATH":                 "/usr/bin:/bin",
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("parseProbeOutput = %#v, want %#v", got, want)
+	}
+}
+
+func TestParseProbeOutput_ValueWithEquals(t *testing.T) {
+	out := []byte("XILINXD_LICENSE_FILE=/a/b=port\n")
+	got := parseProbeOutput(out)
+	if got["XILINXD_LICENSE_FILE"] != "/a/b=port" {
+		t.Errorf("value with '=' = %q, want %q", got["XILINXD_LICENSE_FILE"], "/a/b=port")
+	}
+}
+
+func TestParseProbeOutput_MissingKeyAbsent(t *testing.T) {
+	out := []byte("XILINXD_LICENSE_FILE=/opt/lic.lic\n")
+	got := parseProbeOutput(out)
+	if _, ok := got["LM_LICENSE_FILE"]; ok {
+		t.Error("LM_LICENSE_FILE should be absent when not in output")
+	}
+	if _, ok := got["PATH"]; ok {
+		t.Error("PATH should be absent when not in output")
+	}
+}
+
+func TestParseProbeOutput_IgnoresNoiseAndEmpty(t *testing.T) {
+	out := []byte("some profile echo noise\nXILINXD_LICENSE_FILE=/x.lic\nRANDOM_THING=ignored\n\nLM_LICENSE_FILE=\n")
+	got := parseProbeOutput(out)
+	if got["XILINXD_LICENSE_FILE"] != "/x.lic" {
+		t.Errorf("XILINXD_LICENSE_FILE = %q, want /x.lic", got["XILINXD_LICENSE_FILE"])
+	}
+	if _, ok := got["LM_LICENSE_FILE"]; ok {
+		t.Error("empty LM_LICENSE_FILE value should be dropped")
+	}
+}
+
+func TestSetEnv_ReplaceInPlace(t *testing.T) {
+	env := []string{"HOME=/root", "PATH=/usr/bin"}
+	got := setEnv(env, "HOME", "/home/user")
+	want := []string{"HOME=/home/user", "PATH=/usr/bin"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("setEnv replace = %#v, want %#v", got, want)
+	}
+}
+
+func TestSetEnv_AppendWhenAbsent(t *testing.T) {
+	env := []string{"PATH=/usr/bin"}
+	got := setEnv(env, "HOME", "/home/user")
+	want := []string{"PATH=/usr/bin", "HOME=/home/user"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("setEnv append = %#v, want %#v", got, want)
+	}
+}
+
+func TestApplyOverrides_KeepsOthersAndDoesNotTouchXilinx(t *testing.T) {
+	env := []string{"XILINX_VIVADO=/tools/Xilinx/Vivado/2023.2", "PATH=/usr/bin"}
+	ov := envOverride{"HOME": "/home/user", "XILINXD_LICENSE_FILE": "/x.lic"}
+	got := applyOverrides(env, ov)
+
+	if envGet(got, "XILINX_VIVADO") != "/tools/Xilinx/Vivado/2023.2" {
+		t.Errorf("XILINX_VIVADO must be untouched, got %q", envGet(got, "XILINX_VIVADO"))
+	}
+	if envGet(got, "HOME") != "/home/user" {
+		t.Errorf("HOME override not applied, got %q", envGet(got, "HOME"))
+	}
+	if envGet(got, "XILINXD_LICENSE_FILE") != "/x.lic" {
+		t.Errorf("license override not applied, got %q", envGet(got, "XILINXD_LICENSE_FILE"))
+	}
+}
+
+func TestParseSudoID(t *testing.T) {
+	cases := []struct {
+		in   string
+		want uint32
+		ok   bool
+	}{
+		{"", 0, false},
+		{"0", 0, false},
+		{"abc", 0, false},
+		{"-1", 0, false},
+		{"4294967296", 0, false}, // 2^32 overflow
+		{"1000", 1000, true},
+	}
+	for _, c := range cases {
+		got, ok := parseSudoID(c.in)
+		if ok != c.ok || got != c.want {
+			t.Errorf("parseSudoID(%q) = (%d,%v), want (%d,%v)", c.in, got, ok, c.want, c.ok)
+		}
+	}
+}
+
+// envGet returns the value for key in a KEY=VALUE slice, or "".
+func envGet(env []string, key string) string {
+	for _, e := range env {
+		if k, v, ok := strings.Cut(e, "="); ok && k == key {
+			return v
+		}
+	}
+	return ""
+}
+
+// fakeProbe returns a probeFunc emitting the given stdout, or an error.
+func fakeProbe(out string, err error) probeFunc {
+	return func(context.Context) ([]byte, error) { return []byte(out), err }
+}
+
+func TestResolveEnvOverrides_ProbeMerged(t *testing.T) {
+	ov := resolveEnvOverrides("/home/u", fakeProbe("XILINXD_LICENSE_FILE=/a.lic\nLM_LICENSE_FILE=2100@h\nPATH=/u/bin\n", nil))
+	if ov["HOME"] != "/home/u" {
+		t.Errorf("HOME = %q, want /home/u", ov["HOME"])
+	}
+	if ov["XILINXD_LICENSE_FILE"] != "/a.lic" {
+		t.Errorf("XILINXD_LICENSE_FILE = %q, want /a.lic", ov["XILINXD_LICENSE_FILE"])
+	}
+	if ov["LM_LICENSE_FILE"] != "2100@h" {
+		t.Errorf("LM_LICENSE_FILE = %q, want 2100@h", ov["LM_LICENSE_FILE"])
+	}
+	if ov["PATH"] != "/u/bin" {
+		t.Errorf("PATH = %q, want /u/bin", ov["PATH"])
+	}
+}
+
+func TestResolveEnvOverrides_ProbeError_HomeOnly(t *testing.T) {
+	ov := resolveEnvOverrides("/home/u", fakeProbe("", errors.New("boom")))
+	if len(ov) != 1 || ov["HOME"] != "/home/u" {
+		t.Fatalf("want HOME-only override on probe error, got %#v", ov)
+	}
+}
+
+func TestResolveEnvOverrides_NilProbe_HomeOnly(t *testing.T) {
+	ov := resolveEnvOverrides("/home/u", nil)
+	if len(ov) != 1 || ov["HOME"] != "/home/u" {
+		t.Fatalf("want HOME-only override when probe is nil, got %#v", ov)
+	}
+}
+
+func TestBuildSudoOverrides_HomeUnresolved_HardError(t *testing.T) {
+	_, err := buildSudoOverrides(1000, 1000, "", "/bin/bash", nil)
+	if !errors.Is(err, errHomeUnresolved) {
+		t.Fatalf("want errHomeUnresolved, got %v", err)
+	}
+}
+
+func TestBuildSudoOverrides_Delegates(t *testing.T) {
+	ov, err := buildSudoOverrides(1000, 1000, "/home/u", "/bin/bash", fakeProbe("XILINXD_LICENSE_FILE=/a.lic\n", nil))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ov["XILINXD_LICENSE_FILE"] != "/a.lic" {
+		t.Errorf("probed license lost through buildSudoOverrides: %q", ov["XILINXD_LICENSE_FILE"])
+	}
+	if ov["HOME"] != "/home/u" {
+		t.Errorf("HOME lost: %q", ov["HOME"])
+	}
+}
+
+func TestEnvOverrides_NotUnderSudo_Noop(t *testing.T) {
+	// Not root in tests, so this must be a no-op.
+	ov, err := envOverrides()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ov != nil {
+		t.Errorf("want nil override when not under sudo, got %#v", ov)
+	}
+}
+
+func TestChownOutputs_NotUnderSudo_Noop(t *testing.T) {
+	// Not root -> chownOutputs must be a no-op and never touch files.
+	dir := t.TempDir()
+	bit := filepath.Join(dir, "out.bit")
+	if err := os.WriteFile(bit, []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := chownOutputs(dir); err != nil {
+		t.Fatalf("chownOutputs returned error when not under sudo: %v", err)
+	}
+	if _, err := os.Stat(bit); err != nil {
+		t.Errorf("output file should be untouched, got %v", err)
+	}
+}
+
+func TestChownOutputs_NoMatches_NoError(t *testing.T) {
+	// Empty dir, no .bit/.bin -> no error, nothing to chown.
+	if err := chownOutputs(t.TempDir()); err != nil {
+		t.Fatalf("chownOutputs on empty dir returned error: %v", err)
+	}
+}
+
+func TestChownOutputs_MissingDir_NoError(t *testing.T) {
+	// Best-effort: a missing output dir must not produce an error.
+	if err := chownOutputs(filepath.Join(t.TempDir(), "does-not-exist")); err != nil {
+		t.Fatalf("chownOutputs on missing dir returned error: %v", err)
+	}
+}
diff --git a/internal/vivado/vivado.go b/internal/vivado/vivado.go
index 12147cd..abf4f6a 100644
--- a/internal/vivado/vivado.go
+++ b/internal/vivado/vivado.go
@@ -97,7 +97,9 @@ func (v *Vivado) BinaryPath() string {
 	return filepath.Join(v.Path, "bin", "vivado")
 }
 
-// RunTCL executes a TCL script in Vivado batch mode with a timeout.
+// RunTCL executes a TCL script in Vivado batch mode with a timeout. Under sudo
+// the invoking user's license env is recovered via envOverrides; otherwise it's
+// a no-op.
 func (v *Vivado) RunTCL(tclScript string, workDir string, timeout time.Duration) error {
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
@@ -108,9 +110,13 @@ func (v *Vivado) RunTCL(tclScript string, workDir string, timeout time.Duration)
 	cmd.Stdout = io.MultiWriter(os.Stdout, &output)
 	cmd.Stderr = io.MultiWriter(os.Stderr, &output)
 
-	// Set up environment
 	env := os.Environ()
-	env = append(env, fmt.Sprintf("XILINX_VIVADO=%s", v.Path))
+	ov, err := envOverrides()
+	if err != nil {
+		return err
+	}
+	env = applyOverrides(env, ov)
+	env = setEnv(env, "XILINX_VIVADO", v.Path)
 	cmd.Env = env
 
 	slog.Info("running Vivado", "cmd", strings.Join(cmd.Args, " "), "dir", workDir, "timeout", timeout)

From acef7dece30162829adf586061ef689e82c0850b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Mon, 29 Jun 2026 05:35:00 +0300
Subject: [PATCH 23/31] new sponsor: sgorm0

---
 README | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README b/README
index 1cd4431..08da464 100644
--- a/README
+++ b/README
@@ -20,6 +20,8 @@ SPECIAL THANKS
 --------------
   FTWDMA         Sponsorship
                  https://ftwdma.com
+  sgorm0         Sponsorship
+                 https://github.com/sgorm0
   TrueTuring     Sponsorship, NVMe and xHCI fixes
                  https://github.com/TrueTuring
   CaptainDMA     Sponsorship

From 499232929d092eacbf3e9032c0a957a5eb6f78c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Mon, 29 Jun 2026 23:50:25 +0300
Subject: [PATCH 24/31] added known issues

---
 KNOWN_ISSUES  |  62 ++++++++++++++++++++++++++++++++++++++++++++++++++
 docs/logo.png | Bin 160832 -> 0 bytes
 2 files changed, 62 insertions(+)
 create mode 100644 KNOWN_ISSUES
 delete mode 100644 docs/logo.png

diff --git a/KNOWN_ISSUES b/KNOWN_ISSUES
new file mode 100644
index 0000000..89745fe
--- /dev/null
+++ b/KNOWN_ISSUES
@@ -0,0 +1,62 @@
+problem: "device data collection failed" / BAR reads all 0xFF
+cause: donor is in D3 sleep, IOMMU is off, or the donor is not bound to vfio-pci.
+fix: enable IOMMU in GRUB (intel_iommu=on / amd_iommu=on iommu=pt), update-grub
+     + reboot, wake the device to D0, bind it to vfio-pci, turn Secure Boot off.
+
+problem: "VFIO_GROUP_SET_CONTAINER: invalid argument"
+cause: the donor shares its IOMMU group with devices still on native drivers.
+fix: move the whole group to vfio-pci, or isolate the donor (ACS).
+
+problem: PC crashes / hard reboot during build
+cause: a memory conflict - usually the OS/boot drive got bound to VFIO, or a
+       shared group. Look for MCE / "probe failed -22" in journalctl.
+fix: never bind the drive you boot from; use a separate donor; isolate the group.
+
+problem: "card in sleep mode"
+cause: runtime PM or the host driver keeps the donor in D3.
+fix: disable runtime PM, keep the donor in D0, bind it to vfio-pci.
+
+problem: Live / USB-boot Ubuntu
+cause: live-USB + VFIO is unreliable.
+fix: do a real install to disk.
+
+problem: Vivado "exit status 1" / "Invalid XML token"
+cause: a corrupted Vivado install (device parts / XML), not the tool.
+fix: reinstall Vivado cleanly; --skip-vivado proves the artifacts are fine.
+
+problem: Vivado license lost under sudo
+cause: sudo strips PATH / XILINXD_LICENSE_FILE.
+fix: pass them back: sudo env PATH="$PATH" XILINXD_LICENSE_FILE="$..." \
+     ./bin/pcileechgen build ...  (latest build also recovers them itself)
+
+problem: donor BAR > board BRAM -> [FAIL]
+cause: the donor BAR is bigger than the board can emulate.
+fix: pick a smaller-BAR donor or a bigger board
+
+problem: Windows Code 10 "cannot start"  (most common report)
+cause: the clone loads but doesn't behave like the real device BAR0 reads FF,
+       MSI-X/interrupt setup fails, or device-type emulation is incomplete.
+       Often hidden: stale Windows device history.
+fix: try a network / audio / wifi donor first (NVMe and xHCI hit Code 10 until
+     done); run tools/cleanup_device_history.ps1 (Admin) then reboot; Core
+     Isolation off; correct BIOS.
+
+problem: stale device metadata / wrong driver after reflash
+cause: Windows caches PCI device info in the registry.
+fix: run the bundled cleanup_device_history utility, reboot, reconnect.
+
+problem: yellow triangle / device not recognized after flash
+cause: a partial flash image, or the device needs repo enhancements.
+fix: rewrite the firmware with a working flasher; get a steady green light first.
+
+problem: lone-dma-test shows BAD DTB / can't find ntoskrnl
+cause: usually BIOS / Windows DMA settings, not the firmware.
+fix: recheck BIOS + Windows settings; compare to a known-good firmware.
+
+Note (not a bug): NVMe full disk emulation is still in progress.
+The admin queue and init work, but BRAM cache + IO queues are not done yet, so
+NVMe donors commonly hit Code 10 / stornvme Event 11 until then.
+
+Note (not a bug): xHCI (USB) emulation is partial.
+Clones enumerate, but host read/write + doorbell gaps remain, so USBXHCI often
+hits Code 10 (e.g. VIA VL805). Targeted this cycle.
\ No newline at end of file
diff --git a/docs/logo.png b/docs/logo.png
deleted file mode 100644
index 04982953148c85a9c01a029593e949ce5fe67599..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 160832
zcmXt9V{m3o(~fQ1w#`kR*xA^&ZEmo!?%1|%+jg?CZGHFq<2zMXovNuir)Ii)x_hqf
ziBwXMM1;eG0|5a+l$H`#0RaKE2ErBw3OI5U^zaRQ!8%H5xqyJcqyG<}AQ@RWARr_l
z(&D1OJ+lt|ppyxQQ(EFV*qKYmy^fDKc%lE`$}23;<UxRmqtM6}hK3p@gO3M>vXQN=
zt$24oZ;a5KfS?(!92%N*#d>OO22#ZTei3ff*QnH2e1Ru7%KX~peR1`0EAuAo`F^kT
zaX`e$y9E!#PhR=2A!nB=(XRLG>E-!(#D1%7zQzCPePh3Qke^SRuOkybV{{3*^2XlM
z5_fxHj;*7)+|5>2_M<JfB)0xab7d`fGrG%cfl-Xxb}hc%Vm3$gtJ>iG;%d9v+w{xZ
zKu1+)w5(+&vT#FUduw~gPu62}jFx;;LIH1`&-t^gMHyYvBQ|SkWsA#dYs@K$FN1F+
z?uvlF!9qdt>Hwc;7Di37>Ex#$ns{j@SGc#Vy}iA=v(o22hFc+x&;Rn3U&1Z6!%uEC
zt=y!e!vS}j_x*T2yU?C!S?HXq>H7H^cH1tST!Z<ddgo~f-D*CI*y?NH-tA%~ox5gT
zlc&Z<S5{VU@U#R~-bCjdf3*1@My<S`iHC`viH543s-zF_*^cjcE-5Kl0RRBU4uY?S
z!|3>25Y5yX???WbKHL{Xx(|jzJN%4{SLhv`BU=j#Oa8JxKC6s+SB3WHwij7zJ3E{;
zh0P`m%|LN^#_d0Kd-Qj!?P@<%AKH`~y!#v`NG{Q9)XZk`x|sXf_^DdRnoI&kyK+ZZ
zO?becxoL0fU^V*DTG?LH?k9eA3jj_vrghs_=WF7K-sU#IcB_r`Xsg|Y^`}?h=cn%d
z!=>)x?SpEyckdcf`adtohvxbWmkrJ7QS-th6Su767rc~bWWJd1m*D+RVkc{*i-1~<
zivSxXd?Bu~Ct|CEre1{>itKW_+Kjc$&B~6IA6BD*B@UgM11G(#XS)#XADgI|$5PLb
zBWBo<*B@z)k)PoL?w{c*c0c3!OyT|`2otcG{|$Z3=PmfzF5n8wv1lqRtuD1*uQy5x
z?%@T*34gcs+j$6At>Or=SR#7*3$fxe=9W;D`eztQe{$?(-3kN$tXLm2RcB|OeTPg{
zeMeq6a-093gV6fQ0@odItr<3Uvx2HOPLx{zex}PfyGm8h{7vRF1LA(R3tB%TbHKaL
zJb<6|B5E&=LN(u+sM&5gxZ+(o{4+KVFyqP)QW_oVDO4?2TuoL}=pkCYD9N;!X+GM>
zowGr_q0mh9PXbOPiBA1XIQ>lPC*)+rwBZwSHeK1_y%BX&ayIJhMFMe0>^*KN<ah7D
zh1<tf>jyHikU(4SmEnV;z@50Z@vnQLYMBrHsk}9Vv*wW>E~}UTF5IbH3LJ*qG=yW}
z1Hs}|Jb%d>?2tDT`RMo6bDnAF4b3YbEY;6U;M&36+}y7A_0651e%SqQ<tu))cR&)j
zNYDV!@)ZHgewDWNnIEO~+(W+hT-qX-l~CCdii}+9kbK#oj~j;QE9fEG$lfVP|BQcI
zrv5Wl3!q_Q&~Gvtgz^jcaj+4yQ8t%&MmB*S^)q4}4iUA0sMeOe;5?UiO<#^PYl~Km
zk&$)mR(2rcM!<<UGQI8V?{(YAe(<>3SiX4{c$^cnFPy*s-0QFZ@fk!6=`)rFNg4;k
zi;3N9?{9&zBdOB6{Ipu;D^RxTFX9a5Qg_k9to*)dN^XMI_uPjRD|(WxHB(fK<7VVN
z%2Oy5j5~p>#jV6ny%Q)~*3Jsnt}cGE;lN|Ti$TFghu3a~nvy^-JNTVy;(+rS-U0wb
z&M(a}ANZ>3ss1P9yrH=4lrd|iN5|Oz0eW&^{QD8l$_;AH`pI+VwAoZ*6R))21stmR
zJ8|5QS4UredAe7(u=|JD`!xUZu;|diW@)4M?`r7wpts4M_SqjFiNeAY1||jh&0xEs
z2VTcLL#0uxo(1bCi^;!}_P+anu>X-&3vY4Fe}C5=C=MaU?|80O2Rn#-`8;2;dh7N~
zSBN_0>O7h!CZ)h5KE*g5tlbs0*F)mrW#qNDV`^t^=2aIHZs_pm6;>zVF|~5G{IU^)
zf9>`n%RA?I-;E&_?%_;)f1~}zV$?2b-Mrj{M#6b49ybh&Zj##|Qg^WM!Os52wwqHE
zn=mKn%&~+_EZRy-OZR8!mBM%qx0YgrI@=z1US&D=;pen4E@MmK<%=%mSW&w=N3+`9
z(&i#ixlm$oEMc3){W4~5nG=qWUvj~lQev&Wf`$oNJ{k}7G7)I+`ao~z7Etr!(eps)
zBB8y31l%~-cqw=dYz=1tB_~DQNi8v2l9Jf{?nWOS9UXa{otaIoEut<a=yzUSDEvH7
z|6)oeH+Yuo|1@IrkpZ3C;6+M$PO}c7q`@!4Rz5><J@9TULc45;Qcq&e)+SL^7y5pm
z^7i(WrluxQSyg&Y-J7OPlq%HU($*^H<LxddST7paw?1EuOHLWPBg17i6qFQV+jZXV
z3Q{&U{7o$_(B}?Tg)dy}x^b(Rt>sl!CCo;J^S-QH>V73gr*j3MKhU{9pg%+J9~=}5
z_m;8f<CzDUN<Vt4Hx;sqG9R@RE@XGS-KLv>tJ}%dT@r_`JFKpc>yO(R{+k4k9WUe^
z-v_(<6`h;DPKRFTo9+jpW{+L}xUPql&fDkAo4($kP2@B1AOz3bzO)Bk-uAe!Lu%o9
z@y!}m@=*?C0+v(myJLt6G-97i*!$y5he4kkKam}u8*tB`FXZxl0s4bU;rCM$&yOpQ
z{l~M^yiOm4wCTICLm{^{g2~ld0|x|;nW8IPef}=d!WF-~mD3&>+1XG=oz_9-T~B!b
zuldp2oe$!~IR6J7?Hg#~&%YZVH@(QjzPF&hulwNz`}a1rpTWTz!IY>_Kx1kjJ<!3G
z#(#ZQi8R_80*I>)bi#=EI}mw2uR9E`H`apaXL9fOW^QCUbc<b8x9<M&xW()F5b}MT
zm%M$ys9kLN{D<8eD7gC})Wp?FQVG?q{^DVyFyl=bNwf6DZN0Qsf)9o8Nf?|ln+iQE
z@IcV@ym8^VJNFRuf|8Tly6dILp-a7`^QgW5)fjLCN&!Ap#h(8)d~(m|{q?lkynmir
zgD>RknZItzTdr=yTv}2xD26Nu*84gf(BFCEN0I|?3!a0|;a(&3db@i29?&i7*a`e=
zT$X?v)W!xsDVKuZf5r3P)n$2xP83h!{0=|Xvp>R3-<GE>3!CIyC)>?j?*`4^_XYQx
zNsQ6~1BwrkCe(eoKd-R5?c!r^57_%R0Y3yipZ92=R}Q)T*ao^VYZfQ-V{fy}@$d$^
zp;0Hjq0G#_kZqrzt-bK=>*~qGOu$Kg-Hr->J85(L1bE!ot7%(rm_TLU(I>MU&tB!b
z8MK2r?hm9c)#+g~`AS0+POjBNVfT`)?L3??quH|8NTRUdO&hYLG3m&`j@npT>&|Bd
zfZ*t=t8nQQF6hsl#mp^iAQ||(;r8$ZBxLp8Qoe2O3WxUwJVW|^4@16wK0F*Y&h`Y(
z3VlTTe!rdE4r3d{Kb*{hvkNHJX8B?I5(&$&r*hzJ$9ensKufrMDbqjkbv1Ibo-3**
zs*K0l@$c6LeDUk{$n6ab*N**(GJuq4_V<EK^Sc|yc08KEY;)WP^L<*@IK0<L9lO?3
z3}Re`gUbF^v35T15uCjq|9kws*<z<7r!6xQ0$g^Yz5@j?ktsO=1=$16D{mFFmayAA
zh>Mlnvztl(^RJ$;^IIjo<KdigUo8zVqMH@)-p!@Ovc}Tf{Pc6CaJCL1#eT>YFT`6d
zUiZ8AX&C5XT?oa!O#NYo)fels&-L>siurtU$enjH$m)$)P1|!5dYQ0MQqe||NIGgz
zsD5M3`T4P#{Rs?k{4xqKC^dhOuO<e8!t#PQKl|4d@SmRjS)$o(xbSCW7XJ$!fsil8
z^Np|+5)mI*cpSl?m-WXpVP1>JjX$5D;~olufG3W={~JNq`#E#jZ#GZI%cG{I=<eN*
zoq)9htA`f5&1mhI?^2rFA_|MX-m5p{`x9Y5xY{fq!dN1HR8z@VqS7lq*H;=&-JRAS
z5&|C2G{AvaSXFCPSK@hLhUPT1SVdT}q|1!I-|K2cMMFjN|Kd4r<^14)&rL|&_XqOr
z2J<f3rsL-jt#<BO4te<go{<1G^!{AFnB(iMk+rA4Lau+LtE;PWw)^egT2gm+x3XKt
z)pn<bP3!uq<?jvVOLuAlK352#&t=Km`*n@Ix%vag+f!C+=vaa)leL<{(YOS1$=JSn
zlhM5t4gH|SQblkXQofjH85Q4wev4ec6?AF-wdSoByG)5%?r;9{r`MzV?HhmM@5fR_
zp!!^bR>5wFyM%u6pMHfNeIOGQtVV6Cdiw8t9_hqqr-wLWmO+hn>*y%!pjG&%-}kE>
zal%6*N584mvJXZH3xo9j3{u~YWZn$aA5h<Apt@(Tbq{WYsM^l%_(8(}a)ln)y52V~
zOb3R>QP3;NoWM;CGC6Gk`#%d0KQU#(Td@h}Twiv5y}!Q3P6d!w38HpBTbB+w*gT#E
zJdaXVVS;ZG$Vc~vB2^(A9DU1Ti3DRMLTUBl!X8Frv-9%q{zZKl4n;^@#<wQ|08Y1W
zCjoo0CEJQZZ$;~Q+&zJ|e568<Tn-x&JH7{cJpPv)esi&e!qO->^P$j+5OThAb(cfq
zi{c;(9d<^_uoM(jg+ib6@e`z+2|3)ly@vf@c4}6`R8c#=<A&0qZ&BBjFbks!-4wwb
z;MOZ8Ce*P>g`;;}1eB6-M1LyXvw{~QP-E8mq3KfIZD}0f+b`mF$W{nGyt5?&h??(#
zerb2FICXaZ$N%*e);c_vkQ!!#$IQ%9GL~?-1r&_4M;xW9Uaw38|0#?<{Vbgti&<Y6
zrNaNr;o*3iFMH-yELkuyQN?f)VCQ%|H3?y`1@re3Zyx(BGHEIFf=0j7q)l({o3vCR
zTXZ@bjME!c4MXF1Sf~0YpKEbtb&VbtJI%9fA!*L%p>P0FukQgNkMH5o^2OjXBM#&Z
zI5hI&*&TW*44}8oL-_OZ5BB(&a$$mUh_&GszU;M@F_PL3_thKmtzy+r1~Qg(VNLkR
zL#>i9ptGu`Jp*TY_jW(cX;w~zOTJ&TE#Zz-*z*xbltcnBeYuxUo=nIpCVxXM><5a6
zpQ()AlL$z3cb#p0@hr4rcHhEv17M>wj3+A#zmK5<EqwJ>v=ABDXAZ{_TJRP$9xD~K
z&oRS5Nqh;9aA*hR#mR2?cEfT86YMD>pWGdHX=IWv8`XST2ZY*y4_Z<&Cn$-zTTUTY
zQ1W63TGw_p@}Pj!keJ^+8jLG=cvgQ6`soP~qs+wk_sL-(-%>lD?`s_s^<;-=>Ab<z
z%nT*J`(?q&*XtR(<L#@{|8!LB{`$&lJyuZ9I9BH5{dowx!31Gzt0DFUvs6}FR9upy
z+h{KD&+$UcW*tRogv@50oJJJjo8*b;_!r@6Zolx6ub!EB#N2D}!Q=kW>OIALx?Z`K
z+^*`Fd--TtZGP*g(R})^4bgmu1ZHJ-(K62duKz7LkIOZu^XqGQUMgR}Y@HW`GuQ0*
z;H<$G^cA6Av~n+}$w>68<0{RPSJdH408s$hHgEC>+S#-7(eBW@6A^B+w9O~K`_6O@
zZ@Bva;XfhhyCk>W{K05tb|~?6=mvFDifGQSM+@Q7XkdorMoG?i(C0EMc=Gr7hg`|#
zcZVNd3ei-FxaYq+M#twZ=Do3b5-f@p+B(t=tSaKkwJ7j(Q~-J5%2|v!yXME{{l9zC
z`K%wWhvV|fNt;|wYdP_1ZqeC)#g6Ak8n^w}TJ$Tky(Bc5SRg7O)^IDY#3*I+og(o<
z@yerNo$jA}$wDY)oOD-jmzTP0Jto+^&i^R-FI-*^rL867IiaJ$nm}d_Z|BJ|s*nlz
zr0jNk{2+?cOTr{vm&vh`-qu=ky(jR`+VlP3Iz1{G0HHVkenig>>PK^6#t6U)CGxOD
z;)6Na_hrRD`3l@WDN^Pa7TM<+k^0{cDjMkK*{O6pLz%_ZBz0Ct(nKrh@v0L(KahXW
z6|#8Yf$kOi;za*d)a;VTm<<naXLhWNQ(F*df)6WQn<rYomTO%R2koGLi1%lo_(g=z
zUrScvE^M`0)`1Zqua{P?*9WQ}It-Nc%T&lI@jN$LnmnSA^$Hai)oiECgqTMhr3@O0
zz?XMEvCRW`79^Pe{CSF6#Xn$_hIYdvXT?P~Ts*dei4Kg0!Cj3+FD)~|FAmF{9aYAI
z)ej2}COd~0vh3U2RR^g5U67>ch2&<QL#iZr)(hE?idR<66Y|4S$nnOF&E*k8Bz{ya
zH7Jn7G>bbJy)$!1aP<B+1k2-f&y&UX2jNHU^)8?XBu3tj#j*}=cAg#>KUV)+%&{Q$
zRnN?{+bsL5W-v7|5wxu+3_o^$hX;!Wjf(p;PhOz>?2A@=<U|*g#pjaIaOU^%EGi}j
zu3WjSfp&n7wEy(Ci10F_fL{04ulpA@I>fZ8yW6?JxCU$<LFUIJuX_x;Oqz73Xn@b%
z!pF(s_#y=<Y2<s(E{oxw1N_&Y<^1#1Z*PYywPnQ00P#{*{rVy5LH1c8#hdKL+Aj^_
z^62$_^3gJ?X%5?G<9=pLsHG5-e<)?UY5X2Fw7<W0fkcx*hd-?!vfG{%-PMhSNZY&9
z`=EtC&d-vnqS^IU`{MUyEFlpBHqqjW+Q#~Z*829m9%qZ+VZ3yqLlyq^jvBYuWhiPA
zwH%St;!q}Dsa(bai`&FfSb0*((zf?vwHQm+2VlH)DH@-%#`p8|ZrH|W)!V~i`$}`O
zbLFg#k1MUYWLEh-&GA5dt;dhrcC!VX%WfMg&dwh#XRRS+M)>VeeV)r<2P~7zfmG3c
zU82Q)6LhoXhGNs>5=^(Ire-)WezIKJs@AaVEyRZC@n)xm|0dlcXMDH*ApP^qLxI`W
z&W`ci_L{-o#+KpI@|wmHZ|9JBoo|8PcrAjiaL0MZGy>Xp&Krv%$gVRdjFCU5z-_^s
zTTuEcl9~&>|MYXEdecd;|JiQ4BRfyO!)Ddq6_*@_A_M1&`shEk);MCp9^1FXBeN&5
zi^|Q+jY@t#zKRmXT>a<E8ogr0n>A&&3cugd9v&W|I$}CRIja>56^*bX;&XV6ELIbC
zk4N=p7Yb_~cG#ku(I*Gv)us;sYNN%Z%<&TW%)LnJoV>;9Ozy!XMSC)xRv}o$D}SUF
z2hX%6q;l};83??X?=PSTGP3zS-di1ZuP?06CT?u)ne45t>CUXL=r+2%T=uW8HsPJV
zuD3h4Gl_N%3ATAV7^vxAtg5wN%zhcOrSCSz+wQaw=4|zZ*lxGOw_I=i*K)arq|@p^
z4nzphuoJ3vS_cjk?Zf1CTH~o(?So2l{h)HZ&uML`msVDS^=qleBc*E*D+yP+TRf`q
zFMQt5O8q+Bujo9l+fU%!Z+7$|9(abIZ8w_6Tivg;Jv1~l5{A(N=1dz<E}_%713=f?
zZMZvF5~;ZaVdDgQU~fq8Pth~W{JYI2xq`1_1_VP4APTP5-Z1urUW)@Sbqg2#Ret~G
zGaEf7%(3tgxL9xT@z_yS6jb|MQk_*EboaYyzrhq}bg`Hp;lz&`b(N>dX0;oM0F*p`
zc~`^Ya@wxF!U%kPzKoYt^Bb<JDh|%*b;7O;o)2*u>eR^tZ7ggR^~R<n`UiZ|K)3+)
zw>4uKbmh*4r9BhSsdl2<y|ip!JKTJ`?|9_C+0VOl<`ka5-Z(XFclOHPyjZvkB=x$S
zG=7)13Sar0mzQ?6A#c>^b?REaBK&IvF6lbUBFBsB>&<SK`f|NXa<nVxJN@;cc`2Y8
z4*{SznR(*99M|G{ws07UPVG)bO;szaAhUz-z(p)0tss<W*hC;NE61CSmg~zz&ilpr
z=%)~==ub~h`$g!}a`m+pefi?T<}6fae(Y;F+29{&_Drzp^Gxv38B6f7X<vCDZxMU&
zbh#9*!Jf3JSTsU?qgYQtI5%PyV5W3Yo2P@(v69bRwQNnTP>ZZ9B)ld-Wc=XScXW@E
zIti{YqifI1(=8Od*)Aw_>-qJ&a_J0VsEi#*tBv$#1LB>j`m-FVczK^}B_vkbhhB>`
zlF*Y3CS|4tQWFyItlh1T*G*LyWXDGiRnuwLEf`9MdaahB(C|zDRN3OUeL)T#-v_T=
zP!q)=Z`s!_S+*~pL1h_#th3GFBT(V}F<;SQqD)uW;k=NmH7_;m1|;OXO*SPzwl=V_
z?TSpw&A$GpEptw9RgP<sgs!S!MrDyxXMWTJ0Hpcv6mg2lRfQdDXYV~>1`eJ<W^T)u
zGPS09`g!d=y!Bl?1&<z}PW?B1;il^H0pE8vO%5Abo~Lp_$|dp8K93T>1&sSe>eYU<
z<dk1(Hs;sN&J8XGiggq{fXwU<Yh&O0^`W65RVyniYBp6iWSz&m(nR#dZ^I>>nmp<#
z@E;RVQm2oHzWqBDmkzxp0w!vnY)}{8ti9W|{-X!9%55m3T<p&`ucEv%l*FVYtEGZr
z%N|44^nmolG}o=X#at;VDNkBb(*2a8q9P48Ha2~Ec?I4~oLomHLCUA2<f6mH^6_$N
zbjG_<HM;52GUdXLg6Zp`7ZHUT#7lc*&j)yrO^KLJ^`$O<?;Xc%YG&fUvJ<E6Lm$*Y
z?(cW~x$Jl(ZEsT=dThRdtFiO><oLK%ZE>kZPfm8im$$q6j7>|`mWIn>!)(bAb+`3o
zL+|;NTX$w+vcG;UXOOl@-YVQ|=OB8U@ZGEDES$v2ozTcbglg-k<Ywqa9l{TM4@y0|
za_vI4BF9Lsg1i*3`2t>ChFeKeIV`P3qYAshxXiRSqaf!)3Xn2ww4yz;P)S-eP>@&P
z&rFOsp?fMm3{7U2J|0p9BFQqcB=i7?K}(#HSb(X5FY9pPV~DuwKLwu>x9|JmD0tvW
z!1hz}pJLHy8{mDAh-6_TbmK%@+_nAP>FqX0kk8a{(Avg9R#EondM^mvfLOrt_GZbc
z0-i4h%TJf}@a6A+4m|~U7~!e~L{(%woK`X7oHR(_5S9@Q$|fLK3)LEDmY&=ITuvzC
z6+BVwO3=m?DY>8{`ih`>4YcSxh*nfGIIA*7clWbttcb;P!+32(>%xTdiX|3=H1-q)
zWb1BF1POM-QbHk1m}nfnXwogHW}>(N$hat@cANzpE^QczGb4OPoV`3ww8jy+XgYFM
zd~_J=rATQjj5*g5&p8~L*F_XlRs^lIQqrxgeLjfT&`=6IiI}VYh+l;x5FI>%L--7j
zpGIlCJy|S#$eh|q{ZdO#99!uvI@qPdE-@fLo*XnjA6FjMwSrsoRDjLoa~39pFPmws
zNt<)tdO2^tY_4pCP*SX1K5sD-bbEA(4$oR)vmk1*px)7S1M1O#{^Bmcy8cVU)#;sH
zqWe$Tf$O7h;{$Qw%A8GL$?^qQ$ugR4xV~)6P?=gDccw_;V(<>mnnLyRTnioo6bmj3
zgMsX92pv}}4gwU}5@DHvL*5B=X<N2>wWuC`P|93tKB*&<qs%tx9S@)277DuT$@-J=
zYIIogK{r)X<_<p<eD}+(=bA;ZcC)AdqeOwqB8r2zy=9w6RoITObP0s<LPjK&glru-
zUJxFqb(gy5O_`(5zW=bd<HWf|*p>MaPaHFmz$j}y9pA7IXfFA_S7&e#ujh|3u28t=
zuGA%5=IE)W$sTXfC<?-44T<!xL9fOc*YzrPy}#Y0#}4PB6$bcA?@8r%<8jT=mg#c~
z3o0!>FZQYdqHhMEKV&<a+B?K_0fOGTtPXus>FkSmVcZ;^+dJXt43Rg(!&cuVDppLe
z+-Og~`xKc{6cjn2$bCRy74D1%!x2i`s@PA@eitsHF_?sHvK&mN*PHzN4n|EspqVy+
z{8K6Maw5N#1KMr46(TF<_6Is`#^e@adKjfnL<q4v!5t1x)%r7JWJNU|g-FJ~`w?=`
zZt!N1$nvh={K5Cjc@z^M9pRnKQ0Ctgots*j3ySQc6<R@zO9ja^#aqB0$&8S_BX>JY
zo{Y+6w#n9q{!G2)|M-V8z4T)JxoSov-M4e??LWsQd>WD$UTOs0w~K*qZuW2O`<L*?
zPx|HAo7r4RffIzG!R1-K-n<Ts7RYq2#t$6<Wb2sgUs>88y+A%AAT=Sm-pEqxX-?4R
zxyTSfJmBsmHzt4--;psz@&gOr%^67BvCF{ASZp*n=f(o%?FS?TNX?ZlF-e1CcQCq0
zl}5=Lxp4a}xq`-xOTr#B!!BVEPsDIHM=iNflZK-uCa3POjAL8t4$zG7?_Qyj5^hH=
zp6*6g?mnJb3)6AUj1tWzf|W1C{Zx!Y{j?`>`4!jF|AbW`;G*CK5NV}@;u`jyHq4vm
z=e7)dhZ2UfYn!)FL{K#%R%?uhdZ(ePQ@1j36IU>tu6_Qb<YZP(f{OgdVzw7;&N6}?
z!b()?nv=qg-covTM-Mh_s_>gbH*V8;6#E(R=LaY*J>hpbny&!&Z^{#%(|6e!SRzH=
z8O`j^<`R|BWgqG?d1tEio>|Vw!|z215ItX7R*Bgaps7vXK}{NPvQ}`jC9=0Pw>Bxh
z&Lr)!1|;3ybbP?dqz*=&CoJ_^%o6FDn3%}Bo6mUI<FKHphUpI}l9|Tb-9@6Hqf5qH
z!R3i1CaRM1k4`kP-@g0pO+JX}iwcd?k3p9oVPmn7Z*^&gc~jugqXVqGjGPj9W>XvO
z-VT6zZ5HeK4kj}M<Qj}chi1-B(&rubT0@k2wJD6Od2{3n6DzqqzTcNU)0h~y&*myR
z`t-lPk-$4KSeJDdw9v8^A4DFN#r<=`iq0*~sBk4DO5K$x<F^!KKf60TH@X4<Tr%wQ
z6bFt-xn}ID{=XN%m-x??_mamI685q`WT9CX>?lec<$BoOch`~j)f5ajvU+9+-ub@)
zHqmN=m`wwQBtWB=zi`$`T%4JwZ$At-v$ncBlb?R0OBF<ERaVN8vz_`YGelfMP6FgO
ztrdk3X=IN8N*!t&t20h9U&xFnue;+GWVZH;5s=m`0cKq*66pKyvjf7ze+!mP4p;s=
z7sILWpQ`3JpTe<mcfTG?!}i$g>rWdEHq`!4E;X{oWQ>M22*EuN6Ek(8?qs0>j;6M(
zKq7T=vMePzg^j#TS6@q%uCg+(svt|-%j}OOrdmo-K?Pc=YddhH?h2!&G;B2K61$0k
z7b}4uU??u&{vReDYKdP}R~OsZ!~~r<JtJdjw!CGUk0?v<Nm)}>u)>{y+HZB)m^zm+
zhfU&xbIglWIm}igJ7y+Y@-2bxl`mFz2BUQO@>x$&BUa8VW(GRa0S?P_J93M+SF)q%
zZjj=Ohg&nev{Kb^KJ!qYAgFF}u`bJEX07*zgf4_PY}q;42)n3{2WGctV}MuWv)7q)
zTxlKQMcN@hjhR7(%p}nt_q`~110<MxFvrEI<g_{X=8wZ642WxbC)NsP4!SF1_QggG
zM!gP>6h!CS+Ry;yo3&g!a=Xxl9w6<e;v<k_->v?!n5Ow;z*>miLz(a&dkh>iRL}ff
z*e{W?8eA~7<z^Tb2vBX1E0Vq=&`i)Gv{#uRRk)?kZ?wQtlF2?zu!V-vcy=d0kiZWR
zH#0NN=86hD>j5_VQ3v`Qcn+u@0Ur9GN|@+kO3R|MBAi1xO=f%QwPiCT!$B<?M>TC`
z$lpYPln;MDq(xJiM{7$4{*jUS3PR$33?%xd+!-kN_0%QzoW8OJ`0uDCfiz=Oc?FIz
zBR(Guh-iT=kOry8o`t_PBz}P9=T$(AbiE`cj@v3G_ek)}qHied6GZILrKhh4h7ne;
zS%fSmCv$AH7OLC)R4tz8FwZdCi|#%LV19N|l@Lz1tp2)VMINZzFygjR%P_EB&R~9v
zh5F2ro*g4g*W!hlP|{Kp>o2M5QZcoF;m{1bn8Qg+2BeY(-jm1#{f15RQlA8;Ckn53
zMY26>QF&$n)ratLGBEndGmHH~@6RhLie@u0H#5TwWi^kLjxzgfS*jBNS%TRhbA%6+
zU-L3PQF%opC5r<1CP)RQRi}OtyY?Caw!&%YLCRs;R9dS0YA`{yuG0vVCfUsLvm8Yj
zGsMr)f^?CFyg(#ch5E}d!bbpJ=qsokben(T{ff+-MJ76z$63{A4P8KHb+3!6TI0Hg
zz}c9Yr32Gh`cj&tuOUexefMxYl)mJ+lGwb}TZxZYAzZ_wii*upKJg^uN0?ovkZ>Io
z+6?FL44gNzJd9`V1Gv8bYua7a7fss@g+*VuRR7ojmfk%1&FA)HCAx#$;WE(BNLe`%
z{o?u!G$D#pK-D9VnV3CDJT=somFDP1!n=wPtizTP^9RF4w<EkQEv-XGj;XA9cITF)
zLd#wCn^0pAO~p;X74mzG#EFyE!^apKO>V<3+Dz^qG^%@o41pFEt)GmiqoKhajBE6u
zDP-#@h|ASQgb|HEs19u@7KTI(MEC~jV6fdOiVAxX)-3t&)s+Z!HC1`UBce!UY3Zg4
zymvN3gq+mkSM2ax=hMOK!EquqlvMBlE%n)zyF>`K-&B$;(gk@iT24X=q`fT6RY#bw
z()ys!kq~nEH=?Fn0w2fgO)$q`nd)<2A1pcw+J*?gJ-ygcUNSv9X}RA(G6r52O+jk?
z+@@c!FPqNaYe)RdI69FHcbTb!WX<fuyT?0JdmA0i(096Yc=-D~G!U&~IMI<7*nc8w
z?)^-zS~?@Ax{%gu{|O)2J0IM*kV&pvYsHhXySAoj$(HWVaT*qsn;ug_53_JuXdSIc
zvd+by{QEbWoRQLRb%h{2VlL%yrpmkwx(Q;jFoZ(bSSp1q1R!Y}w39+_I9!oZ=ln!B
z@2F)QI(_imO|OAs^mh~8h`0lhJ~gdPu#y>V@SsM!5ie%X^=X51DuSoin^CLVn^E}6
zq*A?_6bR5Mo9M6y%QpMzji-WY{l=QO>VYqfTFQZBK($t9PL*CO=-i5(rXmo?HmkMd
zK!k8!tU%%J`t#~UUZL3zPb|-M8e<B~b+V0l`)HsQAMIdP!dwrQEco5%e1mMYcBL|O
z-uP>F*z#_5J_>0%->_+RnbLA*S%h5_wS0c-bD;6efV;kZ?_eH&L#soqJncvVgdKO6
z%ZIKz190*B&l-+oLu}9dUIw}+0V+D)yKM8C>xsoL1OI$d_mb<pn*Ni;N&;eVU^vQf
zzkt#dh&sc4;|3s3wd$mr-UQ)UD^QPTE=XODXTr4_PX?mX8~1b0*!Qn}%=?-;OI15<
zHUu3{^gIR$JrqL9TX$hw<-5V{yRY2aj#kPYACh&9?&Vd-hNQXsV-BbX)|?KE9@CtP
zd>%DLF7VdnJ0#r2ELLfPBLR*|fh#RY872hP`SrMkDC4&ssE<c+%pVyW`H%212{g}W
z!>Qyxpls`5Zl<#O0;1W=`U=!1LHh3l`vwHIgx67onVMlwyaY@LzY6c68*E&qL^L!W
znMXO=fL&L^4Gnm?3!ZTX*x!FPnF<U7@KB~5w%VL_mX?-?%YRoq;7A#=<>wTI6cth2
zVjhN2&m#XRrc_c_gB^aA*3%M=pWdhD_V*?;A>wtW*z*6lVhQ;6b-w9-8JI|+HyZwn
zIk&kPCE@sY@)vIZS%q4qWBLp{)eQVc<j39}54r7oA2>3ILlu*GRkRLsb+`jQKa*YN
zT#wMma(}DfX|GK5O2E(83;V$)ItO#L&C~g^vCiRlZ;`I<=<~_N-X^(SW)tJ*TjGcC
z!q052$&bt1{n5Xlqe%d>fx>m?jgZKoSH7ILeyGh8Nb}ClhZni+L~X!c(9zsxXV%{1
z_s8AZWLm<<wGN!+Bw!mj%?{Tyv<{?J)RhFE8$ASB07F5G=iM*OHkLIk22GKhJ7Cwx
zKo+md*yVbo(MpvTi^&K=+ewa(;YO3yVJ!c3-t53qx$4>D^QHs!0ET_%6<6C4Kxb^4
zdlw;zT2X?WC!50xO)iTk0SHtoxipfE)A_=3HxG|NAQf=xva-G|&BxE5UsxE@)Z8p;
zV?*Bz0AN{KTa(4a#H7Lh(bm%=L?9N*0)ik65g$q{9BKI0M@3Z?+%hF)?I)OxXu{j9
zs0pJtR5q`z4d?IQzv5qnqI|5hkaLxTw$dc0*SNXy;-!FB@r*=nN=`zyMrRnX##>I3
z1~&-1OUofzJ@+;e>e0U<@+ehjY4K2tX4w)yy};r*KPD#T+YilW)VW7>jrUi~P&%8L
zjJk@-!eV`WJ+>NM3eH_hMh2XhmzR=~irhqHC5;HV=7F!MH0zh{(Cl4}GP%)6Rr+JT
z2{JC&@J6%E+29yBhR-Wc9~>A6uaarsV4n<}9GnPUur$wJ!lr?-UtbdUcW<7w0gga~
z^d_2-kLA~b-Rn<nop5!)G@j{m<$ryt*MqrY?shni|DJSOY;m<ZTxnSbQ*RR~WyLeO
z9f&v~m_WPArgH={gK@xcHXhFwY2&y3UbdHjRILPJKLR3X^m=vc4&6pFEq6kuLk<G>
zHU}(~Vh&6am3$tT(?3sZlM&ZJpmu<bFQ)M^c+3Au#9l(|bae2Qxw*GQtt>2vSGTvL
zW@O;y)jL6Oa4f0fv;LzSV->5zXETMF<_s1Y6^R8U2-Yz&BE`VKi2wZb#VeS_hhOz*
z*A*QZI3`4rjOWc(7)af`a<5yrU8+*A<e9|>=v1o*t8VGfthMX|2!kg{gP9*5%zL({
zurptJCH5q+x0@d2Hd6mE`NGUZN3ys6dc+VDs~ZVbhgrh$2uw%-w(4O=-bv32yq^}9
z8*qRB*EQSRh5C-3Kj^Tyy-k>#kWkOc#r3QTHD}(KZb$^#m0wW-1`^Y!8=UP9vleV2
z>S6=m?sjfhXZz*{ftZdO`~XyzSBZEkDuQR&Fo^MV24}JrZ9ShZwNVs88!WV8D0gi8
z{QH~9od{iW<Ww?v6^UW87wPR&{ndX5o9))i6+$G;X77^##zMmgRZxU8Y*_Z#VP%pm
zP8+OrRuiap;NF2TarD@B!)D`h-n45?pj9pDljq(RUtb4i4=^T1JW>n|b<fZ4h7483
z#eZO?qM~tvI=l(NP*F9po6pbBNh&KU$g-5(NAOLoIXO9bn3-HYR4c2hifm(Z;qoLW
zCMM#ym2ZJbd01j184VLtXh8uO4Z{>QB&63=T^0r=CJF;KLMy0lZte|m3^Fiq9AO;V
zA~g5?%b#N)gpM5mKYZnm&XGF#Cv0>7dFW!;mxM?+e3RsL!LH_53H1dVaTWd{6x<eW
zN~X`QbraS?Q^ND$dDx2#((tSvWy;0HMcUq;3EbaX7xmE&39hA#xv>wQ6fB{x4+|j_
zwZO*8v;ZX{#5Qw8EibpZuc-Ez1{Mdk504*@R_WmMp-gXds7$DNJ!{r}vxRa0VxU*5
zwfES7qM&o316$v-->`La)rupd*H{5!DlQO^kRa-y;#+oWL|aZ%dJhH0`Ji@9#Eyr>
zpe^OL^Wo!DF7$Vg+;@RY6V237Gc2#$^Uio-aZxPD{CFze@g&<LQOCahkN-QV&48CV
z49BZhgyA3vv@krdL>Dn&L1vU2c`zDBZOOgkNsbqd&y6$^jT@318|wE9PU2QI@h8hP
zEN}!NsJa<bGRHnYH)VQy`qc{d)oNUbIl+l^5)DB#7WZSy)R3y7?)=;u&KXQ9GE8I`
z2ao-ez^sqbqPV#D--)%fG_28xklvqz_{u)X*5Zr#SH5+w%S8<ysQ!aGvwR}!OHJK$
zO=0>$zjfBOgNUa__xrHu<aCgMKF~T#0unL(9OM{BDF0p!2m_;uv}%}<D%}Qs4hW}W
zH_fm;21uuV8XWkGAv35c+iZ|E(JF1QC73>xf!8ODD%=PcDkgXkInXRt`<$2;qiuKU
z6gC!^u($$K<pj3*42(7{Q%Zo&KXlj$GF=h^NK1k%XiAiRdU4a0DRxufA+uLjQPJRi
zj66=WhWlGDb@!=^XUQFBN=08^NTyP~w_2r~$q0)L;w(8C!<Pp}s0oH<Ok!>r9u%q+
zW(TGSrbjMJ1TbZlpWMu(-<9T%wCglVh+&F)i_&xpI%4t<JOY_F7!#R9AfhfDkn*rM
z1fIS`Au@u44^B}rIu1%^@%Y1@1Xkf{kV82U$eh3=E1DooWkYTt+#qe5VrgbZsidzj
zQ(aIHjc1Z&%fA)YNFtI9RuqhCHirPVNiwI-Lbk2}xAsVsgwrjVCXG{P8BN-Fg#jr4
z?87ygE0FF_g?8c{2SYqbX-U9IFgg$joCI}4DO3k>(8o()v;bjT*MM+?8UZWBijk(W
zUB`;>EE1Xi^{<%pRL1Bw*$rNcgq4ShmiCV!pC$n}dJt|YO-LP#jOk9f6)p!eY*-O~
z^zkG(G?FhhHMIqp@ygRcum6otH~QaD{*}+OMRr8*uSqA?dTixuk#%xT&J;Fi2ut6*
z_;S|1!SI@%9-^Ss;JfqX%JQN>kQh7~!2St;Fo$~;3H$J@C4@!EZvMUi7&>$rnWKyd
z;^Y}0QQDuYLlC9%D&#;}K*;$}IY`^TQbFVbTb&jKu&ICbo_l~XsDDCi%t)w1e^MbK
zFDvM(uxIhV18jwRnq*+WEo-t!cw~!%9Yyerg)qvZE_g(+Mbo({j~S{?4B$S$d59s_
zRQgg9*u_x*2|Q)e>+H-fQXm-<xGEsWff-;dHA&z`I}{>}oaMjKD0FB7nIR2vp$LWw
zD7~941!ztV4<klJ1CL{=8=Nz@rHhdvl&Nf3Mi|Bs2Tn*)AJSR!%nf4*!*QmwGHnXa
zOthfM!wT5@MofmwIeu%;TXGoSA%qbF3z5uU-uni<f`W%Mz5&LYgLdJ<zU;*ml#F$0
zQ@K{Ztuv4oEIAhNA&6BV;3qs2L|0ct%)B5Gi20(o+(xtOjJCZsTg@2->OTG97RJhy
zHU7(!AjB+&yL3cNWAVF9zor3Ugfx7nodHR*h(~j$g)VT`wupB!q@QsCp%1P@$V?F=
zT49FnvLt;z>CdvNyM)9Tx)j3&vzLbL;R(UzWY?WV0L|D8+xzV)jYetp3n{`&L=DW`
zoHUkPhKeAGN(BV~QitYJ(pNQ9b(Gc;D)^wy0ZVByR%eWwCYJs?$~-Zm50DNu-DHPW
z!>&9LDt5M#Pk{;>5%tc6d`OUay~%4;x+hH`LI^SDJf1TouB;2jp3x=mFl1^5(T`V*
z><e25BUwd1X&us3Wt&lhlhiRhJe-i0mL_a&YASI1dJs3NNB^yd{CVZ^UxIzyMJls_
zezIYta8$cbvo)gI@Z{7K1}J2I5SW%cXAE6cbq%SD#cU8Xw{2)jH~rrC2Oz1ra$eCB
z(`=r`Z_9O29!C7p=oq9G8RwxPNJ%kw)}OZ1^Z{-veOKS96DClz#YJ`^$7{}PQ<`t>
zoj~^eS3-*@*)YqxSh6r3UHlWYW+Q?N6~SPM;S8%a8puuEy*SDsAVDfPtvT7tMMSP&
zbKvjC7`4j55uC#FUQkz@Z~qlJ7)yf*tmgw^D5-py8g%^yO5XIN)kXph^pZ1!jx`%$
zBpJ&CUK4_g`9(w`5~JC=K;z8#ctV3c*>asrwR=VttRPQl)~a|0DGF{2MP^>wd&(r2
zG(Y?>DC^XnD}?7r0css94^$A}=rsu}ZFwI1zJD4z0km4|n~Q~o#ZmJ=1CBO4=T6I~
zGs_*Sw86ovXU2K!rvO|Yny{R?p+gF+40*9+Eo!o080*DTrr|?G(PtD&<VSH4WUyqO
zwBw1FjY)7talU$nK_u{o1`(nH2C@TDzF&obj4bx`{*>zy8|m0GA;`~RN*rX1R%?>~
z3@>@I%%{P<c%B)T^Lcs2=xicH7z>qOjMnpUTB9Mo9HsctDV-%Xqk=`DK{+yKJ=#cj
z_o;+Z@dauEhx#QNMa2T$`Sn~m@R2R-J43WXFSX7w$x@_(DUiwu$T)M9Pqe}BCAGav
zPBTV9wCDmH&y<QEoXwWz=*2;-Sow+1S6+<`t$yD@<^$^nnhbYwPtVWR?@<A(m|3;q
z7ZGTAiaEYE>FWdmnzh{ezfRmRF7=4GAuZ+1#giygQk45d9fxB@T=B)OyuRL_rjS#;
zUGp3+f#-s<56s1Uprvav@yDV`(brk6AF+rKpz_B$`e;coKpLletzUVrvVSV>uW>*x
ziDv)ps+kFCAaIlgNe^zuC^8GwZaGkfDhgR^K~RDQb*G63fHeO`N?<!9DPdSHHhZ+x
ziU%a|WALG-93u6E)Wv-eA}@>qz7)9c4(3ci^N>#G(DF)-9nqi`U^WywLwJsYGA!0a
ziAbGuhy<h#d|?6sHH9BXaI~tbi)`X0Q=o2TS*u2(8D6n_vVp}4!yPDP%J!m)s8CBh
zJmLBdJT1V>9<!W5S5HH`7xV2j#c#b|R}RZU9y|ZL6TqG#BL=m_65;R6!WC2Ffl&v^
zBC5fGU@4*`(Q9}qBAyQ3k0;1i*BI~iOlo*bgcki)Khq`kqzT!F1lxcLV&046gmEOw
zpj|S^QuXJaZy!_}DY<yBddR<ciie<2rkg!kK;rOO`5q5;v<R~Z>AyHc%Dz~oV;I=A
zeAjap20p2k+fKbbC;syG?U}rK()l!@m_51a$UU2oN~()6>Zd3`$HCLt@89RT2+(Wo
zV3WhTi&c$E5~)c1QbCENVxwac5H>^PuF$4ARGQ3Cb0qoEF>3ieU!(v2HFU0#bj<JV
z3J+Zzcz;SX$2JsGmS)eNA*8ZylY|8u6A0y|;x^XrpYS!9nohyYoo)vi##G^L-z#08
zo}T6*<Aa+-0z(lZXq#ArDXv4@1*v?fahJ0p{y3LW3^I%nNz4h^)=w(vah@4&uN7||
z;3+}fcpNQ{3Kh(aXIyNe=m^I(o?0?lj*l$KWR5^8$;NPDpCV2uhk$1m3SJ`Ky)!!$
z+DbpJgdu}zGjiJs+#K#+0!4|Q#fmmlJyB4KCvRq^e&O~`i7>*b2>Cw|3qJ0DsP39%
zN)Ko-$IT_{{LS7t95ly?5`{i@36ey2dWyD}8l(G9?!zVzZekZyh(tIK*j(Cd{u6Vd
zj6qv-7*$p(KMN{&6v1fFQBz`p5_S4bmZ&k7Vj%q_NDAkM`h=nknltod2t1O7l(O4r
z@534CfGIaP3Gb;qJ1=Yjq_Py8CNv)OVi9a!#tg`8sbKwq^BK}UUMT|rxHTmspKhrU
zje!-GJtL^qe~QSsScEMHECf80fv&`TNb_1W7a5Y%7kS6`B$@6I9(Wss(b7@b5im3A
z*xF3>9nNAwuJKrelp*S17Ci!cigwMa-8ezX#M*LXKH`&QZ=~I)I8i)tLQ9`xtW%uv
zM+2>zXpVb{y}*W6{&WMkqE~DronEBRn2qcr5BpjmYv(Cbx#IW7%dq|>r8o%#M4NyX
zQnaA7G(7BABZ_@A&yZL2>tJ{aXflSUCkg<(f+o#bljNq<zG^I#GKgM=fxn7jz^h;k
z%&l!kRVXnY+>*-fF@fi>0KCw&kMsyR604fRNqkugM|3nFX3aT&$2pHM_`jFZgSxoV
z@I)%c(E=|Ar0`V*(TogwkfnmDe%yz9l)#K&pu3n_R*?R;7sNOARFf+qHc_s1#R1*T
z(uGy4C^=CehDVfo)H#|8+JoUJ#me;?w=&>%Pm@450|5`iW!}2k?_v;HnB#j;tiQPT
zVmWENCD&y(%U3PyeU^s-sVAMKn&eny<T2d#5ECzm#}&qG(bt)XYxvf_L>gX{RaAuT
ztH}Z_q6xfO_+A3TIh?>SJej{J;ZHQG<oOfn3t55-XL2CNY!;@Vz%MTk8i<<P@A-mJ
zNgl#?KFxTK@Wje&gb*YfR4KxJJ|yx4{&z~ZF%Zsds5b>4rE8HuccmL74rF(NjqSi=
zXNc%G$<6Gk;9_J-MD6ker65XrR_paZ9H=E={)v&LtauDPe?$?lL>Nv%P-w2rso?a=
zbZix@Dt8?E&Y39t8@x_+-dLJvah;c`RhVa^w(i05)V)YB$@zjRCet-lz3@kuurwc5
zk!6NRawShpG$nO@zv8dV-|@PR{k0&e#^QW<qDlYo4i2aWl0F1nw$NZuFoH!xFL}UA
z!ib$I2p@qC(n&gMH58*BaU!Ga1#)BWQdD7F>EGx>Qg4sj>`;|AG3o2QV2#5y_FjdW
zgLtUS&;-E&FXzxi0na>jIOJ5IXG*7|REA3wC`t%Jl_HYKXmYKf@PKIFl_p0l4q}M@
zk6gqjn~4l(242KZ?HMJoL(v`?mSj?fNI)t4j0S<$rw&41C65cD4<ns(Kaj5qim_41
z5?>&U1&{x!b7ZN!EV8j48?}g4j}DBJPn2XF=-B+U)pgxXie5b!^9b*5w2>Qt#dS4r
zm2<9YZI5ANIB~c)UoQ>lLPq51$?(OQ1U(KD{M>UiH>)Y1$u2&eO2C~p3|x3@GOFZQ
z4tWCmJ7a)&f7(Zrfr5v+;e10CZ&q#-iNh_Em&^`fLw3Z10O5Q_qE2=+<T&xZDN?%B
zfD!^<GJa0hh2Bulg6}s{x||moiR`Luh+5J9p4>zpg0|tTP&jm2B@q~BjaW+zVboZG
z9TJ4@QjOkTOM9P<2Q+9yvX<;Z;ynrBiiUQAs4N4%iv%@AB<Vrdp;PxEGF1?Z`?PPR
zRgtkf)3iYh`Jg4sPk4VQ5efD*)C2qfI-EZ`>YH|7@nbHCW*mHMb=2)8u0gw3M4GG#
zA<sWQe>u5gEtNvP2xPQiH13i{nKwY2w~A>90K_9f|3+`+C%2L(w-D5bv7#9wQTjYW
zpB5)Xkh;0H|1g6u$uN0*vMm;W1Ul0QTb1`V1$#(RsDv{V#)71MKs1lJVTHk)?(-pw
zweOEZwm^&%8S%lB>V6|B#39M#P*8hF4Gx+GZ5)H;F3Nr~?JkR8rGjVKZy3R>=je{z
zAO4CRRj9H*NBpG(CmR2J#3MFAh&CH5L>RPRgak{&PDMCW*4W@u{*i@ImH^vWHuUZ3
zBPAd_#NfLoJ#MvJV6<bMz4wI*tW^U$k_;4cg#;-HzV$pndR9Vc?KW5D1XR!~-#~&k
z%D9bwVFVxGl1VKpmpHKmPQdZWz$1wbIdhR4nqUdY-9!cs24+|+kvhAC8W$uqY+v;M
zC3hNC-AWBmmI~ri$-Pw~{F6|`tTtC<#t62`|6hP*dXaQO-Kk^Gyt8&wfe;~Wl=}T`
z{9-}zQGOBPctZm<^k`8^^f<16xG;&6CL}X*Ys{LU`q;CXSOzm;;@4SxVlJZ9oBG)8
zp-3!y{QIJX8)`tySlQsal;r7lzbwIiG?=@DIoFff@q@4UUI8{--jVL(`&4OB$s*E!
zSjCo&ykOw)r!i@bc*an}er#7QRy$I44ZUcRbI+@29z-=xCo|bmPTE%wu5?$W65Wv`
znx&-{zeGh*2~qL2IKeorm#VMqToFX4C>bdlq2;9Fj1FN4U<87X8O|5xJ>8@p^?0j!
zRA38xL5Q5bKBFXJ-{{*2o<W^(u>}%1=^^WGwcwAyv?z#(NWrxz%B4~B-gJo?62gr>
z^UNm69?wb82(_i7kZ`?lsx`tx%^J&owQmt5bZn2G&fUWT=00l#9M^#AWip-q)|Gm(
zh>vctP1Lyw-jYDp%>0bkISHR)gAV4b->}=OZzmC6r9U|m{T0NKYbY(9izSj43T8P4
z9=!gvz}`Tk<YG7hg%BaL5%1hRbMgPZ0H=$h+MKy=aYr!y`Q4gKw&w<RE^|{pYoij9
zti%K_C)YFA@0PbJH3HV=e$&wLZ~wawbkWj59J`vyTyUBHS8WkBFzT<&P{JT;*?ipl
z2<*X`2*_ATJv(X;o}dU$l=)?%#R!2?_$AC|#+pkJ5s~sLvt1`x64LvR+&yfuJUxqr
z7Gefu<CxWgvz2r)5s?gU(GeL|v5Iu))c*k`LE65Vmp5cRJfiUG2rGBUr6`q=I)Wq)
zY2N5?k%e;1St&)SBm-WbWJ;pD9cs=PD(-hfjz0&|^3ou+A`_fleki%U7K-m03MJF(
zNbzlT;O;7eoN^arxvb!{+91!W%%~MKX>p{MC^hLmpe+D3U}qi!YChMrB-Lps508jI
zoDZf!S3Q(ln0p?wYD|lon3zoE50y#-su<O$rA4JTUk}ycy5g^tzDLsAxqttDV|H5h
zliFC#CB4=F=$>b{J4s1N89}d);*v5PR*MF@+;;m^I$Db`QVVt}5**D$$|9xU6#<hD
z$842=_G{@Jl-4f^bWsYp;oa^c4hL80ETn8&!9O}Ej|U%Z7*6hxW7Be-h%(H&kDqj?
zL`vcOq9fFzMP?nsPg*XylA_$9<X$J|Bh9gCajN7GEtNsI&O>oIRFeN(hZF2xH)MHp
zAkmeKAWb}D@=3|vwNNx?D9N8c1d0|mkkWZgP<&e*aWob}hCcwFZmXzK_hHsihK2JW
z&9iCQDPz+(O~oOy%<)79sFjj3Ma8U{KFzZ63I5u&P7Eo>&P*J)5rG;<E=M+vor*fG
z;R~nD-4hD`LV@nrmc~@6vQWo3b?TJG=k)C`>r9stEQx>`HIA@QSXhkic~ttq&O}US
zdiV5u;QrpL;|roo9%jXp0yQ5Z%>lMzWMMyZXY^MNiH2qO$<GmrJx3S@PC~fdMZ}`R
z_({tqRtgna7%E6b!NVh@M~9MMv`n6kaPD>ybsC0CtQ5kvE}XkvpZpwB5ax!<>gyjJ
zEOoFX|DtOhE3<puB+FxiR8IzElx2f=WImMLJp_v94<U}ZWsuub0`{IN@b%O|(LMFx
z8CeDyMOMhPW`WBlAB8A0plu(YX^wF#Y0^s4hsdV0v$LsRGXqiqsO3CBqV=N|%Mp|r
zW9R2_9qQxAs4+nkewpC7is+t)o*zcN>7v`|?u{hx$MwM9um=bS#-a8(cI;T9*WuZv
z8Wi^xGHR4R5U49FtC3ApUuuj@#4!=4&zu3hD_4k7h&XU6%hkaH7z+#MlQ2ces3BCa
z$=ArFBWi;}&`Lxsnt`y=uwjv;DGf2|O1O^0Q0{eM*DJZ%MUhNN)<O*~i+~$0G(23V
zVLuZ3D|&M9Kr9z!C}qo`Mi3Vnwbum*)Yb|olyp}>&7H%cWJWD`=9YqUQ5obeEr;C2
zmEc)46pH6GfbYgil3nJ6EJqg2peM~KEf*#(W!2L12s#df0GtDAf;m1Ipz@5m9~yPY
zq)d2Blsp)F$8zjY!~q2muyI^P>|evkYTBU~r}@g|aIK64Gp|=Ry|5cg%Oj=oXU?2S
zcDud1)oSfU)OOI&&84IShu1>D2&5-Pb~StUY%wAcr#LoZ6doNSqwXi*Dy|O!`ayZ0
z*)-bvW!fF7XNPp?ENOlY*-pU-a!3c6v`pIRCzUYzk&ZO1hlj$rgh5e=O1U~h<?Y~r
zTCUSDoYWx>hZTxZW3YtB>n9lDhUQ`B@>26TsS%&k4_*hB`vd081FtI|img^Cu-T~J
zv)%23Y_A_Oeff~-^N}2nI}jRf%OQSS78E#a#BaBPJ%@IF5sx<?v?T^es7oQ%$!^G-
zRSDj?)nJ=f0ggo_;9gb&&gBK*URFjN3o9XiejSwFJsgrMvmwQiMe9S*XMigmdMk)g
z+ihUA2d23;D;mLRpOA1F_KbkcKpvOrScx_pWz<G)Fn|!=8{u5^LTcBXt6xxfI{H)R
z*d5eZs#UGV2zs3v^jgzbE{A7zq=0(e24RVmIY(3Z;lqbhJRaY(YPI$&C7?zi!H0Ry
zoH-&;qx^xxYVlqjGEs%H^Iszy?h_R#1JqI1ujJdU0L-DrIP5d9ZkVJ>kw_j=`GbT3
z>OKK5kuvTGT<&O8p+aJ%kZyRPKsZv@J3;c`$1x0<K#2!xuh$<8(i~7LnOgvC1nE2n
z4gV%~w}<3-eUR<*LAJ+DtnNVQw;$c`>{jsPW`oOV1+U)&HouFcIkF+GB^O+i3ZQsa
z1r*G!1oxZ@@GhtV*WyCRo?{2+5<fT=6@a6s0t$NSp<+fo*jxON?#qQ-mrDxFLEtO{
z)Sv*=Az3tnGusZqnU&+nPX>8yIT9d_xMNW|NUjv9vu!j_H71fH98h0!+P!P91s@~E
z-><vJ^2CV~X<o1II|5J>IiN;>K_HknZyxPPM36?CFkyl?_^eW}hunOBSaXQ=eafW3
zES<mB`X%mlveJhnfQ1L?K0eZNtXYXwD}b{in+~B%N2E#1g?~qomQ)(RqQs(QHEB5z
zma^&y5-cf!bl;43?mY0i^AMZ~18Mw>mT1sY9hxQeCtimqFairLbAa9B0Gr!R94>oc
zR2I9N(1=4f9>+;?T-lK3&4jE9D>&=@;J&RKie}bA-t1E1pIZz?i>tspw+KA*Tu`~P
z49ZrPf_HHNco$WYf}Y_}KD!QzCR9OMK@OzavnbP*8BR+Xu$4O!`Hn)7IkPfc&w!fg
z(`jjGA@$`bnX}?LJ{z9|s0jzuJfkLht?4oYY9;&&*Qt0-u6fbw(Q@l}p!Rt3o>!~2
zm$0`~0BRxtHDN%FK!Kfy2++ciTV&k0aeTh%h>|Ep!HmNJr)(P1NbFkb=Ohn499+tt
z!@AssOHV2X++hGZh%xs!9Gn4m1YzN#tRYApeE>Vsq)JL|b)h^tWY)=!%o2${jUXK`
zA2kGQ0jLR%ZshiQsIfGpf)R`yq`>U<(Xspj3I847bXfze*=`4~-AN+|G5QdXY4tfF
z*`EpVCFx*o_d)p`L%}y^D7a@<P;ky$kPp7u9^#wjfW|fD<j(Kk2pya1p=enl_!d?|
zLC;VM>Xmm4BN=5mkm|{zAj|tsOC^v<y+8Po$9b;~Uhd#MK9Ef(B_&18jwAH?2s);e
zQDaUKoJW0J0BRy5eTYD<gnyCZW?1}<=79alsCQx?GU~kVYcx6v)M$)R2lVLx&>$G}
z^z=}m#$-$g)}u#{ra%-9s3ValuEnAR>VDU+6s#f_VHg6KNi^DY6w!u?qkzk>W<`eG
zpD4pnKrNH2BPftXsWVW@lEZBiY6vYExg%((EDSh7<A9oiDuT4b;|8Y>Q;|ApI#RpG
zCYsY@rD5JEb>w<I#EwAiw1dZC1(Z4RY<6mHYaj<lrrQch{%n$3YbVZeC6GU@8uDgT
z6Wjb6u+A-of@LL;x5x#qX{pe>x)c`v#{^jR^IKrb?sh1?HxJzNOTa(B77AunL-q7}
z$QWXU)WQrZW!M~cQG4bYHs5imkaVe!#|O`-m4F)Abb5L^#K+TQNznjxD0w8L^uf=w
zC`bfqWYZyldR??BHLev?!&VZ_wru{)nKK!FKLzT`=+=UUK+Qn9v^0>46aituf(2s!
zX=KzRM~)0BdqgQK$bopM{lsnMz&KP{wDl`=90uvp5|EY)0hbL6m&<&okgr2lkB&4f
zJi?){Xy&|dQHGogo}%m#Nm#gojM0ZF^AUuhwpGg85ia8$=GdTlHe6nUMnT%`r6BF_
zxQU&DbigP;QzmUAPLGwi+&0Mec@U@pff}U_uiZ)VtWNOfI>19glIH6m8O1ip9^nD!
zgc2y2UJJfC)!>{}2HA5<z_p|VoISZDe?bNr^H?=3{qc>kX8&YZ@!}*h{rjV!Y^fJq
z^NYaSQv(HaYM^4~aFRLPN(|n3$j;4SV9kJ9lsdTJmXJx9IByQoqk}PLUhd#K7g6>w
znZgcU8x0`$$($#QUM>gJbXx}0I5IiQ;-}RZ2@llQ0?7Tw-|Jn$o;`cA{QiO;2tX||
zYB``@xNsrifEqeGJCzbFMJg>s0^*UdU#ScdPWp(de%=*N!lLPaRT>(Lj~<i*?NHiu
zDF0}gknm`8M@w0BScyX_cZ3-#D{MeZsE}_Zpk{eFWY~770cqvrjv)VNpX=%f;Am8b
zrXY=A?Ij4<2*P%^>uTO;YBoB}@!5#YgK`K0wHv%PA9$=@aN9gI<6UmP9dfGd;OxwY
zf~i$dIJ1hlXOw|!b}4vzD#1G6NAj2DLDAA|=zgLI)*hM+-#R`8R{o?7*6tre7XNe{
z3|UzKzC|U(HNOf9<`03=nZqEX!3qO12SH+T63NWYqCky+ony_VfE{Um58hu|%BB&h
zY2u}<EDFv%qfSjt1%tuRAK4?CgiJh86P{6{6e0jMkpMNvs6FeW0@w&~Q+7F8a1NDk
zRl4upx89nQmzV#e5I`;Z?qWJqo>8~Aw@ZOqF$3OpkT^ntYadOypNv}8<fIKgO{-im
zi!{tT8V`>U3_568rsFW`j>1rK2LoRPkQTw2btv*KcK!A6kn{48vSg{$!GXDK>Qb4J
z!GjG4mX&}s2h?D9djcA?%L6V~pyLp8MkBamN>ZEGN&-yVMVt;VI2}H)JG_wX@<5u;
z23a)@@Qf}bMR!#~;mmUI&nf~xl`%@dGp`6d^KDSLC<mrIT?-GLo(vBi84GKE)(j8s
zYk_t9JK=%-<Dq_iA@Sc^5|BuGhC<owI+EMwh5;!9K&#i0<kS@EdWT@mfSUPhhhx;C
zWDmxov$C=Xf;A7|DJdzS*Xw09Wd^7+0|!KH!f}X{QOf`|2?f;Qyym{P+#iwd9BSRv
zsZ*_mg(W{hpvH_-*qMl-nAnj>Gw797h#-R+^@<fM=n!0JIDl<9ALb}VPl*JGqXB#p
ziCZ3@mqglGsNmVr$IByx799l8N(`E1!jl7Lxd4|4htLWI-g3Hhs6l3x<|7#@t55n;
zsrQDQpR`2sP>ebZ2h0kRM{u$wuLB2{CBopc6r?HWx)7j!;Bb10%Ng*W_BwpTWA}o`
z>Y=%#^AVU`+2HZo!R>W{&E<wnhYM0&E|Om61xHIM@lURT!h33=bm0*2%qjriJRd1u
zm=C_0PAHl0hsG6NnDu-MdGN$Uc=%Wstb3szHoQ<r9^N+s*6(YE`}dC_H$T@3_IVy~
zFRCVaJwu>$&Irh#R0RX9YEWs^V2-x{W7Smtu-gb_^ETz|c(&Yt@g0Xe5VQHr%uG@K
zVDs3KXtCgkD#01^LUjm6DUI;J92E7)kNAS_c_@8k<_5-YWI&DbhfZUpKz&`)mHwl`
z$))qR-+sHjsHpe_tyX`9#>eXnV71ys_dEfpfdgug0ctr-I;?R6#$KykmqbevppMv-
z^yetNI~19;QZP%HfoP-k?g-}}9WHN2#KUGq5+WW+M`Ea4(osYq26A=a;IbY&1Oc@G
z(g@JVl3fljxE+4*IkDq0pH96tFSv4C;BaQ4UQKgHXS#DBy}%AxL-N4YT?Hj~jezn6
zjo_PG0q)raP_(!JN*8${e^wS$EwGc$wH5Hl;oIQxV^iR<V<X|g{UhMP7l*+k`|IK1
z{lj3@3&UZ>p|NoHzmEpbVm~++l!I@6H5ASs1|_!+19d?nsI?kmG@BqjGtjXp05z{!
z%bG3MN~}5ZESfh2WhQ^HdF)6;eOdr&a*f^{VHq_8YChtT0d<zuMr42*5U5=?&&E*r
zcU|%KTHXlZ0DIc4(;P)brTe5njgp4|)FLzFfSTYGr4I#0O%zgwN;?1%s3Y~Ajy8%h
zWc`xzP(Up^)?*kC59Zmyv}o2z7}Qy)(0QmNdGH;F;au^UX9v%!rDaN;hjKwIimW<J
zQYAjoKW{ux%lSr!bkz$rI*Y`!gJ;#$WKxu3YEcMSV1U_xue67PwA<+;$fTWi4{_Ms
zI7L@Jg6@2{4d#W;b!Mad0Xg~EkXva7Z$}X+x}}B`&lpaM77PRLyb6-Hq=I<o`AGhJ
z7b%>b4t4ihq33%Y<niOv$oAtm!(;nK!TO&Kg>^rxf{icM!bAIp!h;8f!McNuWX0jp
z(6e_UDZRf4ob!voH@}h;%&LX*yBonW%nE9~4m1Wm2=WK@0HI7;h(hE%J*Y7zZOzF=
zpe9N=JOm?biXbg?Dw5>n<bXaM(5OM7Q&5_+RL<ig?9g1yhnjQIBNCt%88v3|LpCii
z>Ps$%`@#O;>9vA-)W2{EvG2O;E_ZQp=^>rYa0T^gjFA_Bn(&O8`B5`Ajh%^YZEcY<
z>L74r04<RuqUqp^mQl-rvozt7)Vm`n8=z9&jtD(E<iI(ccZX~si-LuVFqFFEh4k)F
zk~qTTkq*V6<-nPi@o7xuItars=^#cOf=P?=hrpsqQ1D6sqzMCQ>O<}H5O)BmspNrU
zh*EO}ygP8Dm2C9*aN96=h2)gk!BOW1e|J8V-dPFd^J*Y}ei?Y@7lLn55h+|!00lix
zs9bC(-5UzYy+7zAJI~z(JI~$@kG{|j5C5!@Jh*oVJiLDhY}`K-*8O}4S+{p6tUuTc
z5A5rL<%g!g&~@eD?a7C{g=LUGy9!EYjew+9H|R`8qS9$0J~4sn)4Wd20ktT52uzx?
zX*8LvcsxMUWn|M#qej3^NJt3i(~)&1k`N#siS!Y~s9Cujqeh_CX-y)dcG|rUg#+8K
z6^O4##kk$fyY6zAl$0IBs6+v%2`1p?7_|sE98lAtxLR9VgYtVsD0hVG<crje?|Mik
zK>#hy0vIB>Qb?&I(ok@P^rR$GU=B9|ON5<=L4X|zKu0=4c$C9s1+nEYARV#Pp)}56
zP=Y1Oq*)mPv<EQSFc5JV=s-k|4u{VLwmb)>7$qs*3`ot-gv?SaIGXdJ;KnK_omvZJ
zGpeC@emN8@D1y9&J}A7`3;ubzP&7XWMm<ypbHCdL8xKu_ov+*hn@)^{wLfnl-`dv!
zkL+uPjR%Io`U6AB+5`2let#pZ-#Y@<?QMeI7u#Xwp()VzNELYJyD=z+_~w;R`6Fet
z7fcE9fIzJ`n;;`6TLfw}0jQbO!I(5}QbtWAj9Ls8XP}L4d1kYjf^-Ot8m^ZI2oKPL
zw}+UNNy@0D(gy?TYr)B=_PyQ-Mc8lp9d~$2OUn*$K;1|BV61Qc{P|?ns#O%Mag>*q
zmX;tt>TqBhNl;1zY*<mYhycuGx0kvW$|Y9fB@czbl}J*Q%4*Vlf_@nWt(Zhf4zR=d
zQujlX?jw1~1+Ii)(GhFX;oS2i^P!kD&!QEF&bk^3&OAD<g0v7CPJ!I&v0}bxlIG8V
z<id1FtIQ$xCLbvnQwC-C)Ir7U1}K|16p9vBL*bHg@GbNbZ;zFFb5tzKgs~47!1@D|
z$gWqW!S<JKh9{1Xfwg<<;lV?Vu;!=ru<peXuzKH6=-odAR_tqpHTzp(!~Panzps_7
z-PZ-H4@`vdTZWPR9vcN~&%6TSn^R3PrW8U#N-~u{v_=D@Ue&1sc|3xFT4d3@g_AxQ
zP$P(A8Ac<TOeSJ98qpvM{kcC{c97)3-13A`UI-7=n46mKOhm5_m&4mf`Uv-v^A3p^
zU*#l>>oFPu0(Eh5*?yhQaEUQ$tJO{i4&WKJ0Mx(%wK!H{1UWnuqXcE<<+S8$l0W2L
z1R)atvp^Qbkyyfbc|?;~DM)vgBvumTj4<pv;si^f!oVe3v|=zzDBtL4n6#XWog|PY
ztanGKfEKyYz~zR_;`C@Lb)Z)Vn$O`0<nTa$X|DrvyxEYRpAK1-*^t}d1o!AXD7mc~
zhRkY&{GM9y&#NS^d8Od$DWS=fyo)_hvdjeyt9{V({Z@GN(2el)*;`=SiEeoGKr?LE
zUk|JI4JWG))WND38({6hCbITe6RbMkLV6E(kluYAWX;|-*s!-99^5wy*1k9n?tZo%
z$`?DpJ1-Z!Jzj9mEraa4OCUKt4MCcqPMwsNdX-6Yk&4v%f;8Wm$cK&h349TNTJ-in
zHjS*B18Q=OY+6pwR$|m*Zfef!gAO8)l9~=0wISf5r!`%6y8=Lctr3RN;%~nzQriBm
zTd799pJ~***9W@i1(<b-2-K@rucq#Kn3KA>xjD#>I)o-Ib{s|!K^Q3@lMvn`LG{<v
z)b#1NR0?|!HzJE<OhYA*4jOqy+Ht5PbI1g;$N_c8bfr=@jbI$2<4`GpC6p!|E?sFK
zO_~dGk#-ygfpIi?G|#SOKsqQyobNc41!_Ty7JwRj_JCp9QUq#;*9N(H*<h=(LqTT|
zsl2ros-_Jm<ufqwWC%Fs6%o&p3h*tf2Jd}U;9gotiXJF}vD+J9`M#UUmY45@=U=~*
zY(LsX9(%D49!Bl?#i6kN$Oy7x|8Q7$s1<tm)x)y=!(sX126*7`NLX=T6s+0X4jcD&
z!b5vU!MYd5!h#=+fuYO2#MhGxo`qgwpIZz$v&xV~6P?LOI}{UBQ!r9d%#@d74J1;c
z36(fqS_Y^Ujd^?Ee0q9%fJGY&gaNi8w0t2u24a7_K5$;EGl(O-a6nBpY7VFa8T7QK
z%O011V>Eafu1_y2{Eb$h4)r#<bIP60f`TIS`Va$N@S;jT&v72TKClyU<w{I-dLPu)
z4TGwx$TjM4OgbEZD}i}G5-{;T(`;Tg0+B@_Mv})Piu9x;60eR>>^Ph@%>%NWF3rms
zGTL<1;~L7bX}JIvIXT0fpAYW*d^&aI<$>GpBW}MBl+5FE2U)(?1$iDP<ar&`ydFC>
zx5q}!?#c<|<?uPc<#*EbqL>`XMpKP?ND+pS+nfXwC!sfo+mlan++N7^yCA*90V&nl
z;27-#{~aaZpH%|h`6b|7SOT_%C171#3T5;2pmKp9%I9T6O-~Bk_^=CB{HzIfygCk^
zetj(LIM)GNPBz204*fsg-UB+SGt0uoBt;}4GAM`2Nu``X5{gJ7=VXi%U=tLO2)0R*
zkVJCCHZ~cIv)c(!7SR|m#%_D2XZp=dzv-EdGqYwoxb3$4?6=N;?=7xMl?3j`TK_7k
zl%T^`Tl?Q<p91V{D?n>o3GHdCKx=yin$MNf?#@!|?kuIIjv|QDSs=e%hNkv%?CvT@
zV|OL$J}g5~lL3|u7Ey(&smVrMRR+Rs<1uVv0Q^G&5f(BEanTyY#cC0&O+<7;4C3OW
zkQg0}#OQb=MkOLPCQ+!**jV0<64|GK$yKJBH+=Kql~=sYMNzd}=Kmx3(&XW}J{O11
zikg=Qh?>(Fej#FuCqZm@8Nru{tf~V-elX}Pdw#UO4qv{`)3o8e{IHcvS86Smr1Kol
zlR+*1OLC5j$)F|$)K5OSl|fBzK<(03_F#SZ3Tc<h*~{m7@}(WCz?=tN+<@BIlO|tM
z9$xyRorhRFLE52|y%aHd+`!^&ceomEafYv(bcZ9k;VvJ|P<H1<E2>y;Hj&<JfzHH`
zHj}|*gqtHi#&9+m1f+={jRqaedVbW1W6*OUznqQMCy>Qv6!t}20w*Hkpy4(=lTnO>
z^RLaCxLDF8#!C%(Mgzqd6A@vKM|74Ri6vGf-=BlzN3vmClTOCR?J!o^VXR4lzBY-B
zn;6uINUx4VMUxdZZ&u*BYb)rL+skq2#yq@ut(=~{R4gF9uRR|v=cl5DFAm$Mp{1jO
zni<3b(j^k4JBq|*q8ijqozn!UH=nJb^1U`B)mow7kO56?7BQ$Jv*R&jqQ3xj=!kGc
zO^PE1b#!7pgPLOFB9Rc&2h>7+#>PgAk9mT$0&3p!9T6E#y!l&!C2v|80Epq?^Spk(
z3~IGUEv6G0)C_0_HJ=F+CNZcvnkN*s$!P1NsPC4Wcg^1)<8qNdXYu02iDt94Juom>
z0k!xq$JIp_TOTs0>4_({ATN*iB|6&kyrnUGt|1-Z1*2Ol#e<4=dE9x@ZkEsb+$Zf~
z($Hh%ZXjJ9?k*5Lb#^#g8qUwTQpc|R=mB09y6y8Yn+z};O)wdZ;xKsmINo>RM;rC>
zVp@LGTVT{%xcvW4pS0d6ij_pUQlh9BC0-7|?RebBkr=NLmxUI+6^TZ@s2`28#3Ldp
z22nY2NUSu%wjxt>Kc}pp0^7Q5m>*AtZ9@uDYE#L+!HT4HdZDJvcIfc%kvz0qSV4!s
zT8E=QeHaI?Ex<DuEAZ^aX<~?_wY`8^+X~UrUL-CFSw#x~ca%wQ-vKq8LCv4TpnkGr
zI_5l|fs}eX8LBcF)QGRnfMJ>)gD3bgs3~MbI3|pZM0}hUk@2yJiWjPxK}`(mgy=q?
zMqI39X}CLL8c|l$@)BDIOkFIlr2(Wn26UVhb)VD+r_^Lv6EC-ANb?B^9{GdSlH@h@
z@uLpE{JpY%D;BRvG@C8wRG=2GsIHO+RaI4@=9EFbb?atKnUd=a>U*(1+$w5s8EaqQ
z?ro`oI_2R4(9YXg2DF()?LVtkwl{y-LxRKG+ANR9i_Oso!m@SIM>%@{wacRhtqW+A
zRj&shi@^x9-axF5rDG7!8TAsFRmbtZL8lknSs2#*$V&jEV}X`!46Ssu8k6v%+1fDb
zO(c3fG+O8r6KISv3X_uK5tFBbc7~ZO%Tr)qlZm9N9GI&!k+>#_j8&<y*QOz*ItjMN
zHI%X@8s$$VVfCRhY&$z0&s|@MV_&bvi#L|yz=fH3`oeVV?<zyn$N6Y&D?)2WG4^zp
zp|!INO<kq5tFr{Vx{9!~t4LPU?iF=oM;S4ww{^|Ll0&&jt4}5|=~$B`mfof<oPzr%
z`eArzAb6?k=<sn!h}R(^E=DZCRTOo?9Z-vn-NO2aiEukQt|ULAqGO3c&Al4RMsRi2
zXvmLaeRu*dZ;cfI03ZNKL_t(K`3P#Ug`6SH)(3;yVsa1af&96vi^Cri+Dn%%O)#0v
zANMU~5}<YfL@B0cP;(g*TOV7tY{KNpIphV@t}YdQJ?`?=?pAHN0=2s>Gj1;ro#E{2
z649H2cD6m_{|p_9T2a*l7*cW9-7%1jEItpgIOm&XNcXu!bhnYkmBMyYs^mBhQ0sK!
z$e<<$wOIw{I~Ro}WnGq}pp6>Qvmsp`8U>^cT03-_WYTGpVKSscueB3{n+I0nbqR>o
z#UQ~H4SiA^CY5NQnQMdX!7L=N%@u$))nt;kCY3J=VcyIez>~<ZE)mJq@l^7Z9``?;
zitX=K(9usH#*v>c!;3fP<C)8q*w<Tz{XLxWD8t^45^8OeY>qu0<<#6I`OOUJ9i4^P
z-Zd3Fx(j7U_fyp50Ci^x8oH*@&aPQ_;Mi13-;^Saq}ODSc4H=TRup1LbO45i`XMxQ
zBu0jg22W8&#l?~e)Wo2Ui;)yHLoFsIib3s8NjnB!*!GBwilI@X#|pcFRW%=_yg%gb
zfIJYGJARf@#-z4BI6p0pY<(!8=E+2p!Risz1Bv1NJ^1T$oMiEw#c@WX>4SiPpdaq+
zOuVD06(z_3kU=dx>MdI~(d5ZFYDMjBE6ac`3q7f0FG`$zQPDo6JG^ZNCvRI>)E0-U
z3q)Tn4-aGF{oePm6?{O&O73hA4>kw6DOd8Ahla(VSKusr%{sMucFICK7SM`iwBmhZ
z9CXG6;Y)MMLu_l&+Mw4YL8nPVe7qU)8YA)LVXP$)5tb;5N{fP_M31Zm>9DWMM$-Bm
z0ccBACJa@n&{o-@t+B(f(FS9!5w?wq$bC|aB?mLG<NR#Ae0>=m|7<Z%e6|43Un|A_
ziv_f|XA1W96wscIeC$3qMJVZ~dn(b=#+m2}+TBrs#*T9A>?$J$HA8w^Z$V#BcNR*Z
z=0~<gIx1L!V^?Pxc6HCjBd1G|u{oJRP1@>oFsO4MDaCM2C^4wR!orC!6yswxh>nkQ
zDC)S_KA;u~*&V3W!!8P_dE#$m_-MzbaToqHc>(ghK)a9ip;p=AGLc_&V&lbc2@@tv
z68^MunP}8o_xl3jzuTW5>n5{dYeTeNZ+eFnwG*fvU{QX3cLFtXbF&9xeR#S!^jP$N
zx1P2uP`g?_>&fnLPI(Mq;?U=dLr;rm2kKwnO=pLj!4=1I3dlXBIeZvkQKESLfUP$g
zNN+U2=}6DXOJ~(bW8g<KGzLy+n4vSq2v~E2ok7p34^D4L`DvawOfc&ZZHlLe<XFT_
z)sbON60G;9BWZOOrLNCqAd_Z85;zBKs!4~XHVx*gWU|#*kh)QijJjAXdOi(XKB~ks
z*B9aF*UND1tND28#xy*8r2zXc<Y8a$6tr|^V|RNNS~@0UPgen28NBBTd1wXA?d8<e
zE<jB?yUN(|U{KSJ9sz1{0cxSBcXv(`@jVIDGx6A)mB`wf3Uf_5Sn+d7Q_iXqgxJPm
zNZ4?2Ia5gRNW?@b@w{kfP*ZeFg7BPUVxmX}bw9g9t*F_fX4^ydryb+m{JsmH8h3GV
z=yf<oougL6TLtPniaIDvWT|;F(P*&l8z@J8QO^B7HW0b(>&>M4{VQEpq74SqdkUy|
z;DzIPPKgi2qZVaM>`{9FwcAx!J_6WN-rDiV*=XfBf39=<&RvIxhn%!?>5{YU;mPuF
zY+iAW;&~hY_Aqhi0J=Ai+Bq-nLOpv^)2@bH9OX)C=sI<Es5?8<`Do`YEb9ETI9ekg
zlX%n^^u)=FJI|RI%*1fM^Jpf9wBwjqQ9BN4OmUQGjzgR|8Znkg;{0=BfkyOjBtMu*
zDeES~QkBj22F&$2&~COuzu6AU<`g7tN+Da7nUbq?D0<3@MF-Nc^}TX>=E?#b{^=5W
z_4aJMe5-;E-YCJoD|u+@&O}RBE?T=MV{dPsq^NuHskJj7EuB-*+EqgAOSg1XNb0z=
zf*QLyZdZm~Jw@2*Y<)1GIiA;9C@vXgP}9ziQZ)3;q7Cm%N6u4eWU0+?fI4e+2}Y$y
z;=Yl?5fUaQ@+c}o>imd}mr@^bv64p}8=asAbst5o0<;6tV&zsu6mb+!>4fGiGe5Gz
zc5|Uf1N5LheZ8aRROMCoDP>~YLj`II4hnPRsM(|T#6NG2!;flr+{-t)eED*e(P(~m
z*f2i@)Z)J!1uTj><VRN2JdwC#$2M%*REO+rhGE~GiLNg3e7r=w*W<DU&yA{fr=ne+
zflL{yeQ5P%qL*=SkILDbqL!cUm+Ek*s(mR^^0l)=-6!p3P{p}C$uXqD@YNbE3Y0}z
zKfldtT1js35mpEL)3VCu=h$-=9US^ZiZjI{&Ju?R^CXNjk40=w1dNqBWUkCW+9PR5
zemtF$tFyt7)77R?;>I*+>oZ{5#6?FYB-dMzzR`e!tp+^!QXX2)&&Q!_OL6M+B{*?w
z77pK>hJ)9pV*jOlH1{y1r=qc^SXRLTuxRdJHJpd$&OGU{qmW@OdZl-_l~PN0g@EtQ
zwnAb{qp`C{1!@J>lJ&t~!)jbS*Hwxg9p$KccRHr*NQZH~9Y+59*CZot)l`IMM$oWv
z0SE~47dhgIV<t&U0pc0LQHYI>L2Ps!#Y8it1*nCZj*pqtXT_Gfd`W>fXQyRPS^;Mt
zl^f!_opIOphq{zWJ(<XVH@0RHH9C<E=l6MOK%nC?(X&VWW3cqD`8$y4-h~SnA`J%f
zTfBulj5jHSjuig|DF9*+s6Z`NaqZZ#ofy<vSs8s4wY$C#AM?__fZL^2;vwPTym`iL
zRjH@yQeS*%PdRCC(}Z3!(cUf;``I2UP&*H^cmlQCorVMOq1}}ykta}VbtV{$Rx+Aw
zkd6fgBikBA(ZiwGAzHmoZ2C^ra?_noWT8zKGh&mph&0Dzk}VbqxjGmtl3<&cf~4iC
zl>BHq(yMcbV|B*$No1_H!Nk6E9cQ5JFmFkLy*dGzoAgxKoPssSO3~W61SfB=#_M0M
z#EDO5<M^i)IPysmUbr}gp6<!z@+6^n8yK|Rl_F**PFE?{l45t)RP64`=R^F+5a*Jm
z-EGCx+F1@h+~J|TEkm06g1Vp|sCRZ&Q0@D(Fm-1pnKsyAtV@Na+K!aR3Nd<0EQXHt
zhyREGgawVnxbX3!DNj<(QKSZSWNd#>D?J`+P|J$~z}ac_=5Iw=tGl5?e6u_5T4^h3
z6J;t<0X0t|@^1$TiCRb32ZK7me+0i^eQz?@Jl354|JJH^uge53Uc5LVF;R2I-#_qs
zR@1Ua?TDW#7m7-Ip0tHrQq);l3_$N5wXf-pyHMMX!4^;XXfIjme#+X{-VP6oXT6sF
zy92f_@jG`HioO>9yRbSu7AkpIm8DK~45XK%&$u^l05@||gExR{4PvyLFAk+kL@rH|
z`ZjcCEp%oLG)CSA9)|>DJn`Gn*$Ift)4@=YjO3-0k-4fEX={s-w5|ZA4Y^2sJVjg%
zS~n#_svFfIsVW|68#S1`)kyRAB%}V#={R`pVVwTzah$q+KOMO~3r9b#z^R)v@bZO1
zJl~y<{q6bKbABqC+ltZBF^#PZYV4>$L+1?XbV(O~O<hH3>dqHO0`^q2^prT1HGeH9
zL7LB(a+ilHp638H-2rt88at*6<-Mz`0`(uyMsZUXtX0WecS^kQHu>=aOe)plzOjA?
z3=P7_;4q912^VAHQBe^LYN4okf=>apXq$_PKwR|1J~oH48&Of$VnKlHMXMFHVnryv
zb;#WxpURuuC~9I*i}CS<L;-BR^kh)``vnW@!>G5oTpZwzjrUZ^aW8Y{-u`kuJw4+!
z8tq9|)PaG)VhcI{%EYRXfu;U+UOn(qU%ydN)UNg<dd)fe;7_~qs$E(r?ko-;B6zMQ
z51q^Y-Nx?R^hgi1OIi)-er5m8mxHb%dR}tUUQ3mn8}XEhLJwUWeY!k6^l^BDv^Zw1
zQ5>VjK-^X*wyx;4q&I3vfZ3dgcyk<LOi_q5PDGSx62+&)!7{~!w2~A`S(=XY2eP?;
z1L=<y@R};JY$$-aW(rKa{%T`7FNTG=#sKq%7^GB3qI{PDj~y#S)43&h`RW5WdFx@E
zxOG3B_-qlKx;+m^ZdA~7y;JBwXD$wO<Y8ZX5%#r}f=9pibX3xwj!FsEZ9G*t3r!s}
z*nd_)O>B!Oux{=yL~Cy;TDnWobiPQymqFchwiqqvc!8}0)a1xfcNS1{dkG(5gD9Zh
za&|6Cn{&uol>}3*oi~${dCe5W&a`0A=)nr8X=G5SfU`5G+4fLC9TPo?LEYy9k#{31
z%K>=pmRMjbgHmO6I3jXxrW5HNpzX37#0k`npFe)WBr#nojtpw{s2S93eca6m`91GQ
z{85)I%73=k)kT<0)-z#Y;i5f{1M|EPQ}I3(*eDxbl+=d`)LwJcJ|sMRR?j}9JKTEG
zzIfBlN?JXn;-lT+?&8o>!o!!L6$g+9lJsz4ZFnpB@28^G@O72wP(#-TPr6^rok^z`
zN5t`rdKgSv0p~bVtk{~ut#uLhNQ%jdMSNZYw5593<|HF~c@7F5Eks6j1~RI$kXDn0
zl$snQ)#kublLcdS8W}bu!CYg8wJMRaHYH-t9y`^(UW{jZm*Du#2XOlH2XXq=LcIRP
z5}dd(3ol(R!NJSLc=|#i_I4KFK<_lPc9aS@@9mfYK6^UK#dDnMXziSe-5oQ;5?XQb
z*LlbOXzHFSfW5oBSmdHxx~DOyi94qEc1;t?d@sYD^U~tDvOXkGH*^%z&dzddJvRqs
zE!nVau!%8tZM7BpRoO_GpNv7H?}LA+zfja+fgy;Fj1tON1~ti`76nG!TdfAQI`N^r
z&1#w}O%*sg`_lukKHx)q&znc>s5@03R@AYH8V9H+MMODLA0fdbzfX+szu{#djP>-f
zd-kTCA8+2gIjp6nW#YVf^GfH=ox6PQ?AdE)&6rWOe94kEOBO8Hk&ux1&+JX}a$B}P
z5)%_eazMUJ6psw*+S*!qxvc}#4(r3$n$f#d)@qxhU!ug*K#KxuZx@D6p0rv`_jz=e
z=<u=d-=~prr{spaN3{p-C|6R0dLU&=&KYSJE3o>l#Bxq|_*&rae7K*3dpR`PIPf;_
zSYsT;SYjzEIR?=gaTJ{!i-a;ASr?@s{o%=!`FK7u*X1E?-4v1FFx4dSA#<%A=2{y}
z)g~CLbg<Xzkh$4_^o>ziaxe?KyO!bD?KL=Y`ym|tbP-NmUw|{W7U9_S3LO5V4A1vY
z#s1F8*xy}9`+AD0rIP_$MlD^_(b_#zdhDzeDwj+BTRZb<AKMz7lWr@Mo_9p-SOrU`
zrMC>*&lRAhrxHB$($H3fJzdkVyS)(d&u|8{NPftmCI_gy%J9Vbxm3}bD~g#6)iz>K
zYgcDOyCjtcjU6ID9TpUdk%1#IX~IOQXIfU&(XyhR6dUUe)IwSFmhtd#$M)|&k7{^_
z+?$H_MOmvstybA$>$nVRahb@VRu%_v`XypQ)XkiX$=fUj+x97$xjWO7Q#VbXJo(XC
zvt|`7U%otw+2{_sf43S_=g)of%{PY}I&?^rVo!N=!nkqo`VSrYp8>;$|BwIBVSgAt
zc*vgvhYtOt|KP#jgoTBR4dlEtkq=uR{C{}G`j9~l8PqNnwWpni9u&1VmF;%<ttY#~
zIfCcpMU#usaG$z6e7rd9cQNQeQ7Z*Z?!0EDG|AgYc%RQzUmCh7RO+X)Jq@Yc<vJ`^
z&~~M$g%_<gB@$POa%v+nDG{0s9d!977|LyAnv;Um2Xm49=w#T%)L<^GwYe~E%;JsQ
z;uxREgnm;BnKs#w{Dc`f+l^G#Y{rU1Y1sH?0iM6Q0I%LyL?=IAiqp53(#cy3aqPxC
z9KJS}4qcgr{XKcKw=0jqD^xNoURKAg-7~1Uy8<n}<!J6H70OsB<<0`MbmgP9y8wH-
z3bCiXh!3&4=F`$Sl~`3bbrlOMq@imXYTwBs_OM%eDrsjMNAHT!&|X07Kl6)$8$~U{
zzYq;=Q^B#mZ5<0ReeV=ltE|vho1v*PLHAfL^eZxH&_q84)D#{RjtOJNij6LcqGnJ>
zMaR<}P*0?|=<$6r(~j(PWF)I;a<dcBSM>}pirVKP8CR>g_-zKY@TcPwh+}#(s5zpC
z0KZ@^siGl+hJG6~Joqoe1`YkrZ}9MMh7KO`=fQ*S`_+VT<3G;I%6j;~fdetj%6sK+
zpFcf4Jwso9`Q-@*4jj-QK781^V8MdaCG(eLuUNVwclo?UIZGBS$yhLZLB@)uEAr;e
zocBn?xQXxj5A*v?fS><&enW;*ke@$-{R0p<+z<YP2a7Xw=x_mOR@Ho&$gjfue|Ux%
zKPsT!xN)Pric9jSrRF@zqjm=KJt}IK7KaMb9!JA{nKV=@>AM(UaqCgLQpy8S)UGZB
zUD+V+a?#F;+C`yKzvE@YirdyZM?sPsA6l6v^tKv{7sDo6HLzq^kY197+_`y}vaASs
z50zr_<E6rPPUh@$buNsxIUK2@giRTU+nkD+&8ZZ>DHVyE>`2{}fq6$NP<w7Mc3)nG
z7j7)Y(c2uYn}gSG&%v3`Il)nhLzheNLU%FtcNB`t!TlHV(cGRZfVj7t$Gj`i(lb+>
zo##u@)LV+io<i*IDZuWYJhWaYpw`|(0qW+C0^;w(hpiGmtz8_+E5`2b5-~Eq`GYBV
z<fsKto-M-e-Wk|&p6!ql`O<N!SL;IobyH6Tc6KkutOEsPtF|eiCgZw1m>$f*kf<O5
z>X6`2j0zrwF(bp(pcXN<sOWf=qMisD)Q*cp<*@C+dl7?!gZtSX%GMS6dHNBRv?uGM
z&n2ev{Dg@S4v#u6KGC758Pvmv28c7lKLo??^Ml{u;RqZS0KZ|w#R&@u{XW3Y|5w?m
z=_jimdu&!+RaM%F!-rE&9X*<Q>gcJ|lShu&PaZyOed(o_46nZWYQoFUJQH=~$dNHG
zzx?trkI9kMD_6&9W3{a#gF?@b3m<zmEF}D9cv$%Dv17-784@z`tFW-}uf~iS_fzTZ
zQU5e%%(&kL1&#P?KtK>hL_~>-(vLs>m@Z$wjIOROw70j@$&)8BC9eQ}{(%%2Gy;5h
zD@0PV9rl!DaTFkJ+O$b1>Rr2bVB^Lb$H0pR%VQwD({8<MZ`OudVLL6K6-wEaqE=ZP
zj-n-RIcZmr^<sC3uW=R8a~k`0Ir{Bu$-m8#B#za3=U6N@m@PIkTWqk{tbE99wZLq(
zD335%jAXJHp|=?LkkM=a9|_0|a0^VvBv?(!FdLFdwA2|{aT{PVYhf@ah^auMh2Pdl
zlYz!Wn2cJOjAAUDj9Q)e8m-Pi8lx84Bt5Zej<QA~DrpkMWke%p_9W<*Y00uW3D$L)
zFx6zkurU|fx?IH9W+8ENHWKR6NV72s)=f#U)$5T|6^FE%cud)%!(-1)!1mWIc(Jz>
zCvMEa@z3Vs*v&aOero}pyuAo7-<XYq*JcoRaqR6W6>3+U?h<09yr;8-56O>c?kW>U
zC}=(c&;_)cVclJfW<Fh9u*C7YN<4e65(m3xqv0dAIm*#+p;RmYXuLj;YCbMO<(>qr
zd%b{mb#iY<AvJd9iX1i%vhYZ`*pJvzM2c0yWlh}g!L4~*gUW4t>}~IAD-mPli(bkW
zwvMSb6`J)~Fsx07?cq%LC62)GkpbeKDKsz)W5$dVu{>dML`6#RyXaVoh><`Y9UV#h
zF-d915`&!Ij);sFlZZ|V_Q%}d0v}blOOIN4j^F3YLuE2CK0za0CXNV2Kwz*K%z0qt
zLpXb`4PD*6)Y;jIix)4_kt0VibLLE5&P&0;!4x_o^e-_{vHw1P{KT)ujvfEgapNZZ
zG(3FFPsfZI_r<7DV?G-(BJ}#0F=MZWhlO7Z8xi)AE>5$9mxA{LG|Tc-TWVHVQ0UFT
zVFBOquQq&w0)lBoPzdq9LqER&3Jo3kw_(Hl{>EVT_YV}$v86F)%s9OK@+<V0zx)OK
z=Z}B<BYyqsU*jMD@gJ$Zy&ZY^QyJ9o0&1v1U0Yj?oSZCYQ1_Wi^Z~>^T`c+<y_0j&
zeXI=^pmz46eOA*x_|48!g>G}xE<o+m@d9d+PajbC2eer}5~%wsW(KtaYYEt*na%-e
zR_R8VEqVcKqe&y;b9@PCu^Px^){*d=H3{4qP5dIk{m+ROJtf-ph_NRiA~_mylM`W|
zlR^a#6(Ds(29nmLiW*Vlx(slIr@lH1#=2}6H)lIKH>~w$B-d$>Ss#b#E!_QFiD$2^
z!Ld(g;P~~KIC*m}z4rM6I`h-T;B)lmJbK|uCHD0cV{dm6wRAENCI6T~-P}`3>>n$D
z=EGBjcR*btgSyah1f;u*#pf}odE)Sy^X1s{F@Jp-HFOly&Yn{2xHuh~I;PR0SFBk2
zvK<?LQY;$qgo^IWlPr|3QW7whKn>TRmUbs{TBM=96kN>24SM#C8UbqUhHUYlnf1{u
z1ZYEPSeQSlK^+qn?F?!-gIZGB5~TT&?F3~hzyL<X;bkiEp3)(%tPehFP{+k5(!@!T
z<P7T1Zr#S!Pd=sp{LlZyx8Ht?@4x>Z-+c28mM>pUfq~rN9flD>Az)rIH-``Rr;#H^
zF*_Bm(y(EE<Uc$BVId<C<QMd(A%h10zmKkb)armWztOzCIVx&m<Qt)ZA>RfJ^+#Mx
zJhC%$Fuh_1X3v~Mm6bD4S~?9C71L2%T#A`9XY(Wf0P*U2|NRfpzy9kl@WT&3@L!Pr
z`Jew8tg74E+VGQ~{6v7-pFQfJ5u||HW=|5Z=A!~Nxd8P*OPIVa25`1Jyfoms8wu~{
zMXOb|yV#w(no?OA_q#Ckka<>jM)v`>k8OAGF?J`w+*eJz^`f0i{l&5Alf<zaEM(<g
zXtPcnR?2+1oz7t5G=^SEen@qs${~x{E<i4p!|HUBJz_QxPYg!sW4VN%Vls5l6kB1M
zlSaI)J9AwD(yOK*d2N=c>(tj~!&E<+ESvLSsLh0SogMlO7T7o1MBm2btwxd9Sbt(F
zT03Ur@U^8lesd9ye>$Ju{@ML_{VTRO=Hb<AGw{-t3LLyNjh^o1w1)7Fg@4STZs{y?
zDC%a;HFrt*W^p>DAr!vwlR(`U*3I38qz1K|hb9r*YcIyWOXYa#TmiOqO~=j)3u(#A
zX(-$ojjFc_X<J*l<aKwI5dTc}s2RrWVXHt*UO+7x^p+o)EI@6nNnucvaYH6-tFke|
zI10nU{6!!jBp{SVjT*zr4+b^GMM+!4ofNfzxUv|4hhX?^9?NzG#R0;W?m{_}F9R=5
zpe7Zl)ry*U0}O+@r}rX#`O~j);lc&{_P4(!7ON~&Kl<n+@xN6Db$Hk)W+=^?H3#M8
zm4cznRDOHfv<mTdZuVq~oD_u-{=x7c;`d$j#Hd5hH#Ln?Kt0%^vs4BT5B!&4zo5Ta
z^kzJ{^(nk@=1qG4y$|sAoA2Pg_uj`_Z@oij&b)!2{Nw|1o_+RtL`HJNCKCJh9l#&|
z_-FA-^1I*t4&B||Y<uvp0eJuY_mN*vsJsFxikf6llLBgn3@d8cqee|l6)7X+?ppKi
z!ISQ@9?M(w&fVaOFMhNeXuDdE<s85Bxg&ajF}!{W4>y@;6|@~{S}1966Nb*7vt64C
zyDk|vy$uX%vq?v?wLxre2y4S616yvkv*^ua)tg~6SfJP0pf^~F$G{T|I>Z{|5pRu0
zV!9TZDF*1v?XWJ)K*}TeNLgC|+xk41He^FroeoWP3KDA5#nIKK@YWQVYRqJ>H6VM7
zk&3q)@W8<=Y<*`M4qjQtS!bO7Y%xyXoJVioo`?5-x&SX<t;8$WX3(KersIW+W!T?Q
zfY$ar?CmVX{%)bB#o5zcB8~!Eh9w^v(z2ByKrL00c9)R?Yw2qW9sYAmXEBM0Ui&oh
zerrz|?dmE-LvID1Y@dxaXG$=6YZMkdn}Y3aGttyDUF4`4(#jY)!&rRp{)(DpP?G{`
zzTo8Nc$eY>$Mca~rzIKGFjZwCX>|^Xm0U8YxjimCe6+OdP*T*6COl_Qv(+IbLZo=x
zsL^8`6M!D#cXze_Fl1nsiKoj%@i7Lo-1Q+Y6Zy9R1~qexdA8z#2XXnzC+O_z!DpX+
zhJXFne-#}3{qKJdwnCOITL!;j{un!Y91b0N74N_QAwK-@W5LqbUVEM1dg~p2WWM69
zH{Qm^nmRF*6%sIlM)(K+%Z#!abNSwI(7*lLzxiw9v>U>LLjNzoFA(e3Zot`(&f&FF
zX9R%v?|)i6KJ(0T#6RercizLh@BRc&KDkX?4Dxo1=bt}_|M{Q)6}HEJ|M!2>rAwFS
z%9Sg)e*HS$dh0E61~qRnRx4@+GWGTK4p3KBt#_n81_)~BK^B+e;J!>3dQi}w^3l$N
zEMAix&Y*S!-GNLK`noD>Ag5nG+G>`L#bkCIv(ZHIaa;^q^{KGxlVLU3q)jWrW7fcE
zN|28R28J|0XV3|l+e~Kh$i@EgS{vex7K*nR5NFpSE-L~0VjYqe*pT*M1~S&=B6)od
ztkt<N*W{9>CYus!vY@HYh4G03GHgr{Q-hXTBaG{!kX{#w1y3j8sSnHX@~2C1?6ZY9
zb$bC``+Ocwe>MlN-I|Ltw-(^Ujd^(G@^n1iTP#KDx~77U0%uNSsFbu?Q9G1zOAjkt
z#qN;RbZ4b>WMwUsw+ht!eRvUobV{-NLNPC=rENTva$zo3oi0M&6A38ZuE)0Xi_z3Q
zM~>$4RAMQKG)ZSA8al*<Bl%)|FsMb}N9RmDe7cB1Ep|8Rs<L3N&W3$WE{#j@ZsKtO
z03ZNKL_t)I>;vkNBS#@3BElKetf)x^YN4VP+k<n-$|Rx>IqACrHQi0;hx25j^1O)W
z#mOV_Za{tg#%H*6`6`%sZ1?`*4}YLP{pn9atZv=9m4X9DV90$#ap1r+0@N&Y4<9~?
zJ$v_~X?F|u?%j{wyIXMN$T6@uUbE^kj2knaFDL&pE_}?>m*0PX#GqgP@|OW@UI+UH
z{e?Y}=bm{U@4o#W_O$G!hK43$Q198ZPr&-vu@egYY2m`f?74`o7Yy$I`Jex#zy9^F
z_|0#ABVJi9UAiQc^*ispBNR1TAMEL{{o!PNkSkDc*szZGC5oMiUItyfS{}|Gw~teX
z!jE>7?r_!H;q9_eQP9qlhU)TvcT<GEK-(8TTI8p_wcV+ncQ?F3E<jB(s2xX%+UZS6
zFp6W5^3wv;TCp_NV$hOU9IMxf3qn5ZNAtcytv-P?x_HDTn-Q00hGwz_mWmXlEy<va
zN3)T>HXHV;4A^SZp|7%2;(8klb!o6}%@$?+y4qxDcm%pO4*A>7nD<O3t$nS8_Fh<o
z(_cS|H~!&%oVYoIPTVNRG@WHon_bt1aVXm2?(XjH?(QzZihFTyp?L9NB@}mu;_iXs
z?(QyMo^R%zVFo5c{^UM6XP>>-TGvUw+R%yFc<;!R?dH5=n(vmSz}X3N$=ZPdi<%6I
z>y1k`GpSKKaxBHfnU`@gHG}y`(LR+^q7X2h<ukOSCb$6^-23OVcl4{s08mNpi$W=W
zyT8(<v>XQ^+r$u6>2Kg>8C;#1D6XTLnv}-{=jnOQ2xAt0%eJQqq(3^jfG8k7ftP(|
zqp2nzPylszpFp7hCQA@-XANq?3eUo6ge)w|x@~Ip=!h@jS?vLk$Z~o}>-KE62$xKY
ze1gTVXz2TihePSD|09&~E7G@y6_q_!+2N6-qIB`IMajvcJ!H^@SuG|WtEsK}f26i6
zwU1l1M@USxe$Do3tA{THqyCvJJESK(3i#(w)OzrTls|-i9T~PByh*^#eQrBx`L9a0
z#{eP`e`aw?yA;_nqZ*PUy$F0*(+K}|lf40V)cCwF{sFvzEYazn1GD}s2t4+7ZYoYM
zWN>iJ-g!;w^?f9z6dnYr*_^R)aZzL@GQ?h`mY&He@9i%~=<;j+;8wH$hsX{9Q-?3R
zWgbG3@RfstM9Rcjw*5FkCePq5Rf1<rH{W5o0A_7>JLeY1t{ZOjbBn7AHNdh-Sf7E;
zf5N1*P22L=aa}Ct^sXVuU9t>-ShJI?oNCS`VZ{S+O10o~<M%AcCQm9W2###C6R{Lh
z2~MVl@EZwZ&SC+_7AULelbAi6h6CC01QPMcz0R!l|0zOk5o(Zb@q$a@I9#X_-Siyj
zD^=se&TLc9nylu_d6%!;2+)JQ#Z<r5Vh*{o_Fp;He|@eu@V$v|^}M!)PcUH`>WP;r
zOzqxUwLW!X`df9bdD_Kq5|T;L7R{1Cs_=v??}KM~F`x-;b?0!->P-(|c+*f$#xtSa
z_C&W~2{*j1A-LCy?RJe%QQTM-`O)M(@psvWk;5w+cjRQqYQa>9upQURPAD;5&z;tY
z!3uLDg$|$QM9P>pSxM#$4$x%T<fFZP)jXD@ITg3eirrYin3BA(O9`lx4aw>m1nvtl
zl0s)lR5ppy|6v0~{?RqOwiahHzm<8LH8CU-eOXW~QBI%=&&m-;;{h3Hn6>(&=~bH!
zWSD)6{V%@mcFgQu({}-aXh%p+(Tb%Sg@~N+;+|ES1lGUlh4|}9VKp|L<K(Qh)`u?E
zF4j7i)+mNWA-=QFQtsbA-5m5GzMa~M5n1qNJ)n^tKl~H_AQyhQ^^gp^SZmKWG`t5w
zAoLiWkK1FtT3dRsx(fsZ2HSe%_be;Rf|uPNFNn`K`5)iKUbiq%0b6Rp5Tc(`5Qq)y
zCB#r6h#ol^=MI9jg9AaB?M%NhbH&ffcKVE7Co`m@31_QVQF48V?!)V!{mjNv!B@h3
zU+){~mP>OQeAL=pm%5R`yU<`s4WV*?=*$R0KMlc8doFQD+>EI0-swN}y@ic2R=mr@
z<{VU$e<X@UNI3*zt#e$YmXn#O#j;e(%DH~l@x~|rv+LE&Wkr6xBhrcl?Dt3c6~&J0
ze3CDVm9Q!Ll$cL1-q*Uc_)i35$aSJ`Cfnod?VwZ6vlFRlw}{yy(NLAn=JbGN$Fx?6
zT^n*lV-LH_`PMH(j<du4>!3+SwUR+}mog^uC@wM^_DHe;bp<<$JFQvdioL~Lm=hu0
z7|(Nh_fNCeHq;EH4-4y0+HW&XyRLld*KPDQ)m=w#ON%qQp$qFry@~5{Lb><eQ=fsj
zW_0Gvlws#uWH8{_A)jVE<nA1a&ih<s1Re(9g6lB($}#c!lf0DNI&@<V0<E&R=QxQB
z2@4Z|2b2~o>N28Lt_SI`dM55{d9rmi#(!~#NLk$BkJnK$zMjny^>@5HO$8@>ymWtH
z#br^Aq8@j2z@U<yCqf|aaW7pMqObU_-8ZDBfk!`UMD;cJc+YV=Y`%1qxo{Oy7LEkR
zY+!uZq0PgLgFx?t@y2uiguY9NU8;|E1tG?y)nBS)84d7Re(aWHKv<>!HsG>1QIA(w
z87Q+dva(b=JMl<J8w)`KcQY$1W32#aKo^Zoe%43QOf3hhy<5^S&~});0w0WqhSq=P
zmnhaHOW^C)J~J@C4b^(st#*=o?MKR-C~9PoGha`{b4LH-qdPxo^X{VEsKz0r2Ct;3
z*=Iz%Y|_)6-5~eTBvh_I9K|Jfz&uMaWM#&4hX0`3Ce*+nORe9SYQG&NC^B^4uU*Lf
z%QCFTvIMUD3kQQg^{&wfKNHD4j)1&TN@BwuJiF^~SfijER9175{)v{wpW5UCLyR$5
z5rcn2NP8XICC1=xoiIFBw&IlL^v&HL2EK0##5u2)q^hfVN<%Ia2+a#udz&|Szh|KD
z!&XrETerCH==`~#iM=9JMdJY8AUiqBqViw;@W8<09PV)SCdy)Nq_ZPdoQy;jXZYK3
z8`21iG*jgO)^wB=N#Ef$9MH3`0OP$4r9%+$EN}l#kKT1nxd-|gAU{q7FHWBOAa-n2
z(Ji9T8(eVRt<aXUdzgm|E{17TpKo7|uPO2ntPFN-QwI-bS=;l;yU8MWStb$m^}@mx
zONNzf7rX5YYG5bE$}yn8v>Z^SQx+BVd$?&N-*I@a!VL`+a1L+NN{M`CBZRGySnc{;
zldP*7!hmd633`f*`alCDLcZ%2zMB$l&m*OeyUSjXd;lc%;D<Gz+yB}*z0Z5>@N`1_
zQA1^|iK2q>J{tk~Iy@vI-Y`E@CdTzK6ICX9b*na7K4A^1NdkkXA9jXRh4<CL-q}IH
z>f$x{H@5LR5L!75_;nyqU*jf{VlK}ay-9X<mNP;wH-(G9#6;xr%r%(JMTh|WI@%lE
zw{g++QUwDj`13?IQr!eIUH8XUpB`u{a|Q!;2@n-Fpg_*)G$DVkS*aoG5TOyuu?Wn#
zD}F;T%3&i28kQ~}>N2q_HVLdS`y-_brrZcb1Se2!dj?(&)#(2IQo_u0Wku=Zj9+XW
zJyWrh<WlunCXD9G)resKZz6Mgg~*^S>|(KAoWe-?D#nl!MnqyXu6di3GFGf-My7@n
zPj<-QtV<_4EEi$iz7hDomg&1ci%i^k_gVE@7mVw>CxK}@4-s8;##}a}9NL=N-`s<A
zl9u927XRr)q$j{MG$=(vveeJ%)p=IoHruWTzWhAHI2Qft4b$i@4}bj4tf*KT-I!TQ
zDuC3xaW9-=!m+lgKGMyNwJA{h`}Y1w>NuOCqh-zJ5yRqZ4>Px?uI0y`!{U5itcXa*
zQOP0)ITa?&_C~5&dwVH8#Qx~07iakF`{e;rY*UDLGH9f79`z>-Dc4nvNJ!QaNXf$g
z74wY%Jwq4;1bn#2pb}CHXuyA(SDsQ)Y@SM(yS0j?UJ*lb*2Kco`Sn&9fPfqeL~k=D
z-6e0WUeEuwH1!RkOa66$?HdKcJLFm>^_4mi<p>{qD#5fc1fdZ};Op{_h5dRO9Z9^h
zqC-+w!x!6nlp_n`cAviJdN=v%4|wK61t45_Om&7>4XI&n$n$ca>q6=kUsQnTP-1>@
zLj&rUg~^HBFi695?mt?5e>L@gwRCJH2Ett$lO8^}KP46!^h7oUwB@OkhDafVDiY6D
z@(YJZjm{J_n8MirI+evD;5QOffLCp@(paAs>vGv|?I1V$gw<~cz8kHDsT3#hvt6n0
zLa>GmI+{bL&%&i$pKp_|zpl)<A%d?p(q|NT5$`nSZK*Q%`r?+%aj;^GxlR~HhDjR~
z809zzDb_K=TfqAE$hXsah75P1Bl1RRY9lAe<|g@L>s*<R_2z%9E(BCOMU0L$&C9u{
zDn-APpdt7l&MV*N9+i}%eBG`exLwd2JNmJrbl5nxKWAjdGLX4~ay3dfcT_UAcY7O&
ze0q^ds{&sKKg~Mt&+Ca-R9hNB*!FZrS-_udy&|D#DnG;_;d@XcXiHP6JD;!v2SD7#
zS=m)ZRU-x*CFxr8+@}JMBxzPKz+Ww(dGoVlGhgm%T;;>gxA1qJc`SE?>Sq=^L$U-*
zXXf;nKxHB*6Cx>Pt?eOfGy-Q7m}I9K&7LX+>F31PFo35WnSS8<l1VI@SQ#}UsC*8-
zf&d&#gNsT+G7Q8$0X=Fu-!5{*e9sa`wJDpE8r8V@7+OM){gESos#5+BAP~BoF&o?h
zRZ~8ysTYe;y`f}a2qdNOfoYV|sJ|<SpnP=XmkZk3wrO*}BlJjo-y(aLpcZ|9+xRdE
z$)ant8~;TU+UAb1{xX8td%ro9fzde{SYqN7#La`{kq+rJcP1?sp<klBe%pRjNG^Pb
z9G0ZLK=fOTXQJ@u&7KT=u>D%ST1ZyxR9qGt?%rv>I{4{HYXCz{K|#vLhpo17e`Rvx
z?cB%n?pUWu6t3n8M+SjMAT+B&ffw4*PNvg&B}Kp9HqCf=H>J><)#;jMtzdm{`yTWL
zz`%<+9+RS3nxUI;!)r%-=~<07ZkV0ha%U?r<Phq<s4bV$9b{Bjg6Io*%ME=03A+u4
z)5A>bl91W67_x&P9+;!=pQfpYB*bJ8$COc)F4Uy1k5To>l<-zsQ;zE`D%J2pruB#l
zsu%jytwL%A6FBp^ffWN$X>znhWmf13Yo?)GW~>95QwLk)KQeFc&-{GP_L+%W4JkHX
zozxi4j+h5UCvlrqY~Wd-M!jJZz4*K{zPPF{%@{DVqCK&<v>wLH)AuRC1D2W&1GJCz
zor971%g-<j6jHc=Y0X5-DAWEHgoFW1sTR0Sf?^mqX5-SDclyOnH5!04QYH+wfrO^k
z**y!j*2m?}PIyd+40Lzq#vLM!R%jP0O?vzR6dJ-i=_>%)s4K;_Eg(DV5Qb+tCGH7|
zldw}tdzxJCfH;b9)W?EIIVkh+NQkIJ_#8SoBk51!b*QU1zK)2{TU|rBnN?s!7wY;g
zykR%GXM+A)EcoDz>Oe_6Hj^(~vDMx0S-yuCka+|R18i_bu^+PA;P?{Ev{O*W%lgah
zsRtVp#W)bRVr`8w;;WYzi#AY{5t}DmkcQ^0_3z)!?pnFGUKF<N$5<`!Y8|2wVfOSQ
zr8pXITbeIvz~XBk0ob-)XVn_g0{CDUr2RPQen;VRS^eCNaLIBQP4-P5a1w6z16$?{
z9lX*krckaY_6OlEBr)1S%5}`{f_86<f$Gfo&n^n^B`Be~XcM-T`u6K{V8Vz~TEgno
zR*e8;KP91*FhuN>LF`n)a85=i%uXNsNk90R$?!y3OSxuB{`dF2%whf9@P<E5Un=XJ
z6~n6rVNBA{(*<Eqv+q*d6rvlReXYTC=96=T;0~jZ(rT7orsj;D#e;a6jlr_)`m4c%
z8@J<U=A2hgUUaj((1W&8i|!Vn)c`#!*j~*J{qgeNg;fAkr{F&YU+7>JgsARQV*hjJ
zv=+`1!70=zzHdcCyU|KfW6$g+9w}VcSomJi=&z5bj(NaTAUH2q>Be+i=6D}YAF%yX
zGcCj*fUD+i$6)(n1n=jIe`&#02R7PncTtUAKZ<;&zWW&7cgo{`nHLqH+-<*68><3X
z@X1CwaQ7JwAHY2AB##r9B~i)HXu0?cC<;U;6H(MB%X$8ZoM9Pp*YlvRk(9#juxcNz
znI<7Jy%yavw8I0v4fCG>g9`+qS&{|nFOmip3@bE4X10)beq6JCP;UD{lHCf*wBk1}
z$YLVn(`)u5oC0$E-c-0R*61Ebf9g&WxpoWyX{+|k)gSIaXAD#Dh|#Y<ghUpLMBkPn
zQ1B(G6(1gTsd~@MVF9tI7WaY{&m(t^o9a1&{ufA@)V<wJ?v{`xG4WFuvaGT`EJke#
zu|PN{eP5;^ba1*Fz&usX^Vf_b@3Oki{>$g58B=Bq&GiRf^z*8tNd=7;7@LFU7itM%
zki8n!=K6Dy$d53k@)~7aH!yG?DX*_6J(U|(SA?UOVEPj;+ID5^HV3a6#@wxS@kW09
z={&r=nHa(SA7(cW`wAsm=gLn}f>agR4c681GKS97qu%!R^GU)0;cld8SJuBHY#Cc%
zJd`KR&!yeJ;^*?G3XAg7cjn7&e2*jv(7$$^7BPT*dCkQAH)N_XSo$U>B^$0ud-IH&
zVEQ%nqc9JC><QP`AV-+|1!xnT;C6AB3a^G`b%-3OgPo)<QwxL@Cx7aOW*M?+BdN7r
zZA&h%@{)OA?2~)N=iL%v#$;^co+<Ya`Y_d&J0fHS{Qe|guhWw|w;EIWy@2l?8-*x3
znCY{a8fliBa}c&b1xCU?#F9t=makGH4{FTB{CDGNi7=kHM_#Lp;AKxA0NzCfIE2T;
z0p33zi(_{<c#Sn7T~}&Sa7}d+{F{7;UIoU1a`WR;j;<Rl0Qv@z%wJlW_Wst?+HG_p
zT0ZFO4_P@mM066thzK||1Ps!+AyTtwNS=J`WocqQKMncX;;bSnM9e`vZxvEsxKE1n
zu>~DWBIdoVfe5P9UHRtHWA&?UzK0aqh^zwSbLQf0{mTC{==RVJdjI)(qC=1bi%u44
z;4R+lwVj@N%M$axlmPs%$^^?+5ToN#Oc{ZP3E*xAsn7BQ-I>A(kB-U|g{MkUWYh>8
z=H**7D|Y9K3lt?@IHzaXsLlrCy;=3HeT74oPPhw**bK!N|FJM%YwEkh+>yvQ&-6J#
z*zUl306gffOjh5$A~h!;X00!?rZQWyjHtA?iz88)C$qR(fhyr&?5Rg((j3w7dg0LN
zg0*%&>wt&I*w^cQDgK}v=#KZJzz#nv(cD%Jt=(LVV9l`b4CI<>I>dkg$Z6wPr=C`c
zr&MfjVkGLFH-*K%vZ4ji9Iu&BYjdh0H{D{-<hdZ2Q1J6rf}`UeF7&a`rx_X0O4_ZU
z{uqX23kewt{*DdBX4Os3zKy8czZg17h&s>ot+QgqB^i}?)<sk1F)Xmx${X(a^KZ8H
zrI&e|P_v3*4@JHUb#GLggO&AzcY0bY48cz(Lw)XS4s;h7S%23Pm-WbpCZka<e)iwR
z*JFYqT+mHQFgyz%+&6^41UxSSwH|9Xi4tc(C`3OBE`O3A9M6g_^lw;jelazLdp4k&
zj5B=mu~cVDi3O<NY$bAm3{;rn454{S#TJWff7hn4TOWSilBq8g^*iSAzbcV}Ak3RL
zPbN)%pudDmbXrL9w8#wv`~H2v8dM3C33=A*e%1j(+y#u}<cCD>Q9|Cl(=TL!{T5D;
z8I6NIWkSN&^+YxzNc^!>U@K_maPb{D5TCJqf5vw7a?wqv8dOu*<$aa~)i`@saPK8-
zKqlmKPK|I^lqjkU(XdM`&tpPE%qSxn-v4OM6fK0(-h|{XjqhaIb08jWjI(?985y{#
zr`~DE{|wxJU7FY`ZkiWD!%>e%TW3^{55*mlDV+Zcr0tYZg7gSI0pA3XZSger>N2NC
z8VlRni0uLOz%r$17p#n{QVBD==(2?v0k%|&lcngIi)}*xqw8>fuQv(*ok7ly`;oxF
zuR#=@9?s~hrp$c>=P<$>DN+GKvoni%QG@4BfWwi2ger!Ha=QF1f13H>%`bRfB=Czf
zItc5gby7~8N!L@x+uhBMbq#JMTzcPf#zjaQO3OoVs!utDB-+Y1#N%%w3sKbdVyG(r
zxr6frP2qfzq9i)6^?5Z<Xp>t7(-D1!wX?(G!sBZ?<D09oW2Ivn8X*I4<my3>$i+FX
z6mOqNS*w4_fX(=syg=^Q4btnGWmAdD16zMB@U|F}sHLmr6lC@b*v3O909zZTpyB*C
zV)!z(qp}N-nE;aVd2>f1JPB<M^|4NxdqV@vSn)<+Ll9AY=+v1wBsD{qmx^#_gx?>f
zFvJvvGkvdSaoWCa!34eC{j*Guka$}UxX_T1iL^)G3x+^;J7Tct)WSQD(ib{?0SBz?
z6+Wj<pMm@Iw<oS0GAIA^u6#wG&~83lAk{14RGtV?Z;7%L*BocY3*<%T5Ht47AH2kY
z?=~GD>vFz3<175$yTvg{!~*`t!tVEpWm95b_bUYOc~{M*gKzdLALpyTg`0gmH@A45
z@UFFa5kYpHp{4qRvcP53_2sd6XPK3}y2u<h;HmfejGc_TJLd7RZ{HYiEuY)oXqwB8
zkEwP;`}YQa;tn;Mvgmbmx!1`wxk{)dovV+vVnGDVPNEPt6$M(NWM$sEY>0az@|4z3
zf50*n;_hB|3R?%@$l2A#6!EQ?H!NFlt_&cxOge?HC&T3qz*S~ykqG`uMwPGWrxImA
za1*$i*2T9lPLlk6H|w4H`0QEd#28jU8?8L=AYau;(a9L<{)g6lze!&BxdJypY;>p~
zzJx!h9<$UneP_3lGv}!eldg+-sGKjp<^aHOZ_Fs;!Di-<6K{%Kn-{mTCpcEZ8K~;v
zi4#-gw3Lo0pW5?f2ueZh@((&55yPHr0+rmlv~Ff4ih-Y!qVe&|rji_d%;=QnEH#>l
z$0hj5p`WLa7!lh6wd?RCt&Jz|H1Ko0S#CUdLI9%p!71-zo}U2)8Ya>O*ztE&w`^)R
zUNHpg?QN6@ZXYNSna3$;++M#FzH6VFT9akVO|H-+X3ep;w>>i+M|f$bXK9hOIp{vd
zj`f>IM17Z>jxkrzkdq;23=;vI-^%|jKIA79`357KKpZ>$(_9XEZet{T5Gu7{CI8}>
zGl@*5Ks%6lP)<2aw){Yn0b=Xix#^3B-=2{p?c0mb-&~$2f|Mx8q93m)fj1M)w|g08
z5M-aCrzQp=H~v^g^=BDnVL#vPeunJ=$#d21Cu~yMz`J>>-h5l1uxO;GYqv%A?hm<g
z9%h^p<ySjM=#0V^m7Ez8I_le443M3=-+{yD9!B_j8qgNJq{wX8p^d+Fv(MIlDsaQ@
zvkqejA&qEi&T)93`kt5LW*$SX<nfb}E`hIC0v!*NYL`8TWHYr?LrG}@1{GCFd>x<h
zTIJP~p(<f`$|NeKPlTW5M0qz`BO9<lFBRkNrUfNU62ecjtjQ!@=ned|7@go`!BSyi
zLox;1csR#;8Gj>x&yXxE64`Qi+43LXb%}0mqZ;55iVWx->IcxnXOMG8M*A4p7nzGy
zW|c%eHHnYvyx24Jf7X$c5F{!~_~SHJ@AWh=#5deIu)8W#Ihr6RpHvKk=Co#bMRdD<
zh7Mws?kxUzaXVcWE<-xHS@PWWr%5no8esZ2`t{QN3&~;D_d!#J=<zsp<(Wnti12`w
zBDpCYTTnd6Zd!_PL{}<n!yC~7p#=-HH>ES!NrO}288lp?ygD*7grfTmS1LJ$T1co=
zYb<g}^UU6k;;h@4G0HxVpAQEO4|nIP`G6{@oFvMNS8@3l`kU3&@QOu$)WaC)YIao=
zm~O!`IGNU6grY9=t!r1W{)}@1+QlKIRY@Hy-0&V$@SojanG+&6M<)1E6_Vu(lXRk5
zw1>vFLsiJ(KCT}T6{R_hWD(Rt<Z@-}irTP^?Ncy04?LgyJ(OP_;;-q6jfvSPsey=q
z;K6Osq0eI4kh32264deZEVTVzRTPf*+tacqOa=)Vx$p~>Yz#H3UD?0Nm5}*zvLeXE
z2s=@<jWAKT4jBUW?OAR->6wCXH8U1VHeHTi&WWx|A0H#6sypwO?eDfjLdyKK@S-9k
z8aMdtFZm#{%~vn$L;FWG6zn}FVI-;xVeGk>zNjY#nMEXIq(M;9YwLSIlRu=lU7!MX
zdtm4OWY{k^V6nQWa7jc;Ek0p&aB9QxOH=dlpMO1*j0%SEWr+Wu=@PXwtJdTd&uFd)
z5$NSsUx=Y~$b{r>xCJBR{@1zs3W;}$LR7;i-Fc)ItL<sqGp$E976@I@nmxWR@;&F=
z!YG1kmXHfp5IW0=1hoWr5x0bDuYg!_gB{1A@u^1FE_A-WgcWVXsNSMHu0Pe;e_Z%y
zSaia^)zFiG@7_Wm|J`06zk9CH32y8JLv*z&9$xsASH>*YnvJF2=6U_o;!IL>)MQ{2
zOEE1!>8$#K{1vWq>(^lp8G4Lre#K;C@p0IS7Y3K3Fb!i)&5d*+FFM3-eD>FKV)&RG
z_N6%{6PLQX-aNmXz0Ac~UM!3p`u<&$5q9090zYNM69iafpQWSPe`7P?cKKpq?VsM%
z{MwM}s4!QY#f%wQ=FE2k2lN!c7-yLKY_5J{qfVFp%l;7r^`DBihk}aTUAsjc%%MRk
z^&@6j|2rWc<atNcXIaaf9Z}BcneVWYivf2S?+WOTe?|C855(>vcJPaP5_2FviG}yW
ziOg!%|IEyj@=Li%%1Na(t!Xh}Cntx3aA<KR{8kkv0(ZBCY-w+_{B{>KMX99vj=Chm
zyE`Ek7M}lU0bHjyH@*`JJX`xcF>7_3#C|N?xV}GZ1b1_|Yu>IGJfM9n)lj?#6ARlf
znw=AI->&?(!p=4&q`F8rtryLrFz#MlAk+VWmsgdysHYE`OCUus5+Uhu;s!ba_haI>
z@aPY-%^IjHe0J~$QTLWaKhRb_5&w(gsJjsY4=feKh@w*{NTSnn02x}3=Vwrhu%}Md
z?rO*ZBi5OQ0><X`v<}>qfke9|_|0Dw!QQJSqG?+|3Fs|us7yfUOv{nlE4N#`l*lWu
z6~&v9Nz7B^&-L9l1^>mioN6X3M0!&4;KU+7BksG7pS)=X9iwceSBk}2P9N2}^_qQT
z=RyS7kSgswC*sZ(d$TngV{@L3tT>zxcWdtiMLKKeapGxn^~OVFU~z*N=VcPl!pw-_
z%pp4pm$lE8X^2&K^m+mN(_hWEgWLr^2X&bcLw_UbZQ{lvRwrmW{S-U(4Fz5P1Ww|e
z$1cpr;v#*N?HC+m%_9vCv&WgHb9dn-E<}tR28nB37EIDaDx+Mq!8<~0XAa9VA}-L~
z_M5#^eyqvCxs!d;_2gSxd*VVgk&MU$$89g0?<8>Fmoz*}DRVm>)m$AhN<JkPl@DS?
z+@&r6Ej{ClQD9mW4QZ&`<NLau4cB~@15d!J2cMoh5N<xuszDyW5G^f#(_GD_^-1{I
zs)ZD67YZb%qx-+jVI<fW3UB2Na-V;kxZHXVCgirC4t{xhdUJz3<Zc39>qowDL^KQ8
zcZbEFTVaspLHJ6-l_JLLd0FEcy~=lsAr*}Z@g?6zpp~lSCwR9%ri-cT=-|`<p8hB>
z=~aE-@qnnwhM4S*W=lT(mjtp~?|Ze~|ANOHV<zb8(7P=Vzmq<hUCNTDsjmAgrMrXP
z^|;7jgrHn&;$H5Q)~N4L1M6LY+d6gF;fCpp56q=anq|PE6Yl*VNccs(bF=fxpraF<
zc5dh?oP%B&dVc!UAB)q}<4e!jLxu#t>3Au`oV}rM14^dY4QdlUk{a1)@|;AzX*kNb
zBDcC!4ZKti&d8u2#%zklJb;;_VOw_c5&MXFdvb*4!BJ7q!pj04f!LY}cB-9F<@3<r
zyIBm=|Mvg3&?JtlsYbbJA>Zo6%2z7={Vp=1?^S_>$eO-0Z~~d1#z*qs@4*m%ScV?1
z^Lti?js3h-)}y#@RHHG4TUpkXG)~`e?}C|do-1p#`VHHkFu|~Wtt6c6`H41xSfw3S
zolV>Wp{b4_@>%47`;hVt^&U7sZN<+7Oi$Q#%!uDWz4uN-qUpSmgwN~X$B0+O{rRQ<
z%RMiM?>I4CrBZxKhw6LiOL2DmD{+4^b1|su`+bw1Ka3Zdl3hq#79@rRkXxCVyOvh0
zPZmXpa`iVJ=J*#(C8Pn+%49@nu|<WWezUIqonQ>$-|$FG06xcV6beE2l>FlJ=|MEV
zTAB9G$}RQ@6(=ubaL?CqnM%V1z|HLmEf7289z6fvPyxstRL3GBY1b;B;d5+!ey*#l
z%N$qQr>%D%fCTZ3;W7VXHf)d|N*q@aWx``iFyeJJI6ZZ!FT!Ir#;*@txYjW1e!9DC
zUsgUxKR%W_XigKun=&Qla+BOGr=aTX-kIj>%fjKIL&2Yg3@wuImfbx_!~K`)Y+#a6
zZKA4>N6&>Fng<lunK8^3Yz0b$AXX(&w8qCesK1}4k3FO1?1eBYAmJPMB;lFRmBio7
zl<^2rYmV>aXHN!-mZ({Z_6%o{y6DH1sjbRBjl^rxd+6YDmU|>=XTt`m5Z>NpPJ>H-
zc1<Fz*uuV)H{1>=b2m*4j8yCH+-7)uJ&s@E_Y1&H*vJa)`!{yAU1BM`mK!bN+-hkQ
zr|&Q@!?n&ZjP})e&i>)ay`e!*5J9h{q^j16@ysRvSe{Xy#SIfg5aC|f1I@xVTAx_w
zjqpSwbB0gk^EkQfnHJ}P80e$j0B)za5D_+u2@=7vZ{;S+7P2+pie->rvyql;#LXh)
zY9P9mui`TwDPUM!5-@Y3a}_jFW;uv=3&Elaa>j^$+d7XNQqX8eXncm3Ie+;KJkJXC
zy3p-4%@-d<YDERaWhIALY`sf5U(>oE7#<F@&m`mFd{H3&hepPOE>W;m9P-RsiD4#@
zK=x_5iWN)2IY_!+nkgQ({}suDnc8>vfkwv0NcigF;(cfhgXGX`e|xFkN;WaiciPo=
zy1C-_(>%SXsA)ou0bFse#2Z*k%>uGB!2Co8+33G$Y8^M_fm^Hlh-x|wh+$j!J$W1s
zPX=+TVVPCE<+`EMsq14G@6`qQ@uvyPWBHGI(h(DV>4?T_h)`h`Wm9m4-zUZ_u{2R*
zvIr6TjG1OhM<kXJngr?~r^G6(^GZ(diWa?H`KK|{@uH}ko2$_~9EjEbQ*EQ$Go%!K
z9rPrAw<a`gQIB~$Yqb~1P+>W1wX{<7c)>1dolFwlH0#5`$jaX3-x&j@lbevE(+Op1
zpOo<THYt(**q8YEI{`CU#7Pg&#mAi0jI<4=<?+`XfTeMYiR9Df=z~|q`gW9X?MqEq
z%WAOEfiSaBI>w4FS_9FY^<wh(h&u%8sviTdcsI3sr%v2n<DX$!Uif=`sy+uyF_kF1
zC1wX>__Zphni>n13Veh8YyhBBr<)&8G9lwBOf;lFjv+?y3JGxm8heZaZ4(78x2ZW)
z@Gu4AV3xYki3Whbzx0GoX2go6cZNdKyH|V1mxAStB|Bn>+=UZG00P();<;%_H~r!Q
z$BMiDZ-QoB!}E9nnzP3bko&Wc?REr63i_R@Yfq0-HAq@U=2J)w+r)kJge?UDL?o3Z
z9Fo<cPfF^jxMv+Lq_%7k>`Q3rrgJX_#d8Mmh_64JIoM%M^&rC+3T^)wWxoHdV#&mh
zipzCWX$$RepC^EkTg;VgGWD1DI^C62zn}%1q>$4qW|XJ5hVxSs4?&IIL9b?t)N+>g
z_Qcw6f1y(&C+q5jp<7#_<8{zqlnhAX&&inE?lCcOC$CAvBFT#<F1iUL9_|qIB!kZ`
z*1vf7K?Ct-BSzY7xhPjFx%XU`{rf-$mKlxh%N&7;f{-jWe81<fc5=0cXNyZ3ioyvj
z5ZTw#upE4y=%&jNtJfmL_m<2Bx(Lyrw=2k_8Iuaz%DwNTlzTTERl1?sl{`Jw|DHxS
z`m?@I_W1{bB~7lrGqhgg{&~&xj;r!cnjv*z^jXJ!xqO{+e|I|uP(fqfg&Bhf1W8YN
zei`ll;+f`NmLjDSe<c0szt1xHxFwaL6$3<PGsFdwF%_6*lOC0gj?{vD#gy^+OpSr?
z@X;FL@+~!Dy}iBUrJ^|^09U}$N(sdiup{Wr|0+l8xF}JM<O@#hV?P`<z*ADggMdWt
zM_=FID^OwD`R4zlJH#JP?xs2eu@LSe+`d#JJSILSm_<I44U;y;{16zpIX>Zw8<Sp_
z?y{dL6z!u&HCO9nI*yk*XznZ#?qF~@NPu|k5Fh5x@#XF0x_3t3Khr1@_v~<d)tz>C
zMWhqppXtfg(O0QY=FRqGr#||U@~0<a9Iiig<>#|G$Ei`>z#k@O9c1S0I*Y2QO;P(|
zXYK;?a%i1W#Y@kBk~yt+P@UdZNr!8Y$s6&u=wSwHsySPAz2MX)1FjrYsZ{MJY#_a;
z=SG|csj?f$s!0%1Hq$R=u*8%uKT=kN5w<bb9K8uU`LSgXuB7GftleLF7LO?{xvMXj
zj06W?5kE*MF??>dS4f!lO1DtcgXhgRi=wH<rr7z!#O-)DJ-=8`sT$U$7|kGbw)ogX
ze9A9|70~uO{v+^FM%lW44-d+2tS=lQsDD=%52A~lmD4DfVCgi!OSdw5@f5!IhCjU{
zbm&u3Y0}4b^5c%CwH`#4VFBU_D+;^+_FZk^z$X!n+W}yY*LK#-Adxb71wyWk?~8E+
zqTeP%aN1`T3Q_;YY;_#!*B(++GA3{DV96AQJ7YlVc)1UA&PBqHb>>dTcmEg3yCI0x
zV=#e?%#WX)d{@ZgFJd$~FRv~_vb7&1*#nzLjgAwPyW>SVOR@_KT9Y|{ewsDawezbJ
z68<fMu&ESqdiu2>Zv+c8flCVA{4;cGyjG|PjW%3|T9AK<B7KB5Ga@-bHBLr3G|%&9
z*8CekhQdkQPyGzkzJ1SM$8&H%79!7KkZON2tO5A-Do}WXCtB6iD5TkC#A-cb%+~|C
zbJ`>($k}i9tD;dRRnXtB_L?MHccbssg^GKU6mD?V`XuF$yAov_LPu1d`|^xN!eE|3
z!%?_og|9;5nO%G=(LOd(Ynzh?M7Ndptj?C@<%Dp6q6V$jwaWzj-6X90p($mW*nu8D
zmL$l?@iJhkyp$$8h-Q1Z0LdgB3v;RbRF-|Ke`5%rC&*`l&2V<XSQJE@CM1^TD{XwW
zA)-$<=^ag{F0`J}aVG@y?l`>FPF~D>+~=<Q=Qx0Z9KPHlijp2(&%r7}*s&#}yayi{
z|4Bqu>^mV(TyGz~cM*LIqJ_0O3RG0YDw_R;w;$A6_^fxuwkGbU7#cbbx8CQ?<g%6)
zIE~C6+$#Ka6w;?oT`Q;i{%+_cqK9ic@{RHNgSx_Wi8noXu$!A3XG29opN5Dom=jd%
zdu16N=MC?uC*Z*6koe6_SPc^Jv2@tZ@cPgcvw$db#!GZIrZJl48xyIN=4&4bk+xJb
z`<JVOUj+z@wDYi2NT&=8^wVwswlU)U_DUHsOhHs}MnG*Wldn>eG*qFCYw9m}UbH4|
ztAQG-8Xquf#@!jeTjGBo@g(ljOu%EswhE?$^+zVtbV4etRfP(}#|}!Q5^*c-2Nmfv
z`{?9pv3|xeucx6jJP>58Ef3($17wGmu;JGnX2Q*U9|ERdPncqnk=}q4PV10oiOEto
zC%*Iqo}REsIJ$E9o{XNaE1tI2L8%2Aha#FOP`&61S?bYje(aoy0E<Mcy<DAsMzqoY
z#w!pEk~NVBJ%s%f*S6X*rBAj6Cqa3AnsNI6!+CWF;TLU0u?GCgFUx~GudV=hRn==6
zfenF&{e9}%oqmPYjf1Mrj~lWdvRsUdPaO-UTH3N)%pbN>H=-{~1p&7mC9<tbOofaM
zEf3b1h6sFI%nS)>o=2)4f`a3iIY&?_6_D9AXlNefExN2>gf0;&0%Ax?<jtHb-rc#d
z4HvJhi22+E%)_e%BLiF$1&BXM__L4^CaW#_kah$faDhY=iqgC8rFv7op^_LW-#sk*
zfQu`!K%Zvct!IpIhM#0_jSrqDQUn2wRUV8L9a^zg;}2?g(R8!=IYA%8!^5uw@p?Iw
zKeBEeMiD6fMO)i()dXk7iJNF?(S#f7i=VNlgTH;M<TA=jk-%MYr$c;G1GH!N(>XUT
zsz~hD%$E*1%&Y!JBT*ntkxg5+^_%7{pm|e0<o0JYr7oWZ32^zBh$5A5hZPL-k)QVP
z3$kNB&+>y5iwdgauo$)AP-$Ux^%%ZhXwC40n^ilWXAnBxB}gY%O{1G#a5hUGJic1e
z!#1oRU)D6pL?#~#MvuTc|Clch7cE1v)tCQU^FcppFq(dz9TsUFD^1EuVML12in<H*
z6F-(Gdgj}V<y#<cbP-ilgB)*0;{+8rE6~eLFP^+5_5s}kDb5PTDdH2NuIUVmycuy)
z|J?Zx+T6(Teo&p%27l!`4-kOn&{6sVn5FufLAZQPU%)btB2@;Hok$lSq!$Md&v^Aa
zv&WN|_A;Bx9!kbP(2$y4c`j{-oaHw(;Dm@|=~HWQLRJQbIvv}E3nT>t4QDH<nX{$n
zH=mu1UkCY-)Qddvt0#(YD+}F_-*{3ES>X9D4?38%3-|CxnkaGP+eT~z#W$#iT+uEx
zQ02NSvemYWApK7v08C?ZX(I5g&V`k9BZ<USu*1{yqe19|>=lLh)d!L^?iY_&<*Sh{
zdPoJUKnBN^EaW840{QU)r+7^zAQ%yQO>4~*moobB6KPu<E-Mkktsgm|=i7s9;=Ys+
z|FJd#JZ=7j`PG2g@8DzcQxy9>2^p^VPr*`$VT4#ZRNwhLJHC}UC?=|albAc^i?b$$
zRWQD?>)vMT$-{P|5z*yBrEtzWwO+@&20|W@>cCuh=C*n;@AAY_VWU{K3E}A|@XJ?k
zTkG#-wRxsbKPO=TN-;@|6(M!G+|(`AI4t3ipq`DGy16CFQU@H)2R2+4*hqVlVJr3e
zRL)pgktFWkzbU08d#YyVe_l!w^51{&zoX7@|BBu(&z64LyQBZc3O(b+7?BP~-j6*P
zKsqnWgK8tOcx{Y%f9E94MYDqDVa<?On6gTt_USqdcFcSNyBNc+3L`*$Wf7Uh^?MO;
z-?J;K0L^#vj(Zr0&QleN3Q*f4MrbU}AoBs|k#>c>=l@Pvo{H}MzTdZULAtdilqjKc
zxdS^8Z2Z9dEyRiQ+-J!f%nNMt2E!ef>^@)K7x5Te-d(=%(puiVll3mfcHM_JI@mdP
zP&vzrD&O8-zD0@B8lYpbK%j!8z3AW^1?L$M-L0%pitukJhm|ygN!H4LrG&-1sJ)Yd
zjzZ!>v!z4I_^LYRKeaAE)avEMQZh=z-HJunJ<sZ2@QY-{|L7i`D}}s|P#5sfN*aA(
z;>OuhPh$Wwp?u+(2RNO93(iJmua4<3c1p5|u9nXleRp<*bDr68rV^+N>iLo&I5x3n
z2#UdJvet9@$evVwUuj8JE+f^4!u4$5c?DCMC4_*BpVDh#fpvCPgUi@shO-5o1(s;W
zd_9asO^$ql9}gopPHOJ2e*<QSeF}=fGqDm`UA>iLZU(DBk_*3zyN|vNL92Zs8wy<O
zLiqsbkX3TV!x31nOKzTsT+l$?Bn%VUE>*w-Z+?~}4>o1M%)M~M)*KT1Gd7kez}RSw
zw64l^*VjKH2rxS8+kPF!!vx*Hv8dP+v*NCp{Z~y%0C6d7W-SUK=FMK3=@bc-KGq72
zfXiYIp9zmZhF(umAFviwW02hmYQqPJoNnvTZEvqB)sqfUA&DlDT!qL{{ux+6>PH;d
zlM}g76>Fj;m*Z$}-;xawoX*9K2?imkJZN;@Ef{$KR2o}_$ov8wy#e>I11E8$%qs@>
ze}8)o;N0x9cASZ>yaWjP0)zG4gXGsrLoHa8$eIWnss2TGo}XGn|7{tOMAVAWIxj5c
zoZcQbv_mnI%es{=P)Z>tP6%%b^rd&4<pu7a80IE>6G+Mt{cS|1Zzxcgbp(#YVm>>^
z2Abn*)**y)chvDAWD$~R4~kQR9c#~)PzCXeJ%z58>12F&@_DzGh~T$}b*?|z6_)U2
zmRIuWG(40fb&cZIdvi%}%BkBadGk4x#|i7m4=e~bEsf|33kX?Z^A;^P45ZTqoBUi~
z6IPF*_29_!6~S@vdZ+9HeEGwQ9XI%n#tB+F=aXn=Ub&{N*e_QABI#tSf8#&~FpL!i
z6{~A|9~2x)r%wNipsZ02hq9_bVxQTyjX+w(3F)9p0v#HTUB{&UU_rb3PI@_#&$?JR
zq?%b|{f`I(z(GRR=tP$)G2u8=oM8A<S{g`eZzTSMg{@yokHHHpG3X0Y)Rnq3|Ng6X
z6^->9sV1FslBl)1mK@|)MCk@hx){<oTu5isdnk95!jjOWN$N-nfoDw)h>na*i6gEq
z*J(e4IePLrb%G<{_shc=E;HBE)vtP=t(-{b^7P76<62*X04GnUwY=PbIJI2C#>=7I
zi{ftasM?|n$Hk>hom9PsZ%3~KVpo}Gcl82!T_1Z#+wVeVJ{KDSt^TiMkUzwpeW%`{
z>O_&i#STfb&P+jz%Qr~iA3uIrj-|8cLJ1wGld$CF%F2ll<dpIdiY^sw!nsFt$qOOB
z`WSMKpS3$U>Z$a+3(|yVMH!?bz<b78#4II8_0Lk;D{2*hRAtSbnP1Brkjm6!9uZ(k
z{he6^tJ7lm#0<lmT}yZF)Z8z7e+aMVNj_h`cQJGSa=?!a$qidrmv(2qw9r>lLpacG
zxX05+)T^+XhO?`(E@RdeW^Gz4am!#JiyHZwAu;jXAb|H{ABOuDo2r@ypQGd^X|9l5
zz3A;&mpj{I#@aUVUb_UNl((7o6WE?qfe5|~es=W=<DlqT5;-o>@ry=1aZd>}QrUND
za~sC=j1ox=TXA<I7)4f`6z;G=3gkq^Z5u@Da_+f;!>?8Fz@_Aq5;2mY=lZW5Vk=3q
zZ{dOf0x)KUoP<iV!t>&5U=F!D(-_qkeO$WK0Ly|vazd{3@m^*#pHI`IH;>8fj_rNY
z)dDCs>KkPu7avpd+Wb(B^Kug}n0^$!$mO>ZYuxZNel5Pp7fYgM6IWR;k)`GT^hjCH
z%>r8eG}njlSh-As_s)*i>LFIc?WCkH)nx85hnIE?FSi+duFu3S{KCOj=YujB&P#Q>
zJuDck!M-bfOg>_D0rQj5J_sWIA4L>8Haeqgi5CgqQR789Z&?3Loo6=3SaeulAxo&)
zLR^JTQKb$v{?S=`+k<L(O&!zpw!YHXp3m$Nk#eK)u+l0jXaOK2L&F-2z9@%1FaG1a
zGeHNAP`PE(eSEFC8PHkV0mnb*b{o49--KKHv{3f~w7^`=OL}Vt&B~(f??>z^{9wjT
za=mCpJX-p?RLx86EOk=zPdZWJcqLe&GokvV-Ix^F+|y?ibaJSvjkQRixZg?zl}K{d
znK0SQp8UR|D6S?`1DPjfzDJN9qtz&q-=9Tq8E!UzRHpV9%RV>vLy1=G{x^kkXI{I|
zx(o-1WJ^fZAx4^1xR$Lv*Xi_ZhLCo1?zzG`0k>qRsH%0ZZ_V-s#qo=7nZz#+b!^g^
z!U8t6=^oQ|fy`a}nWYS>l~>tl``s;U6p&nBoNUI*GOnve!K61iL3DKTj6h9P(Bzqv
zqs-1<+taohv`>|e(!ddMlrIs5g2+9zIM`{Sk|vGFCqfy8$AQU*_^eQnp!c*(3Olhk
z6J4UhR1J}SPLvFqsVpi}zvv<w_r{d;75BX>Y-+LU0_+*loQV4ZYzCR1?YDt5y-b7F
z4hrZA$*>UT9l73hRbp}6;1(*k>DqTl?_A2{cXS(LoDI?0IW?$BcB=}W_3Mp$qZ8kj
zCqD%V^|LxG?J5I@%VeNLjjjFE6|Sj=a4GU?aD*(&@9P(vk-l%7NiHdg{!hrklZC%&
zV6+>|BZ=9p)u?@j!{FoTQ_RNmyF<{4;L+aI>p<=82R>C*=fT>D5yY(!CCJb0a6Y`O
zseH4Vptt*hhbpt~)At`ldQQgeZtx}>UEkie<(fq6F8MxgiMs!@xVor9t9%6c9!Xt%
zb$(?1kQoz{)P>8_e2(s@L`M?9t3tm(*NViDKC+U<v`Q9LG|atqGnQWc_zsqPTOL|_
zD35$#E(pP_wRp2_;P%-(oGEQVCl#i)uS7-DpT<glpq(B11k*qQk^s^!S;43$8WilI
zj;e}_%<s03gryEDkZUz=EqPC*(Ci36H%@!xHAGpcpg^GlM1}_n=Auw0e=HpNeS$if
zrS>~aRhM(9m8{2<_*4+H+(ej^SRLAB%>z!WU45GQon~HysnIC7>cfdvxi-Lm_io$q
zqyeqEG2AmpwqN`9eK(rd;}1|r?;hyFVK)qn!crGvaYQ`a6fNUQ{WerkpzUTYoh*U`
z-pjba$|P|FvguJ23d=hMv1W;*CEE;!FUuO%LN_`e9HD}5U+Le@Kf8Wcz;%9$4Ga!%
z75~MGJ=;LhdqOEwGZO+;6xzH1mo|fY0hP2&5c>xuwu7-e$ex8TphQaHeD`H;k%Fqn
zU;CZnt05M2v=aswL6fc=ssejabj2+L^}xOzSLN*Bp@$bLAU#@kRs#5YukC3lc`#Ja
zQ;YvRPfV%Buhp<AdwgfnDuI&(1;7t|m#ATxMV@yZ1u?`P?ubty#=S#xm(ZtIUmk2I
zRQIg<J;XG^M-tx$L(I;mI`TSt%@}26N2{RZFi1%3tC)Q_j%~Q%O&cxyu9r&8wP)(W
zR|SI4vsk~U?*WqFwfFe+d=z8S%gH}7ObJXdIPGdAVvXY#@ha!2orY#-5c1-I==r+Y
z%lQ5CGwFuk#`x9k+d@Fo)I%5Px89*OJZ+DT{bbR;r@7R!V~!Oqr?n2W?$^C)C~=5L
z#pm&MPHfAk`$gn^&+HwCAaiL|r@gHeg#a8?gLH_trK^r5?Faxwz^V(O>SsaC?g-DS
z!hF!h)8(Fio*^hE@h_$`fMa(NsH`MaA>rJU855ZG&y5@Gg?ELalRrTXTfeohktv!-
zVbII+CSU~4L|OV-L+R2)PzHK5=)YMb_j(UVLF%J&EFgE38?L)z3N*$X=TeVl$Lrh+
zeJO19I=OkZ6-nA(<p88Iq)E==lF`j@j+X>ORw5{&(?8DSXQ1-^Q}mI%420!S->)Dj
zv>>AXw`yyuHd)w84GPOYIKJBxp4_+l*LnTn``F&<HNqTOL?W`Xzof76=W87}pd9AH
z31*4FU(uJVoIkfu+EUeX!BEgZOKP}mLVwY*p=K+dPer7xTnjNd;Jy6AQrDGatHwD~
zP@Y<mVY5aln&rUq7Gy;x762xt-!nDx0@!K(@DPv|1vNg-v#g9B{mk%Y;r(G9_a-$k
zERy^esH-DO*^kZY*`8eUM?Jh90{1O1jkke)FdiGEO%@5nmq!-_EQUU-wgEU){H&KV
z=bIpSE#N*o?Q!v^1!9k5zJG12O@G?bd5u0TJKZ&R2mL3**M+Ev_&UyP-kvQT*a!Qt
zP+s@HU2GlSPZ+c1yNVdEb>;I|MO}K{g`9jh_$9D&ei5|R*_|sgcV_gE>0&mO<Mwco
z!Df7aPn9UliMwEXBNo6YiG5aY*XC=(miRv{z+2D1J~`i(7OSmQc+0K};qj~M@ahL+
z!7c2YeP(hcWXQRRgt8Bb6>B%q&o;!$2+1Z}qm<uyxd=6TJLYQ%dciX8Ry7)~CKsYh
z6goCwb$L~lZo_~U6sC-WrV4LsYFb#<s5a~Vwrahl&3(vFy#2$&SJ{F%aQv(+ia`aa
zup%TvOhUfwIA_UyX%@${=c}3Pb^VjKj(z&h0?r#J_1PTc)uaEb1vBYkfXYQpP|DDZ
zkj-<?ZJLluS~?P)U;-hvD?8lI#bqd7Z0&nWGxAmM(8)mTN#x<-SUS{NHsxVmE1M1i
zkC|dKSBsMnz({|LLJ2)YB#GG4gPzs~@KgJ5RpOQxs9iH6jLMDu7xr{2Jk?bQu8v8h
z{ozRO7De53Nu4h1fv(UMg&I`jO!W-AqNCX#;AGp`u^=%%YwzTZz_2iGta^%AYMLQj
zx_trnaRKL_g7tdjqX~r5Ksvmam*#?6wjW-B-}(q9Db-Q@RSta=XCrO6gHB@vm2ehb
zoQ>J6sB<`S>v%AX+RR8tnuT&2N6CqCX+pE8^yTU_tXL&=?Sw-O>6s{zz|$A1gLTA_
z<m&ByNr_p%@0oj~F+oqKu~EjSf`9;ZHEJzo1f44?pZx_TI+8|6ZzBGcf`0!t4?g~v
zO+UwSq<r>(&BDyF1VA$qs_Svv_3^MMTb*%!_GHKAX?IJ8fWiaLWHOs8pZ7=KSYI}7
z^(7{>SiXSMThZz9o|0Zuo`8pJoG|=XA0s2Xu<GWGp>LudT}Exb1f(q=62wjy{ace%
z_O55*b_W)1yYS7G6VB8Qz>bdOAqItbQSVcHSMm>tYxZgY&n#x8*%f7ZIN;^p+0)DG
z(-^M%H_KaUg&PWWIcZrg>r+S|)T%PDNsKuMOy(>E-e#@>C&69A(xQ@t>MvH0W}U-8
z$rUKBN+>B=7tCrImth<Hp=2>El>-^}wPV~_AQbR|q-$uA;$qCDsR<*ld%jAaDu_pL
z5Ln<SuxryvIHSsW{y>+JE7b6DAjyNk=uAJzj38#QNZ);bUUZY9*IiWb9d%J{VpCo5
zr#2_f(nOe6v2fQhU{mT(A*Ux^sgd8bDUyR;^9?4ELPke+D{>1~Q%A(bywMVN{|A3T
zfW8WarYsOy9g!ftxUrXm`UM3Vu_w7d%Q_ipo6}(fK--Sit}I`t=X!;5qVsWJcq4Ya
zm5SIF1wyNW5n8Q7XqA-RL6FuPLq%GnPL#frkM<FQbRoYP$%mHmYe26J|4qZTQiSDj
zQX2HJURvBGyz<MUN0Sz9S(LyM2YJf5+6UGWd@Y|GB<*_iHI*ksEw}s0kwaF>bTkc8
zN1cs|D{GO~76VmT7|R|(rbvYEPQ`-MRpRb>GvV$z8}1&oh1-u|Wus9us6G9-qZT%x
z{;>cnegt{sj-(G>9$@LLDUX^bGcAXW+wa@K-7`U&VEym^{!8(<zkMnG@|VBzTEabh
zN`;%78x}2Eg!=k=96fpzPd)V%IyySg-hL3o)We65qPe-1C6osre3%a{>GkyX_W75G
z9(pX37(L^YPd;%83JBWi?&k41Sx!h(?(H?>op(-)XP$Xh(DKFSPQHL+$DRf)WITWV
zB6Z24v9TE>o>NH4+i$;(zy9^Ff;#HYKmQyzZrs4g$Ox`py-J&Sk(8V&Yt$sZ^Ew;q
zr0GCWtCM`gwxFgeDk>VIN83SqN_w=DjOj6lijzni&fx3_z7xtCjv(%AOx(tTC&!d>
z$-)0By;4y4ztRF~+Ha`P(5Sc$>M$(=^}$%B_lG7$hvZEu2&;^Pa(5(j<#EDL9WO#k
zG^|J8|4IfL&BfyR+xOy?TO0ApjdeW!O`2}=K(g4|pCqcyiP+zpiUvzjcSz8-1-1>K
z;izmNP0(g=PbP<066`Fw%93r3<3@+_&^lNwwmrKVG1W?FjUnt$E<C<kG!IE`4<7BN
zF>DFc(&+jC<y>b8)^*21S~!8UHKnfAoQKYljo3d>jC)^6Ktw~Z2&@Q1P>mMBRbdD)
zYI(mPb@zE4v8X(^9-YJ6IQ*Xu{p7(F@{YHd)A;$z(}1o0^c+XKVTQ96%#sa|28pP6
zHzRk_DXd3JS~S@p^T>`U$YImgpD#UEdUK#L{((fB*OcD0GRVU|3hMqmK1AgN!r@$$
zUCKjJV-$f}gqBB$;PNO$?M}no_~n>2*99J4?gVN<T{QvA!^_jEQCmPgQAa&da^7UX
z#T`l{lRo|g9ksCOsQHp45aJjeDAJ<a9S=OjfWChHhM*4mKmOxCSpp&Hmu?e?X#uc{
zn=3jG9}*WXT@>$~KZloJeFcY)9K+FLPm5zu9cRYAc<N<b>FL80Pwt}MEnHk@|NWkY
zi;t0OWX5lP^PAZ!m8N#ajJv<25pUWw{^ncn;H8&eMQd9JIu9Me!6S#o!9$&R>6Mp3
z4??y5{`+{jCGFem?(U{enuHJh_P75Fw{G1Kw{G3QwQD1|a^*6TQ_`%C5BkTYcPQ$l
zNu$>3!x&Tq&Dz>pL9P!1bzxzl)rL304#SBCTAVHcm;ls{{Ly2&=_$b2(UhT6zqDOU
zsY5Fs9U79`gS^mkrnJo(Ek3N(S|A+~ro^h~P!W=<LFA@*q&}8SHY-6%XtcvnSEWVN
zUM22*DG_ZSZpMrMyj{F-tBCg%o*c;+hkDY`a5(|>J&D*mkbtUzI9kFg_V=cP>OfzH
zwVL`eC7EL^u+i3+A=>&f&}L5Kk|9oMcD5y_;*EBCW3Joo9^_3b6gf(VV+VSRk+LrY
zy0RdsjSA>10<rZJ?N;2#AxItOOhE%UoD;%t3ORfLY3-~>2TG*nwARBs3EFnLE}Hr`
zi@leNvHj%~MAnC3MX5hR_UaM3FB;2Bln5vZfuTZ)tk!Upyq$-`SGS9{{sJ^~C9w=c
zVNI=lNoX@mxgAn`D!DE4==I~l6M2P~CF6vPJ{3qsQ=gW<cR)@Uv}~Cf%0@FyL=KQ;
zGG7KY>*{2Iq@@h<>naT)$%_`og1T`a4UI#2V$Zo;tl1w4RarPfOpyqwh(`3zbm1Mj
z5VQPdaR*J1p6%t!TU;2_K2ldr8PpP_EgiL=FT;8o6336>x5hMO6ETTK%~GulY|^Mn
z9dLDX=kI&u(Z})e$3MljYaig&t&c(5$N%z|zl!g^6WnRP{PL?<vTUiC?ct6xlM(Np
zIgMU(AAa)In`mfk#_?yK6>Zd6w;#l@r;dxR%U573uaw^qzFo9r=_?m5T=1Lm+u#1y
zBOoBC(Zj>*OZo$zeeQX@ckTlHplChViNjAljgG^I#Nnro;q{-qA<mwA4`<#xi_GjS
z1~mbKI_J+n|6F|Y%~$x-pFYL)>mT6558uZJA6!FM*F^#~1KPz^3Ur~vMCz!i7}h!+
z>&4Vj6R4@yty{-%oxplGuA`oylXfb7OaSR|2ZWP!&67$TPC)I<FKxX|o5N{`p-v->
zhg-F2%ZNCwm)98dBE+D;s)%3&r)pr>8jt8F(h$2lodzyA++STDikP|(JoIKNIzHNp
z<DV4cnHza{>67(1K9VgCUP(n;cLo}J(oxr)B=+_upl&b``})$wzP@xc^koS0O;Zu5
z$-%&|wj3hbfEsq7w&||Nf!ZOY<=YJF;T-8eaX3dbn)6Y8u?YG-OQ0$VhPGS<LuCMV
zyp}2&%<IuHSb+9k3OAB0aQrt|I%@f2zoc1@x-Be@3mZsFZw|88xW4Z}QS@{?w3UG(
zv?2t-ReG$d&~b%UXrQZ9BBvut7*A6Q-e$DW8nON?$$iqF!j{7JJ}L2!{w8`IntEwl
zO%6JS^CjuRx*<lAV&pdvY4eRVsxC*Z%30X*-^ZXH%(Dy^@h1n%r-^jd>gCsTEU5Vn
zjA2c>d1HTuXdKGNuCuv_t7lLP8Pu_lrwK3JJh=F}vdcpTHSI;T0kyCJHS9qBL*Xi>
z0^B>5Rh-!KtQs}x(=xCZEL>~_Iq~w*$DY84AAW=zH*N{)tbhIM|G?k>{uO@z`#<87
zPyPqaoOutC(NUP?>Vh2)K7dP?ySULkefA8qwyC)l2T5A)=oE(zAH_TGo<U_*4Qb)x
zuDfS_yJX4o*ZTVU=Fa%tKmX2Cp-?rtxVU{q9q&_5KO^3J_cRV3If~|k2ho0nJ8C?2
z;u*aD)|+_uy|Z}x%xT2L#|Z*;WOS7H@S_j#=Py3T_uqeuKmPIexOwv<L7*mJU%GSw
zq*1$jc(Lb@o}2~Lf*{SMr!n$yS^5y9QRn97a?XbhtjBF=nLvYf)Ir-jKAeUBJDVc3
z9|?Cfi8v10^ff0EhxNAo*!Z|$CAAI)T^JW#r#*%gt`w#*@FfQ?88irtP#`#2OOO`f
zPbNdRClNYR5_A;uUluCX><`AHKS@OA^&*`7r(*Hk?E;+mXf1VpJWWV|-rt=r_Vr|7
ze{Uw}vaUM~^*tF}`+75Z$mIYHy7XlUf;GWg2DS`h4x;Dj#7qXZ1<afeZBy3U&bn&b
zZQgVk$A0SJ4cPHwGQ!IOg{n+N!TUmET85Gf>o}aLqdyOa%=v7~W7&cy|FSs{iU(!-
ztx>6hJI=urzJ6#}3SlB(@`T<10Xhr&&3Q;`U&Ebyh)KoPyMS^70xR?)q+AVEd5|bR
zkqFb-wdfe!EUgafm3BGOuubbg5(ATimMm`)^7FI=Rnc?fu9kJ|A^JY)?>an8_C3m_
zmh^RAg3zDGZ$=%%>qJw39{oFsee@~FOz@T6F_}V^eMmB)Hw2y%l|d~n3$}d9pv~x+
zylmmXPyrr$J5xkghw&D98PxHQXTl}e8?$}g;O*%JH%}k9dHD*@IdkCV=^^}lz2Qfz
zw|vKU)SjcDo(hPk16(mp8N})1+r*oWxu2YBvPMmg54ujWEj63up|*fp5U5G!xN+ka
ze({U{mq0B(`|NY>u)Dgtk(`{2*|TSh&6_vl;>C-sK%6~$R-8Qf0!t$u9i4*C{pc+4
z+_?*a&i`osWcF;2QBeQvXFu~&D%H(4poT4|+YTQ_OGmqS=HzpD>-4)geeONH^2Y0k
zS{(~_PY=Y#t;WsUH>{xk?6W`O_U)St>5o48P+Yuto;zw;_Mj(6Pg?G%xvSRG7<u@Z
z!$dn!JM5&V&^e1c@lH=CmUI$1WXurDRLWrjo+eD_wc*ff4bZD}T+*NmMV4xyAzj)K
zihwv3v>R3<>d6#Dl&3&l6)!@oV?mLclzjK#%LzDgeG5+BF2Zv+vT^ce9*$khX224d
z_x7Y?FGD#K`+IWGcqIo7mvafyLIyPzfm*6j3B(rEGNjwhnG9@u$-{{R;<Tuf=IO_w
zTr>@Bz^3EzFqDQsSw^GoYG_PLXmd6i`qs*zh6U8Z2Gr6-Bd_yfI7?HJ9MGRmt`_cW
zn}_mofaHS@wxYUcE!G|iBFRWttZG<QrbloE$pR{9D?*TaC<fJC#c1i<fJ1}pc%ut<
z={$9qBAN#hE#2+tg4(eit~78%U9GHT%gYnUuie}m&(aa=*CU1K9NB<_!^LRmT?gao
zL_B;-g9CkO9Ir~+GyR+t1Dnnn;PhHpK#eh=9+Eq41~qr(`v=$I;Wsi6S#5yY7{#C_
zjXLhZRN=D918zR93~K78-AMZI^TTW}PuPN*x@lh@Yey|?K>b5X{3CzPkw$F`YU-#R
zfSOtM*yB$!py@D?fc<a(_V3(LTR<&(dit1U9v&WSkT`$-JQ*zb@`V>pu`z=V5oJ)n
z_uhHfgSxxBdk%NhYNfi_b(Y(gw0xF??YB;!5uHbmF{oP)9YS+^8%{ibk~?YYs87B8
zl89LyE8IOjMBJKq-2UX2_|u<16W@LJjrh}_J{2;kZ``;}pcVvb65r{`5wPh=lSXX;
zHFuK)LmN;F8PpTV9JVo~wzusaACu*Ij0^p@2eT8++8R?T9}>!IvTQr$DJ%gPv$WPO
z2~Qde*M<?S*)vT8F5w!3h|q?SZp{m5L&B6IC{8W(8&-?ePoxWSchFA5;HoeYSgjEW
z)&6+w<y3SIZ^etZx8vp88}U31vGk{qZYt`pBom}Xb#Df$dNQ&1N{%?tosZ_rYtedX
z-I$J=in?jJ2-r=1nS!dhFH^Lbv#3A`dX}!)zLT~u{`y2(HTjks`?EmlbPfH*$Z3xh
znmtOPEHwzFNex}a5@GDh7ft<ZMQ1;C)A=~qOPX({XdOxw*2F$bC=}<63?`4}jgY5#
zAV)M0twqbV&DcM(S?oTakG!K==uPtwWQs*V8G$+yw1P}kt`W+z0Flz95#{F#(RppF
z=p0-tDCdMEi$f!P;D_enWXhA~y^Uka3hdFfUy@&(BqXx(r3s2SJ$N;nqfR^D-@t=B
z<Z(az!F{MWn<>^G3>2G>hKTA5$uuf2S_V@@+h8&my%EWv?liAuNn{k%>1Z8Fwsh6>
zyz_V{sd;Fv*w<f(`(I9_+;Kq>xAc6;^%1#c4Q4KLV-Gc1$Yy)`2^S9^;p*!nJbb(f
z)WXllSI~wR>ZS?QzCKn^Pt`j;ovvCqi7a*G_?Yx}IgmbtEvPNBhb^duT#rAolVuNr
z@&_MW7ytUNKNnwq`86LV(*3=?W>K`R5FWGLL6?^<T*Srm7jWU+dAxA)MI1SFRFK2&
zV0)+N>^Ow?&YVNJu|nK4ZvouhJicABXz8omQUBL}{g=C1rEVlp)7T@qJ4h!vbnGcB
zs7a%K`q>lQQNMHgUA+4GYgip0#~n3Y-un2a_~U1P0BO{pefCE>NEFwve;{t$xDL6a
zp6%|*9~B7H^n__JgJ8|TCLJ~`j5})Trm1pra-42wnMCT4;p|lEn8-uzsAIMpZW-4_
z+h=pw1A8**!`U(bYe%gM7c!`+i;mP85U!)2(I7NTiGWz8&=<v$mWUW*iZE2H7K(D6
zP*f?P*{8vS&xhmC)h*)1TRZT~@OqrQR)lAU^F-67HQ3+1279k0p}H>}Rpv}o_U53r
zI~V)9a?x}#4=oo9#&y)xeG{PRlF9;VG)pDJn&VC_z@AY0n5@HYC2g8PosasyVkFk<
zq28l~qBH^uqXvfRrK0>w9%x+p(7;;J*;^nwdU7SHgMlP%CLaT84uq224<y~R3>To~
z+EyGG*^Vd9<|Cn5iI9>-&{VBLXjOt(u{)fX`D&}e*bbP|q{9<G$>3a(w*GuUS~yQb
zN~7S^NsFez6ts>=&xhn7J5XDLs>qMddC*t$I2ehw=aD?_?n#1ay}C)X3~xr&#awJV
zVL-;dCCG1CiQR9m<}SO1^0_UMvKCN__WpE1X@&>Q1nE2*>B9<Y>GnV#zX{UwuQwNA
z^T|XQ%5_kdjCRzTf(UWfqFHeFbcL^n58S=xz{SG{E<WDy^!0(S1Zsw}ug`qp=S{Gl
zC#E5N{Ls!=OaSqzNFNh+)MU-G1GUvlO`s;n2gw|yQUCnszaUVHKm6fS0ynz5dr*+S
z7PDR5MDh9!xO}OLA$|V6bK<!ZC)ol`pzdfp$aVJgdjx9OfLfA1=rB>M(l*YX>Gl<w
zuW9uA?RQR#BS)V?OUFUbfg*|Abo;Hh-(^P#ReXE`&H6J;uV258Pe1(>-+c28U*5WP
zi|_mBqYnwxg6w(nd^`c$0&01Zj-f=rvjMfp&dzoiT{@kE!ifNF3+d@d9g}&WC+L``
z3}}1z2aS*O>!i_g)(2VjEK6t+5Tk&qAQCZ;r6Qsv5t_0n7^=gdtqMiV0VUR-N)=CC
zUx%kZD8zHux8m9Nw~E8P`DneEj^^$Z?7xzT+MWbd_obq`KL<6v`Ph3UPt<kgqOmIr
z&0X1}9koTfwy(zCENeCKfJ`<=om$G?wl~hk=d8<?i-Lp*Ce-m(U*3S&Y8{k&3{aFt
zF{mT!mZPeVMx`0l=p?PWhdXM5(pdZ7phZ8nK$<@Klh%8{ydL#~_u`Sa^AWXADS}J=
zp{mkwW(VoCfu(w=%5~70f|1gw#-4X`(K@t+L#Oxvl~-m-gDBF1-Za@=!H$*DgF<O=
zMRIW1?vIq>VX1R&94r(Z-ZZ=kb^S%W75w3!q$0aD7!jr3$ZA}U^7k^(adiW~*3to~
zv?y5Wrb*sOw{-A1_8qlorHpWbwFT4-W(sU7L|tDI3ZIIFu1qIFOQI1>pUNs@5tydN
zjC*FWHID|~2-Gt@eK5=0i*;yUi}YauHT=Bgj(QF}=lI?Up#KrWEpYa`9e{eWj@lm7
zEPaqp{qvvyg6(;9m`GAcS64T)%+=Ku7L8hvWtpUpXP$YMWe?d;O_!%npM}X(A!O-e
z(V``z9km72UsHVFu_I5BhnhToqNPJ}evoyf<KQ8@{>GaO>382fL$mB+_UzdVI<wi#
zfd1~g@5CSfNE$Vnzpu0N!=|IQW_`$@wiF+R5wvK8oIp+TM^;vreXfT+s2v_6P9?U~
z-tFNmL}`KzEY8+sO}gvQ(TMm2*ZH;_vP7V!;TMfM6d~#$5gesJP`Vc34<=!CMK+Cu
z3uT3#A+4)ef&3$3Xc)R5FZ`4==^{M+{yGL(TX!}ZE~H`KrBpOrNfWi*$*Ac~M{RGm
zsO`-q=>zrMS)$=ehG@K!=?v7u0jPxxYFk)4^H)0nw=JNpvIz~|G!AB?dAJZIXY&zR
zrGu&@LWGpYAjGIabi*pt^b@G_c=O7^o^?3bvsMQ6IFI(I^g!BezUcg58)~m?!2PeL
zi8YNn1eXRO*rXAPni%143P)&#0U@OdC`tp7d_aTUr+Jt~w3ydg21cY@4uW7ayDT!;
zN@#VRSl5h=4%o<`Ca*LHBayXkV4Y|gDn`rI?PwgnUzA-e6gyr^Mb4pcL{u(?!8i{E
zN3|%wm_wP{Jb+{MOiOP*LOLj=>!Z(iy!0^!)S|IJhe2K4y;fv*7@#esPb)DZq#{-X
zRm5OPtUqSVy&K-%o*W@Tpq}OBE2yLP@Z*jeb0ts<2cVt~NT(xPh#v{?4()jy(K=_I
za0Y6N^ueH(4-!B6=%yfz`p<v<0)P0!r+oj}v*(bIl*phaOY@mCXK>-tMF#cL$4?NT
z1=*l^n6RxwkV}N@dH3A2P`J(Z_{Iuq(x~-HZL|BV+1ybRsNa73U7nVa0o~f#&L@*J
z{PNaY@37@$%a(0C$4(=X@4WL4e)qfI;oEP&#ee_zf8&!+KH;I4_uqeCT)K40UizRX
zFJ$S1VXdLjXdSAntE~esnVFgPP7f=X<<vX791n-xv`zY*b!^-|Txp79;FINaIP9h!
z47RW=Vhd&ajV$&ZHu<I1T9q|ZTB!*}us#UtbUnhht>MYBu<A5u>*Jx^tA)Nc2<fd#
zl)jTGp1b`7o_;?cCvUFjPHx}DIML9ZEE>8qMBT-7)LqU7b<cb0@=6x!u4JI@N;>L#
zQprC});!c-Nhe6N8^qQTVtZQ#wk@ce`m!0^q*=?_wJeL++;&)_vPm`%V>AwC3j+0{
zZ=@lzQV+$RNCcI}@S3Z*mO$(sEa1aHK13V^wP+qrwmM7Lwk8d{&~-r$il+W`sJ*-v
z54@a+_<9ADWkJwXM<TeAJkpWyFHeA~TtyZ<k<x0wV{c@m?do<u(A#%8h2;t!78y)O
z1IZ};(%LcJKt7lw4$>j31ZrW^QPY$md!xyf(bkiVLxV-=9NCOU^Cp<it;78<rz5RJ
z2YuNxs7hBNwq7YVo=gC3k7*j&jHW>;iBHPw&fszR4l_G$__j1Clpz?*?6J-h9H%<O
z9krlO8gfV7G?2@`&v-5e$qg!KOZ8Bj;t*Q78mo+vn5$ce8GbVaf!f>E8*U!HaPjuT
ztnr|>bkqy@(sRxn;Xc<2YDaqV59y3C&7X1l_)|Dc<ds|#9VSxuOr14>nhp}FqrP_S
z17>DmXb9Q!#1p%Bk&jxOIe$*P`Sx3a3>yUL=JpP>w6^o*nX~6$tgPZubr*M!?-njx
z^okYKS_`OYGV$1vr-TL6OnL%!d;3AQj~qF2j6qEnlG0Km=S%zh2Z)m=PvSrS^FPH`
zUwtKh``h0#sBhl9$)KhaPW!_|d+Eat)I9W(k&(e*w$-TZBS~dPh_i!38OD>1i#w4$
zCJI^_w;aIcFwxdG?a=ix(SAb;{<rV0l{yt48giyIjgV`Dgfc1=5ruI`-cukVOc}h}
zF1RLKC~8%RZ`EMe**qNo=n-+^{T(><$!4_mreJ?}92$EQP;(&$b(fOZC9(HX9_lX_
zpsp()b(b^AjweX7uIot@dwY{n*Ox+|wnExcwzp+FpO8Ch>Y`;(6TBw^vV*b$T?TdI
zK$?&{>g}fz5mBKNiapUXs6|412<nE{@(#d*z1a+El0VvqvqaNS68{dXzt}Q9&f91P
z^3h~2!ltJ*SY5dks*<Hpm#aijnI8Ve7_q7%5zERF5Ly~25}PBi^Supd8rp#dbD?M<
z|M4KXNiqZti!=>oiRP<0qV=levS{neLPu|gINX<IUEIq{2W&cO8PpwpxoGWK3*%eK
zDC$s&nDWKYl`IlrCVzxi1|zagFN$Btfw5;h_K)m9!{B;p>-r!=ne=EL@}Z)Q@79cz
z;WRo-l|e1#UJs4ysM+z+(4UXp@1`SeZ;;TH8K5ms5CrNKC1LOk^%FCEXTZnX6P~j?
z;p*-q2-GgVK5+N-78X#mE<FLLrwiAK4j07)0G>A7?Lck)eKz(yd)Ehd)3QB}Kuu64
zt(v3{0`-6Y_aD&TKPaflC3$GZteL2;+sm%Gcg~){b1%MtrnYvLm+4Zz{_cC{gsG|;
z^A{}^F76&*&tJUw6c4;uCKLC%y3YQ)tBVKf>l$$JLN}g%>RBA@IKr`|O>GC!(9(|9
zgNO0rE3f0#pS&?FmBRo4AOJ~3K~#z3&z;2L<tzB(&69gd@QYvn27mtIFZknUpW@cX
zx5Wq7Kg7-3w{WrRl1L$Yp1UXSSMwlHukaUYwH5|LI4xYYLQ3wa_wV12^z`%zwP|OP
zhP`K+VD0EWTR_`*qaBu`Zh4Y!dd%S>O$=(nw1TEMX=kBcYv6cN8e*X$y_rj|u!Jp9
z$>7#Qp^-+#DREF4uBXF8DAz~AP?7{yO&t8I4G7t%hptAAxav^sel<-zJF*og2D0(e
z`&puKumJVFIik8N9hDbTQGGd8)Lu!)-tKhNbft3DUQXlNQl(joyX)R~9O$PZm^|$5
zS_>L1+25B7l1v%~var90Di8awti^%ee2WB<$vGfR=5*O-&8d2pk`ngDm1B8?WQ7Cf
z9PA(1j-nIk2&*+9#Araso(O1+I%FTxpkcU(wd_`N0uBx(h(lyQ>&-<+-+Dooxt1Op
z-IlcO`u;r8^ufI__HIVrGf7Yw6$mwk^S1Snia6G015IHFEY~2YLXF~%AnbWP0nL4d
zXd5WvU573G($2xrA(GL2Yk8vz>CQAI$RqPZ*-}<We<Ah_ZxQt)4`BC|ZP@;H5elBq
z!J4*ss4A3Dl!cNv9NIF9oi!k{BN_FV63}oZMY2AUubd88Er+i1?Foj51c8_i6J;Mc
z9X>XZ-H}oesmy6O(6<&3y_pMLwT?E^AhaSGTGMI-KdQw1dloXtsM(@MOD-uz&*`eI
z>45jgE^#N1FFzL<+;ivMBY`>~089M+v2f`!EMFCXnQk8NpztJ5Up(;OqqzRjZQQu|
z2|oDnCVu|!zrvqB|BLw5um1yAKfI2@;*H{NS2xU>?JkZUe}+Je7hZgc$Hv<`I=Q2!
zZkmc3;R_cop`xM+lxgkm?)lY{CCg5nIdjIBLYZbM6zT^&J-t75b@32cnR$5Y&C@t@
z`aE7b^_qC;)N45P>Ki!m{3$&9!b^DV&3BmkG`+YwA(5sH1^w|ftNuL%{?~8+H~#s5
z{y)@B<Kv%xA}9wWGc#MzzC=pfB4ATK2!Wa)q$B6YD5!-D>a?`9iSj!p+!F3U`f#|h
zWeSIgeA}6%Vbe)Zc#x<L(+cuBOHrkiDQ#ezon_jPN5iRG*60;NPQ|l8TF`66`O<nF
zLTMpwm;#!tND=*TDk3XVp{a=zp?kv-SgC-@xC+~zOF~=kRy=!kGhV*FUOYRLhPs|?
zQQMt~s!M59qNY0yGN=jAHlP;LeRMmOKrIN=^?hrw-<-yv-gl)C`+Ez8@oWOiBRsWu
zB@_Fu<T9uU*pgnIVF_|dqw5m5rIB+hupNNf;lU$)d~fK_#lHS~QSfvM^wl~+TT=+s
z>N2g!?lj=Q;Cg9e2|F*6D7zZ%=3H^GzX)wtQh2hDz|}mEFB-3IL|IoM@}7=?zD9}Q
zGBtvY5ePI!iJ;O*1e9pmC#|c~irA(IRGm#hb6)`tT`dM}4W|QA>Y8Z;+_G8S(w$11
zQs_{VzK@pg@?qm}fjH1#fXc31>^_qv9{5Qn)<2hogw_Z?PYB+#3hHttG!-hLHif`o
z3PI8V1MYh%Pt=>A<UDK{(iSkwmPUS4aOOXkHU6f7Tp_0zQq~Gt07;^uOTONhg8jYu
z*m^2es4LV6G_6KRc@i|GF(P0`2xnT@f|{}}Y(PB~9r;dUNT(ZdiXZa$@^i5PwIp}=
z`(x3H72KFES+SA^euTFVMV<QM$(<#F0R7R8k1;rOjW7TDw=eM@|KES%$kWHgqGih&
z(veXyJfCv$(q)e6IQjgG1Z=$c;!8O7(kpoBrB?{jf-VaR3K`V1X1V_Fz`)=VYl7a1
z6DL;t`1sxO@bLO>?%erEPD&R~JiZ&{rfO7_*PzT;iQRjQC@D3H(lQf_rV37bqMT{^
ze)@<I7#Pel2W5Wz;upWbZ+`V_{M*0%8-DunCrC(0Vwr?AZFhH1PKTmSnu<Uzf5ev;
z2khIoPo$=%PH4lMWPR2csl$=<F&#a6iid>`zedlCAZ-I`9$euZX<JZpj)$e2)~GCd
z4|P0=sMM*T&?^w24;G3P4PtjBBfd0~Go@)fTw6<ygaDD=qQSnN&3N|a!#MH&CY<<S
z9a_8MWk6f2=5mHq-D%WaTS0A8!nVV%?@MI8x~_YzXz1IBsteh8^wluduNl@7sKvhS
zd<J$yPbM0A(ybv*qnfn@Ya3|W0o$=NgbwJ)npfAiRpcCA15Je*p``|pGeJ{gK>p!q
z%J~p&1M94tSZK13hi(S)ahR6~NF&oU*=XuohwP(~P?m=v$f!kVWekEV;-IXKhpsjj
zDw9HJO{<V~I1G=U$>U)dc?Th__aeBFHr;V8UmC(0$fY+DLGl4D)@>Qugw~;LT+IVp
zaPR9$SbIDQNi8bG)GHCOS3_?$P#NjaP7773hC66YNf4qdgRtRPj3_(17W7)T4sN!I
zCmj!En~vK0HG3Bg{e2ucYsn9nLCunlIh8;8Gz=6`uocLcuBc291ZsV099C=%<p00v
zqduK8$$++OIGMK0a0eYR?hx|RE}M>8*ml%QSNb!cm-(*}3zjUEB3`}caEjmqJ08Km
z{_Gc2;urt^Yy6+z{sDja;%_{U5)>TDuM>SD$;!$>O>G?yv+UVZ%4IZ`qhxm}N=nL5
zx~B|#c9kGDdNs$Nk__$R<vaM~Lr;d<uHW*Ch=|(f>gx8}88hzw&d+!L_jBhgfQP#e
ze7x!1WiIbVqkk}p-y`{g*3S^6U0rAMg3I}H@8ONZ2Av)`S=k~jB^5~tiHM4b<fV`V
zX)4+Z5f~UO<x^-V=OWCi$I76tudf#=DJf$P4W}Y|IPpl^`=!TuqV31V?_{FT5wxwr
z{|3sCmUMW2t_<l>Q0sIWJ}9&TTcZ&)aVU+8YoQKT6QmIkAA*R@s}Wa{fe2$FkNFy^
zBRCK!>3|ZZv-vo3Z97GlisK({piySjoLenqK$G-Q-IdM~2;bM0!d26iD(qm*pq61>
z+mpnX+)ejv#AC0l#^bL=VZS+pVJ&ymHlP+Vs2h4yS*Nyk*}bD9=Q6BEb!q3IW@}#e
zMr5=`^E4uXns)iAcN<XjR05g?wxNBnn6>AQ{uI&CpTr^mG*EJAAO)>G6b)K{nyvzo
zcPIjy@?a<{!dUL`FO3%drBMhfGeBWfA-p<7<aUNp_lx!q?_<{q4c(B|Oj>!%@LIH8
zEkwh>I@DYyNv4>yuy?+bg&i*?q4=p-k<+R};@&_+8<z{ptPUz!iBMw@)D>!>G-(mI
zONr1D4Gfi$Fc{S$x>AGu&KQ)PEkgUqcG22jh=y(oR<d@{V|?Z|-SuSlMs{^buQM-z
zuy)iO#3bd1i>ASi$T%3zpjK5U356*IVWn%Zw0IT6OLlC@fR-(4chK=pYrOkM0KJ&%
z<2wWOGXGU9c~DW-hs;Cw+1`kbibHl*KGwu1BP}(HZ!1+AL7ze>)|vF|nKNCOm82?o
zx_b#~TIc%B<1Bv~AoBJ0<0UNj%v&J5J$=6S@$&up?in+GRa8`zJ#HP>z`%g7R;zFH
z@bJ7jYnJP$GiKcVx7lu9f1fpTHcc#k>E<%~OBWZnFI{H3^7Xsu>#pv9_44%jo5yU=
zFWv5T{kylP*SCxBSs=XKJ+Ns0Jy^DAF&507#~>%T%kqc6e*ghmP&aJ>H3Q7DGf_}(
zE6v9fa3=xvgc8U!^QFfGFHO;IXFurT@W4=lv=!9WLqn1^q>^u2f|nT58p`w#I+Yrs
zkt+B{1woOoL&OtnU?@+3rfN09YGXuHO&Aht6nN-`L~-o>dvW~3jqEt+9LYmncM7U5
zCR-s*U9=48%8RL^0KX)`T86ZZZp~6i)s<wBbh5v%nBNRG9#g~kUMdg5*nnEd(ucL9
z?n$@6Spv0mf2I}Kqoe2chlpc=(>RdKa4b7lh@=ByP?l*BS`tp%v4v*00h>>xqiKK=
z>o#)MMhA_E_a~usfX2e51qam8SDnwnhGS9CkVo367y7+PSh+hI>Y7xjYm-EXQ3tgt
zMC2WgM)~CpXdT%q>aXPUW^R&J_V%trMOPlm&gWt0JK5OrN}AaC>>5N>`6Il1mCzYi
zL2nF(p+b$Y3YuzELtCbXs*2tO^aw7~^CuupML0bNp)sitRjo$iJ`Hxhy-u`^JV0C3
zMPqL^4iD$y=tz#BAsRXBL@u`a(UutsjvBq+_WGF2a2lH7=|h@&q&GbRH675>*ZQ;2
zXwId7TannLr8g>}s-y$dBp7zZiv{^htqunVp#CAcv-puF6!Bv{z6I36UizSp+CM0m
zGd~E_)J@Z3Uk`U5;py%pe7xoeZ%@DP=lITtx2GTZpM{Hy+c&dkd;I;byJmjr<>AGw
zbe-k)R}UBWzs`1b|H8w?{fk*MX7X*<yIlV2<>v8)>s>CN&zy1hFTLHo&M#ZIY|ruI
z$9Z?6qs6vfv_v30JnDhaP*sUisjCbPRaYrPm6a-mrd$!CC=Ur#l<PFQiojKY<v{^K
zrr^NfiolhDmFi&SJ`Y#dk7mzu`OMwL^>dfI?*5C*U3dT4!^QQ_o}S)cQ72CCBn0hc
z%T_R;BuI~yKFIM=S67Fmq$I1e!!EbOnI<jnWa@B&VHRhDD$d|N!RGK$P>*$Z$e@;B
z%`%7u(pt6LRco*;VikhYHA44bEW%BRLRA$DRc#dXHG1evSK<B>N$BX^ES|Zx5ywBE
zz@AJ|dpVw^jq*#D?%4usTM5L{VauSlFKbs_eTBN}d{NU~j2+L%iM4IPsJ0Bk*h(LK
zpeTV_>Zq-iX;(79EmMIG4i#;?LIQQuaK3o#t!%{9YK5v)$M!r;X&f}W^|<$iOf>ax
z6|H?67}V|kX&h`sxf$$nzP1s@^I6D0WPqV;6*Q$P{xlL=7LVZ4HS8V<++%>QIvlxA
zr=j%XHZ)#+SnM-zh4D-d3Z98Z-jN8A+OEZ#2BnCpQy`)$6k1~tlzRf8tI$AgqOo!f
z=Z`3jVS-kiv5sD%<Lxh@rFz}~6I!A`$nHQyRI5;QJQ2Iku1CFjo3!+xe;qqC2((Ro
z$)cri4UX_)TM5ciE{GKQD(9DQysQP(HgLARj)s0|1YZU<chZ(_n!0VWC{|u7LhL>j
z<!VDw9tU+vvd}*s2fyS6veY5V9&EF<4bT4(pn0bt$B+5=c87^V?x;!jSQQY&Ir@th
zEfLgBb9wj*mzlHw?&;z4=euUi`s}V5v;N}d;_=1InJ%BXxw*d|5~8RH505NUg{n$I
z0z-Bi)P|j58r_r1AmvW2Lc3cT99pUg)s)bVM0JRISFnHZ6Wcd!-|*TCuLaVQ@u{pT
zzx!uD`<W{hxkBiY77WPu(RKMYUDDQE`o2qNE(L{Y!&d9n`V?)5GCk4|nW0x{HqD>E
zV8GXR&Ue!49zO=PMngHwVU`2Mv7p|&cQ1jOp*x9B+E#;hv|dY=IVM~@JJroA&N^m$
zklPNe@Gy^-m(q@AckoU_n~qwovnkT1sZ`clvSt-@+hPz_nhZ@<Jd|~@2(6~kX(h6o
z^=P`h8PC6ezj$V(fYwHdCUXi*=VDNPDOHqRNJm9ihN$SuK-DFws=G3&#5nDmy6!P0
z$sv{9IjHGb$Acc(%}T86P@?ieHV&Ax+4*7Bs7d~yOSbK$QGPY&Sj!f^(T-Xgj*&ra
zl|d|J5AKG+WE>dC<s6Fe3Kdi(288a8fVw0W+FdF<{Avc82RDkA-U3?K%62t!I8gK_
zb&ESMtQUF5VxcjvLg=1g=*y#_EQt|8JENhiNQAy3o;Tja9Ee8Y$sBBXIUhMk;t+p8
zgEjlqd<LMY)FHH7%?FR<I3bq^mBJK(kg_n6O$13NbQxlz?I=7bBWPGgR~96+rGe0!
z0+8IO#kLnyVZ69O)b(yaT~9vt_2zKbOZGW(u5`SggZ69WALj)Q)`1!8q2*}mo^9tm
zx&_|uzJ`8j1YgPww?bNwV@J}}i?Qq7JVe$ip{~$FVO$NpF%8-sv2YES^k}(kyJ{z(
zo@zYlkL~;rKlJgPxjy8j0n|}1TC{{A?c+r<hR^q^Q1x2|jUibPq)m#9j7<&;i%N=&
zjEp~e^k@)qk@!f^r2;S$XE2lQqw6w9<*!@5hoz2jl84hTI0pD#lU=vJZ8n=1ELybm
z6)!KJZ%EJf^_?Tgo+ry57JHtoQL~47@7}#)0#J|1@o?ak9@kAf0JK9*+D7)6?9gxw
zjP1W}?~fimG?XL`g0y76lR<3|S~Vr%=>)wVG~A-rDxlPba;+*-A#zs=bfyH#UJ%Oq
zND*iZMEn62YA<aP$FJUprw5C0;)5cz^d^hS3o)qbN<`^}B$Rh$5vXAUY9T>7gROey
z=aa26NKIF|us~Yag4)=Xi|Q-u@z5)oSY5eXY&dEVWoKw1Y5{>-)OTl~zB>o@pdKyB
zb8P`N`>iD@#43+Sx;4omy&0SrB14;sKwW3f#g^xjp)XSj<sO3w-AU31ZO9H5PrRLm
z){%8=nd@Mu1%>@nhQ$Wntw_!dg(;ZzXKiJa2-y=QNZ;0$Cm>{3BorkE?uIEcRb^7}
zVWQGVlZZ+vO4YnsoKo{vm4+eENLx>0M5rl-og%?>+ZYDgKps-Ag`z?ul$E6ODxs-W
zLc3Rmw1z<3e<~5R-J8%buvP5uTQ3^Sg=iiqkg}xvGX$mQ(J;yZb21tRQ$^EoIvR)4
zK$muMhOmXPT_-)Ro2H^SRLT(Ntvr3HqM@I%yVLpp{bo9}+$<h^HJj1^1$F&2l^AYJ
zhk9!iW`wxegPJ;P_7Tfc!88Fpk>7c;t{F~(mwuGTw{d-p(WuEoO|T}(mO5&ZItbLW
zT|K`mELh(>5&tIQ<aGHv>3=`um-O`X+_QZ7%9p*peZP?pBFUa7+43Y%$zY?bkJi>!
zR8&-OM?HZa?M#DqxUFRxv82ux&5q08a0YQ3NQ+TWO9zLeq5pF5zx4byD*AdD)GEES
zq*kv+fF=+@h9HC`=%IQd20G&!p{q?MP(V==hOoU#-1kx%j(+$Mo_T)@o*pUWSkanG
zi7=gC1JlJ6L9&POd^*b?_GQ~)S6(E4b^2I2ge4KuuhU@aE=1{tbs~9xC?d-igVtcx
zbWtamg}ql&AcMNTJ4Z0EB~aTB$&AYivD2)_l@-)OY1rGBC)OQ}hkB2i^GsBGq7b}O
zi7;aTO3tO?0A*~9<Vsz-IhVZN;<48=kkP0@C<pw@U2rr)N@JlYi3N?IE6XBTqM*zW
z>X@lQ%JmY2%VH#1#H53Nsagb-su66GeiwDtL1hZ|VC!o&h^SX1wn;0JI`qhSDiXz~
z;>C`4(((8OX`qBka$iW*YL=?qJUW5NlE*+M8fg-9D2<<Y!*GgI06VC0-88{@e}6Xn
z-T8KJ8V;CK_;E-Q+1FQqx}Gh(j8|KsfVw=4K#j=KGz1suFk{KxR_Vjm?cwAg@gM1x
z7SsHmDL=mLRHEEf%b>RGOXOgtrAwFdo><bMy*zwr;rDmSKxNB6nx%Kl-^qS(Y)5^4
z!Lnt`U-tC${+d8d@&|!>6w;#_HLc>ZfSNn%i5wnwFdi3G>cHJGm33NT8o^1{ZrTRo
z4na+JJn}?Kl7|FpnlvPdgX9i^G{IV<HV6t}3Jp_=Rr&ygu2CYcFdpj4IH)RC^B{(y
zehri+B?^uwp~1XO93I((<L?)XLqoYNF;rYkg7HEsOqVi6<;6^tpHGMBB5T!RB2Y`$
z)3~#ioguOWV!Bd{hklZU=*j>@mHXrV7n4!dRY1Y|f=A7}GemuNmK~_aOfQZbLAM9B
zrMnik9kvYWz2;QZ^cEniJr;_c8rG+kl$=+h5Ro;jP|=$%ny#ji*IP97<$xRv551fu
z;%b5sU7_SaCF*>s3l1fZuu&?yt*nfZz-!VVpfptY?+JzfZjD&AI}Cw)ViC9}4nf91
zs4EpbP^2=2AYj)rgzQ<4*an@*KfVU{y^$>*eK!w#&KHRCD@DA?yMCZh>>FH%{lf)(
zsM$J@!r9nT9(Fog2Wi7Q6-_a=^-(5@#bZv}R%BPkK-yHm>`?Zw3>-<IHq$tNrWMpQ
zz_h<V2YY)9QPs5t3H4fNE7d|>PD4a-!ti7wR;DR2W5LWZ9km^(C+dWMNEp*pAuE22
z$G4qIls_fdf|@#NT8*`wpuNH$zTR`Go5mckx!*>G#WYXEzlm7+qjb@C^2;23FLl%e
zY7Y;uZ|ESAipI_*$%7{Rq*Yu5G}5RE)aB*nNK8zemXl+GgF{EbN>kko?r?|UG)w5T
z^c)TBqb5izbqXE{XDwPq9d{U%p&IU}RR$gW4Z&C*=?`sQm`Hgj4eGiz95+cZo8fiQ
zh~2A0*?Yw}e(PZz8lj8`8ZwcjjIwiSD7%me<HamgTu4LZ`7~j=kO8^M3Emeo1z*|$
z+qNVfJ6(`d#MHYT>z_%0ZqEu{K=8<G*=$Fv>&fQB#JbDr6yjv*s_D`O&{r}o12JRr
zL4+e<+a5sLIzwvuGEv!6h~$PysCG#?A8KO+RAmapH-w;){M^!kBlh(cV#iAfSX~>4
z&?i?yQ=$>NifHbfLrWsLqYkZ%7a>)vv9dHAi*_oovP=tqqXq#c>ZY}vAEGD=L&$D}
z2;Lb6Wyw5fO$!mVcO^2~wb=S%B6giwi^{GIpaa$e=8b6TC(m;++J=j0`wH)Nl=mRE
z4Dd7{7jKxcEL7lZ4gz&gCRb~3wtWe@w3+CfR#~)vvCo{vn|Y)+zjQR1Q^dYL%5up8
z>EtD+HzKk^0Zq9U1Zr{>=^l;8{OA>8#yr=FKz*m3@N_|pAGs43Q|zdP+)>NY$3j}g
z<u!-P-OcMeWvIGoD)PmhN*rUpf2uz`k;dZe`w7%5SNc;&O`xVRa<OVvARi`D5vb+P
zlR(|l(n6pX2?+@kIXIkc4xh>(i>)3#;b4m+$-~iolZ7e~s9EA*ZCWi<dL`6ag`mL}
z+SU@L35QCdW!WRtpvF?eD&e0Pg0O9|NZOqt6nkS4S`~?i{j1qCeeVnDqIGx&I^W-j
zqaUv44IkB)l2Q6zDoW2~!gwJYW#_YCI+ucq3n^Aen=WJ!w1pMcmM)v1YzJ!6vE{)S
zQPOoU(mNuc-n9}5bviuylYCLpwGK5sS*Ynskw(oaC**Rb71R{uBuOGtSwJmpI&157
z2cQ<Vu&(JZ!0vNv5nW?|x|FPK(LzZwMrklo+O??Y%R&864(iS8*~c7R<&V%^E1)*9
z1A~8tmbEHNBSdg%xS$R@&=e+ut0IJ=HWERVIvy1dGKF$-o}wgJ7)&a})rKQ!e~h^A
zR5VPK&Hes;X#ZdbEiVw{DR1mskG7$WJXTK2Y^f`5y^@8N?sT+vr=q<l9S8f;t#U_8
ze>P1BN>hcj0N9+yIo8%4lYLoe@6ADbPp)XEnAV<rD%;WfF(dePKpuBnE&?^>h|_D?
z+($Zi3hH}P1jP!}o44YjSJxrjsNw+}b$KN8rZ^G)SOUCN3oyfPwr~JyUaNP9(3~in
zW2zE{_yN!!_xKJ#ZQD@`g0u|kdGqd}!$d(=JTDL5?;^va4>)7sRPUd5XZ?eJfrI}D
z)c*cKtWi@pE&He$T$ag1`H)QpwaH|{nl)>zj*baBXGg(FlkPm6ME019<l$%&i!61F
z13PVKq3|in>yS2wE2V%Xt(r&43Dk6;sM6_qM0|N{FqDO1h}oHf)y7nWR!2iq8-?&1
zJ!^^kd$;1~^&My%DG)RrS9K`?rgKT6<Xk!dS`eg5-%Cg7xn$C+S*ND5?W}FOYb%_`
zchm&yEIjn?daOC1hrT2j$@?Sl_*;djxKu=-7W4*T0kzoIm5F^_nSwiPE2u5twk;`*
z&sqnrWPl=7=~Ak+F`aeo;6~i{YKAnuR~E$!1IYFkQW7Nco{mTT)vc)QFBV&#OG2b6
zSkTg2wMoMVe3aRtC^0};8ph5J@-V9^4Nz9nn79H#Wx-hf_!5Ma`iqD<B~shMu>N=)
z9)2|o<>%MqK<{=6VM1en5gN<|oMpn>R{9IjYF;ZEx(T{D6s#mDq@VURN~^%~c+1S8
zo?Nt;*I8<<CHmDmd}3RI?i+<QLArp8z0Qt{-5i#M!}8+cF$;*PNc!N-JoI|@q+)+x
zGJ%?Of138h#%D4SUal94G95G(<TH;!<l~8OUFC<n{5+>3ecXv`@ngVO{1}gK8*%DP
zqh7RlskDWB@ltqGH$B@MbN%l5c75Td13!eZ6MgLmYtzo!_@hUUy0^Et&pCYf@cg#6
zwtE^H8WuF{ZP2Y;>3_l7+xL6YsA)QJ<;qoLO=J0kx@ucc)6xK=(TMo?c>AeB`z_&9
zjVE=s%g~wA!&x^y4#4)Ew6m^Stub)7Oqm@FYP~{ebxOgY)@X%Z$?}JwulpN9L_n$<
z;Sa1qY<ZdpHzgvpiagU1JW%oEo4M$`b}x>6umOiYq{+Ahl)M+uP%b-{3Dbpa_6$>Z
zU2-lNC6|(|ptgZEch>TCJ5XDJP3{na^@is&$hsxM%GF3d5RE6^DV9F=_hgOcf^=mN
zq`3&xk{sd`)WTAHT?Y03?sN;V(_~n4XI<OB4f#i6gldlhs<KD~)A+cF#^zPna4H9t
z{r6$hbBTzq)Iq(AvZ}+_HWyeChLsftC`?gMnIhQ7Oim60Jgw5wRs``BVoql?Ha(Xt
zo_MDKRhNqe4fY)9TZcw-KBweK>2uWC=2|B#>F|%FjgFx_?uMluky0ujRXZIN_U54N
zN)B%&Z|TcLi=;zawB$6-u5KJi6^#SZrIfuvQ<)acx-VByu#_#79ThJbw!qmQ(o{Ek
z{K5bLAOJ~3K~%EzL9gY3o)qlsO`<_1QQMP`ip!fsPWu`}R7P-qil!n;XlXQmdnE2&
z;w4;Y)A-a66YsRMbq3mh)ZwJCeLOo*3w!B<YU#2SoS?Uu4ihb)_V)DqE`Ifz6U4f`
zd-pDEXgIW>t*vcdM|Fp<y$^c2YJ^kx-s$&}=lZe79$TE5oVjDJx8GTBH_sj~H!t%X
zk2$>_E}s1!Gd*t4pTFSuG&;^Bl%C!!$XgB*En4-c^g)XQ%F4<Z)C5`wp6JPZ(GDX>
zr`knN&`mo$D71|ywY#)lSN&h!-UGbt`r7}`^pIzkV>>&xwPktlCCiexvmp>5Kz8D(
z;hBVxKnR;K0+d34kmbD-CjknyQ0Trb_t%!*+x~CcTY4$I?JX^<eBS@(oUgvJtjH@s
zd7krpWyg{%`{AYI_vd}y$B-nn@rlqFT^+SiEqBy{gPGKHsF;8_odzotRnS%>BYjUH
zQk^Ck968byVq>x>KAMa}m#)JDudf&PeybEmUa_L4GaWTuxv1;52wSHWwoa?Cb(#4<
zv9_;3?CZ%RKnowRmVxc=tVa(O$Cl;6Y}#xhlI#YU4rO9r`}KlA-8g9BZrTNEvA@sa
z?x<ZQBuRv>MdJZm>b{3~1G>9BJL`tN&B)%b6}ox@cgAt`Mqy~CwO9tMd%6<qPMDEQ
z+sOB&AlYUXar@G-vNj2Et!ZLKlYvLXX;fU-NU&BxTelq9`<2-84U=f<-;BntwP@?x
zfJ1}parnX-3C6<(xN{^2M=oW`2cVJ{nWI82WO2j6i}@fs-CeI(aQKRuKS%m6Nm0By
z>~e`9r^m621w3JR&&5L8QR$htAt=N8jw^DRap<yC1n)yv7~tL=v-fQY)E6z%R`?Ms
zU**q{kG+Mi6c>A;7zYOn3Dh_+VnO3jnW*llLf-ylB-oNzpVl^{BB3D@QKhRfW4<5!
zI3?~XQ2UZTrt4##E_}r#_q*ojpUm|^!AdJ)Vj0ww6HU?wWpDe>Rfu3k*!w|&p>KzW
zE_`F=j5*&63<!Bgp$K_n#fnuA+;r3JMhd<As`xwU1JG?>5BTd>Uk$Jpn6HlrTlChP
z8MFQp5x(&Ac|l<a4-7}}++e;^el5uzw2zS{6X`acp1Q4RzCkUrva)1QPb=Vm8dAqZ
z!z|a_N&70TAqk$K*1AA#(5qq8>3O4gLVPlmdM#F`>5#Z7TV&N*k?1Udz9~l}Hs>L=
zDHSyx8)>iu4}N<M?tRS)M_)SXd$Lf|W8wou0(C>X8Mcl>hHh=Y343~S$8^-=$skl7
zpmulF&fX$nI+g)lT`Z496R2xCZ-Aq3J<BQ{pay}O$^+Cc?RxZMZwX`^P`hLhGjE{T
zak>(Qn&mLqjGXZiTNjV`7Fsl`gY}^zo)C<$(;>b(7lwUBJpLSK%ffPJJffXy#MpBX
zYtMvne+DcMnsMuywP+l=2?s~E;LZy-;O-08;por?+%vS6^kLe{B930l!I8^pID9FQ
zV?t?N)j<lGB8wXV^^%GG-A7(E<BrSuTn8_kaPYEZ6=d*I1nea%?z@<U`!43-o{=0*
z_mjrBE$qCw<B}EoFT3hWA=kkx`QqS}d^DX^P#j#8goAr<cXtRDTn2Xr3+@oy-Gc`w
zxHGuBdw}5X?(Xik^Y7MHQSdOYhkNgw?*5vnBVK_EcBE^h-unUk(6PNF2hQSk(v}RH
zbl<w*)0qeNRw66P{E&6qgO?ca8H3LTfF25!{g-22Mn&-r%oK{0XH9o*=Go5PG>P!X
ziMh<k=pjWdjzTKE0zP_tGKk3`5VsF;uO3^S-#@zhBPnBv`F)mnl4SbmU#m;`{q8oT
zQj#+w6(oxCP<SnQxixQ)?7!`&+BM*$He>DKtf~E^?@F`M^PFG6u$FPQ04`NSy+MA;
z7*S%4C8lT6jQvES3*uvBl-k?Ju4&pO1#RJbMaUN5$`cOF6A(wSEQTo-V{-nH231v6
zN&fsvvwEwWE2A1t?dm?Kk1?3Ks;bbPL6KQ~lI;l!p+&lXOLyU;?@j#7YOwH)FddyO
zH<~JcDx0^;m6O3zzGkdh$rIIf#fc}z&pauznGpHmOK0apl?}%e)9FST(@{qP$MOSI
zL@5RK$vaBv&B_qCLbxxuuH($PCIQ1&CRFBJF^7=W^%^@z5v90WMVWN>aB_2T`8=pf
zgIrGo5IIrQjV6~x3y8k~?BxP-S<nwCkHM9oA<kgTok7*s+6lx8nku=4oc!o7i3ViN
z0+HeX(P=*5ub_7cwZJ+s%OlLGH9hopn$t#f6oxT9v?9;-x6kqn1a%1MG@by!@%%rX
zNTYT!?Q6TSwMwr00l;Jwr|bpU;>>c*%sQ(;m=?i|8Ks&^HM{Qjau&SxD&*Q*$q!Cf
z94B4+eHrK0A0fjR@RwpdtvqG(>UI0kVNwDeBZ=+I2A${5*#OnOwkscGFL`_Zb#e_E
z$_<TCf(^ZfLt9S*m$5@0R$T)2Jnn9&KAL3F6EC@%=M0=|Nwozt_?I-AxdRGYsqa6T
zvI2eqVFIE0s?%kuq+jvep6h1%7ju;(ONF}J|Ix1(&GBo!#Gzs#%-y{p>|k9J6{}Hl
zFv1<<YXxRnEiW&Rr9Iysisb@*(9zJY9t+XsLhCu|niJD2ts~_ntViTV7E`cOZ0T6(
zH`SE2YioN|>Z-~LI?9%Gb?fX8Ckm=mi}M7Ev8rFH$80K7ak1Qt{2ZQQ^Km6V9($*r
zNtv>nkAi-CMha=7@qH@Y2KEWVqawbldH|QgZp9AXdD$sW@>}cQMHoANRBAF$WbwxO
zzg{a{cV51Kx$Jx-ZAg{`Cnph>c|9{bq=dh`n9U;50L$mJ7wq&vZmiAg&Gw}1?ChEk
zAl!2ZtIJZ+oaRA@d#>m(Z-90bl=-7A{!EpzMY{+JWTSq{5p3f$j8zr@)hzGp=!|ik
zhZrCGsgssDSA(hOYC6K`NB@#9d!(dqf9>M;NdD>yGth$jVPtv?5h^f&MNhou=ObJ|
zTU9yOUb~NA721e22W`<>5_xdZ)=d;0l(gj9_J!W|8SFxx*2Dkra#WL^jYU35{!nSS
zONmVOo2fvUp$ebMgW%{(6Y>4UXT|4Y3OsaHW-u6yLm2N<(Zqrg{<9x@AxCCO$g;)K
zbVSafc28hoiy&&Qgzo4{KgH_=Dw{;(yr`&93hiRk0}_xB|CSLWge|d-rf8&w^HwU#
zFHI=ADHADm!6+y+tLxg)p#8$tGl!yP07cW~Ghq_{#rN0Bt%(vab^&jAmx0GSV5J^!
zg#}oD2RQ9}K*a`~2ZjJT57;826?VwUI-^ChVxO30Qqj*b=jQYxWklZ1w)yc>`#D7f
zDsxk=MHD)mh#6Ei!azS0;;$`=cMb@fwg!ct={NiiUw5R0U(o%Y`beE{K7&w&q%HF(
zczEyvoFRqu+jw43(QhgJ<goG4pI>2aaXy5=Gk}VYg!}mz|NCfDiaF}7dI%<RQwOVQ
zYn(bVZ?gY%M-JTi%4sd%u5f#hHf)*Ei<K+<-#kTrlQ_byHy;y~7WwvO{*3V13UQUO
z8*3;5FP28}4Ec^N+C@xQjx{N8%k=TA6u{c`rBZe<*8k1^X&cpFp3w^ULw}f6cOyfZ
zHC-1C>}E5Dw(@K}&ldFdfa2{*Gvtr?$3{{>dn2us8p@rGZC_`n4O>T>DJU1gO8u%A
zICYAl3tH$cQN7L69?8&8DiN)ap{;XE|MMefRHq5^(OhgXk>)$;A_hDlQt8sq409!P
z6u6qkO5ioV<Si8T6{R)9Eg*fJv@y$0(>riwUR|fv6nu&B0@`wm!G<LGxtK0?#fVi$
z1|_P71E;XEa=GARX&S5cQTh^@sZ_pzw$^HK&c~!yT?!Scb4aeBG*o=E@pNJHgK$Zf
zHt>=}Y#2};*Rh;PZoEIam^F!23dfO~xAv3POuG1L4z!ZpL;gu1MKjmrl4~Wsy+zq6
zsEn5-X<?l>w3HLYOk3TT)rXCI)Xu7o5O}v8S!g11&W3V4L5hFNyGeXM7vTG6gKA)7
zaM6UM&Elu84hwF{`nQJ)1TyA<n9B@afzf>p+=jqt5rs&~6R**w{T*0W-zw>{;lUF`
z>Yw7{zx<`i0<pGxQ_i*<zZsTgoi@768xySGaS3<3J7vR_6he0vj<(XJhU*K{L(lnK
zY}BI)KR4$fXk%SvY`%rwJoTIB_=bW}bgTkKg7zB%2XslBME(F|6xwxRvftJJfX0k^
zVvvE|@HeVx{=yn#C_b#p37VWm<$ha7P$xsrkzs-FK|;3~ytpIkj?!}S*p~FiL$c#k
zyg}3`FFf?*_*(eO0?J_T|9<Jh;_B73)aMr0F*wFSx((Jo-8)`RtUV61E=?R9QgM-|
z_|ZBsr%?kok~p;m8~C7@Ta(NnIlq5*lIpZxWPxm)#GA36E~1U&6(A<TBqoV*|8=wu
zP}00B67Tn%^<v&>B*>jDM<cBMSH_9mU_Bex!AKf@zbtJrh6Zk(`^K}Q>`apZdD-7t
zZGgIhC7KY*MeK>Z>3jYh-=1HN#+5}g=aSwk39xkqV`GhU{|gCwyZ?z3(W47WH$#0P
zkTOWCc}&`VIIK6a7|9Dj&#hMa30!pf!=w^i6yUQ^obf8V1!3hOO^Q*WM`DfIsm<q5
z@E%p=YS2+&xU_RpHoA4jiXIKM-}2!&yjpH4jnOusW@(npj9?{2U_4BCK9pGW9gN_s
zR1)vV>R6E7Tl@1%$DkzG`RT_RuWo1`?#Q#(Alh@d+)@u9LtDV9t{S$%XLVj7mNr2C
z2MH*doY_b408ctL;6d|SY_WtKgyuncgx`SaWWLyRvLB}XKKY=cf>I$!0v6hepmcHZ
zz_CbPT%Yr&_yooWIRFS98qF*J7IAl6`qRrtZ@u-(Po9*x@hVZMBqP~GkvC;CX}WX2
zNayPOvLj?s|MR=P=RP>nhU)(d4Kl~?h5j<S5Qfeu0to#I$HsxVgXxK#!=M-~ZW1r8
zC~s6WvWPuB$|fAV&2j(}*1cU)InPnh{pmZVAS=CsQ33BMO!o~BdUqF9IO1Z0L?6}p
zX8G{?te*Dz?Ups7-h9%;&=B6&7pi49h96LWnMmV$vxoGwmoRyCO`9`KKyZDaV;||>
z^$6t$0nR$*4XK>z+sO&T*R@!<&isPYGm9GrZPc2;fuYq9_f!k*!#~Uvj#9EkVzc3A
zdfWSwA;uXSk+uC)XRKX86_$`((UH{?i)7ae0!Qv<y@sQbD$X=_u2xtZN&UxGj~z{b
zwa2Ve{LuOHR-3^DGQHrF3sE(9aPeG9nk;yJLUbUF#$OnK&eI;PYS32ooK`}JR!d%T
zj;GFPQ@k8_bDTW!?sQPztD{TT)0~F!P5<svK&{=n8w8Ylz~baCQHF^I5*Sy6uXia?
zZp&3)GrnS4Lh;Fw^{HDB=?1-2F=)op<yOgsOeE7Z#HcxZiKoPuHAg(mo`P>#Nml&)
z3Z=lfKqujqpuP6ugYaO`8s1yLvzgXr(KfQY<V1T;+{y<CxAe(s34M)*xDY44ql&|M
z4MQy5V(9T?YEbrD>b1{?V@(EmmJqE@YX4cvi(eyYO#59uEOt@_8BERmZ|wK-71EC<
z=zAV-jA9BUA8dzytS-BiN#Q?t0KK~rbvEPuGCX}b8ad&+`WD~SuRfQr!luCPdmLNx
zPye0WSm6WeO-f2is$ImB)D&^%{%}mC-1hdAM+ywp9G@FYf%iL(j+oO@Or`w#PNcz@
zjnOF@%`n(dAGBs4*Y&Hb8e!JvXf5o;17Ys1OX!onu$XVZl`=hK1>UY4ucyRfx1O#C
z!F6@Ju{k1AQn-Bl?Gmo8%&d@8R`(rgZ{WmQ<df(Z(vN4>g2gR<dp}&(?i=PP-8M*T
z$I=e8gga)yf#XF1^>ZHz*NbWZtbP-?td5uq;Fc#QPWmgmBEQQ@^$EJ_tG%EXa>F1*
zgOZ1}tE8Wp3Za^4xduX(VqaWQUaSW7poqGih*KlNinc~m7&8DUaL|NnX=zPe+_(O|
zqD^4av*EnVWOT-xGWjhT;=GN$qYxbOY+kO<$5GS&@6d7b@d(i7yi2@N%U&Q4!9_1|
z{#s;oxNN+QSJTV;H`2*-R7TYR|1fB3FrSwk+3L}6U?BiwdclAOJTsnuSH=J;K2tp6
zqbL#6PDad`Vj2I=S(C%heqeLn<F9d*pOvmDFlNyQiV$0;@LA84xT462s^^PJ){`{*
z)Z;PtEpBfO5s)M#qoR}sC3EM?)g*sKFNR+mrjDN;!!X#r+7&E%HBmakNF5BS*YWNm
zn7UG*`Qh27N3{}au?*EY{lmCVb@|(OhLD8;IlQ<UR?={t`dna`@q(x@8#kRaG`%F3
zRcz2d>-ivB*@=viMdQF%pVC9p;(WK*xKWL|!|BtM6#BDujUfBZ2iT353;vzg%}*h}
zw_Va*a1r=UQg8~Z!N7FBlv!yi4+9@xo4C0-chF1ME9t*?FmWuZ^Rz0T$MuBs#T(Ay
zl)0JQc-t5q2jjtUFK=kjqxHP~vWu`{`se})1?7{9her)<A1;h#>nT5WHvo?G0M7ep
zdpFQ-7Gof0!Y<SP^51~MV&9}NTDT1T8t><`|7V1f&^yuRZBN*nLifjjyNI5v{pJ@L
zQagxjeInO6CvF96>z2N`Q%{#nzLQnE_Goa|#Ic9xOo9TwVjc8fbA}CZ!|bB9o@yDE
zMixNHJ+u{d11$9&3s7|;j6t9JhxuTSgBT(P;Z4ZEpYip)__kwy%o>02`F~%D=(sm8
z>n1hlc3^D4PfU_tQ`{GP!h-bRiqjg&XDw6ghSE`k`ET!}3}FSwUFw`q7mH|TZgj)?
zL49^nnOgxfMkia59EfzYsDh^Q(;Bg<)3k7kmghy!(woZrE~$ri3%1eXqP|Tmiy#cK
zFr@9h-{PFH-%o>>Y}3^s*Wz?iLe8Isb=I~O2s^mNr{-=a@(iWbaiqQ;N6*>B^i`SS
zo9YDuK-)~|Adk(_wiBn6`FiQi6#eo?hl#16`$^)e0EvUA=#|Q_TH7YQdw(|N)duDD
zZsKHL51V0^Cex9FI!iJei>8+M!9I$Z3HRWrT==>xo555M)4RY?HOEO2;mbnaRtbq$
zF|?I-Z(I$d(h+wdrJ?$_gE6GPL@<@{>F&&RgD$3#r7qn&a&DUmLZ8qCT&yT$KZmQp
zS9gkHbXNO=gNZCM7}Bb74elrZb4D)ov<201JwWJjQd(S+Rv67{Vaxyb?Ckh_aM}61
z<*^IS;c&Yh+Lodiyblt%DZ#^UjT#vEsXx!<eULf%gVn(I2F$#<HGg|M6h>tuz$DFN
zGg+XWBNx7(<G$*RWZkYERQml&>IeNO^n|AR`DZtFdu;hOFnbI9n~t8@{HUnVd}rRi
zbAoZEG~e$tmh>CwIHOn?4*sP;dGyr#NFtt22`*eVNs^#)!Aax~Xxb6-9!&iDlbk&8
zCCf0?Y$nDlec~${@#*?fUvIgMr->}M*OIQp1l;lFYjMx_k3d~h87*utYgyEOQZkbR
zrTqLlF^8$jp8{2i#kPN21H5`g5%dfc(VI=1T;~LM*@vmU@>K=`*3BH<XTj?yu@$%y
z<xN`(AV<xyNgJ!{tP7fFUxJJsupDen)s{oF^Pa|jnY+|JpVyJ4hF@DVbCxfgKmU@e
zt{?4kBu)C5(q;sHOM^X!pjK9?2IRD9x6*j-;LQi)5NX?K=c#TN%~V)3vGgfEYQqGf
zO1A<LTcs`Hh*D;++GFTKSi3!O9@*)9`Dn_%XN{ga28}R#yjRGU$*SeWciJzv>ibAD
zCSQ@HWKDs$^O!Sg?3sc_=Lje7lrU$Y+{xJ{M_HkYWBtf~$#@oLR(|=B)#Dg4tIoOf
zN`ap<Xk!RSSk6#E=<<Hs%0L6IqaE@fAFXf`ik1jVNdJ}nzU;$=5{(L7=HFUuwcsv{
z<jsa7*|6{e5}(8IOT?K1|Bu_8|3b(;mwu1@KBqdHqTb&8Gc)WS%{B_Qg4|VVb5}xl
zSB|0gwceM-<se4a)pqyGLS@&LoF`8;(>WxKwszdHryTcB+9eD5mXw+Eqm-*BOr?lh
zz4e9@A}LajFOPyZ@FYG*=mL&A^c^lQOo}<YgO`ZBt<P_xqvMQd&}JtErTHIQO8x`x
zn;+RA`;Tb*?(l#fBdwP$1NKf4uj@6L_BN}^AB>y?D8&cFLOz;n4t*$Rxo)jO1G9yL
zS$uawR78hcQyPkc9^c!q8;;7UP;oQCn@0j)iiT^++_{QSazNc)>AV#{#&Z<YIJb;F
zqTqz+-+VDe6}`m2rN&Hqc^&SHHW%>DNk6>Eh@*_Zerdn9n3A-873p901I5`X9lG~~
zPHl5%sv)!ce4vXp7}3{&M9mGqAK;=@D(;&iF;h8gvMv^&2qRFrG-VAzOeG6aG$Kyj
z3-R#A!8p5a**=DJ3Wld0CH=8|#0aC&jUVHez(}J$f|%>{_3-(qEE49me3<2X9IXXb
zHk1EDuG4l)4L&vMPk?$c6)s%tFI99<Qlg*Kb-@F2ZWArQx)@uty!Ikofb(uvzpv4P
zkm2C#!;k|+4Dvy3|K(PQ=yqF7W7VIrZ#{FH9#GU5G9vMG9bFTcb$3tfL!JDVmxtXa
zU6d-|-LM8Ov-`Nom-E28)R?w=NM`0C%H<%zODZH=&n9U+g5AGzUu}j1ah8kLvt##{
z9gQ#Y$i`3*MGd8SAOqJ4?(uxJNm{c*k=d}(l;B!+PQCn|$A62AUl*~UHfBC=*WuqT
zo^RAE`8=Lq24DqqZ~9<%zsy%JJ%ho8AL!u9Z~{Jl{yzpl>64(PCSO{yw)$q&^L4?U
zf85zUS?;9$f4pPDy<^q~r!LM;&>Kp9wtL|TGM~-W=HhX|RpvNt0Af76JN$Qc67M(Y
z30Jph2(Iam(&8K=5!EcOW8}Iz=jRj+i>9qt;iqXl@Uv~*eeIH6tPdA|uC7a>+s11e
z+{g2U3;g9e6qgkAfUV9~m^x$WQ7~8;erIk#+#rR3KSv-YFxRGegu-xyVnsLa_*-tu
zSRxq~q1lwYmOKS2*qC59*G?_}D1dXr#Qkpn)bVH@5dcN=%2%fc`fl{-iKz>2KX!IB
zXC`K76FE0pO%PZh0fj<aA+-yZwA5eJf|bOXFk~xRlTb1sp$+(H8ap_E*;;bRNV-na
z2P#^n(MVfA?K%P}L%Kqc3e>q)cc+R(zrX)HyQDS$jqu8<ZA7W?Izj`kfs8D`L1}Q4
z?Uu`v5zlol0$9ocY;4(2=jXP|ts05kl+vc!SLCLh!eImGQdY;d#oYD2A*=`qAzE-3
z49<z$MU?We(6n#z+zb^w9`^U(MtX$Tn8OLe_UgwyoctF;Eb7rcBW<c1uQz*wt?*<*
zeUU_&Q>1LSiZ82=^OF<8IZmc91mL}4kzb)ACIQA3(!%^#1c$lDS)R*Jnyy_pCgDo7
z%99IGJxPMAydQpmF@rM1-B10jn)x)3gVxoZG+^pqsy`Lxrq}BCWH7Q{&-dNqCe425
zYT6rquH|&8b4^RN*tVWm0N@+Je*)$u2oG7v3*exEo)WX){$mj?$0%O^r5tp;>w0zE
z6hqy;@V@NZRT5OlfpcA*%<=)49`4mXXPHKmzFiIOybJr034QEwTyN)mQkVi0eh6~<
zD1*)HO0vf=-Yr6SKj+jjOHhgVg26Dj_P$h_qoVbTud!mHmwml#q_Mkac$hE35(?UG
zZr}dui99eV0g;k6hGyV+1zfbL4NP2XHPg`|myGkJE5G+04Pn<li2vhll(tZf)KN^@
z`df&?<77sxEg3OAW!`)7Ky=2JBL~9qUP0==h@q%0&d2lSi#TR@aMS#^@pV#6;v^5L
zwLSUoIWO`qY$KKD9TsA|R7pnFWi2A4tE&cEl|MU7Tao;PBaP(%&|G}JFD<XATz=_A
zR`*Y-5B38@f&(&E4K&3t1$E$8{H&m7JK*SpAOWxac}i1uLe=_r6&j0u4ZTmkM8SA!
zHCHw!>nTEUo1g%0&jhYm$TT`0X+3i^*!CZq7YbsoliJe)b&6-*YAo7e!`HxHVq!Ez
zB%G0yVkW2?lB1oLl52nf3EaqMhV^W`u^T|nBIj1>q^HZOz%?By&WjgQ^XD?m&$>y^
zH4><ws9#iRncZh^Y$qpMg*ScJVk;A0hjWB#V4J$e>00=)(`f_~6}A6m1n>E3^|lDX
zd?=FxgTo?!{RKYJ2X2u%CHZT^f~tpr1~HMPUd6@y{d8SbhbhhFqo9XOMVEl|Who8Z
zl4E(rj*pj9aBT4@<O%%rjsf$qJ}Jhvk&%&q-$XDh)Z4fF^1r;mO;68`*7)rl+dFWB
zuX*?RIe2c)r4ZT@`hY|LF=>uNGj0jsg%jds2?}*5`;`=J&Zyhtfa!DfmNipUzbo87
z;DCbBa%Si8^IhoU`nq`Ug^WJfaNHjw?oL@(W#9$pJ^nc5{G?=kCJbpV4&eKKzvyi)
zuT-Gm?LMIa;hi}agOCC#U!UKFIFX&BdU6juz6)G%JXQlERAm3*8B3_iA~!6Wlb2Tg
zCNFWLxvA>R?9=8%uIS6Ew)xld$7$&$0{VCc`dIJqwzjx4uKjqOSOR>o`P(UZqxX5)
zo9BX{q)rOJn{hc(7GQe;>P$ssOMbG59@FuXpqU-GD@g&guw3U+Yct$gy0l2X{CL($
zUGtdCUSs<XQ-iXHSrU?8t=ZCGZMo(%^-m-jyjYxQJe9pcAQDR|IX4J$rF8<i4>)b9
z=yv|eBC(RHYxuU14DUwAiD%egt?cCg{h_H^Y&XO;&$a-vvQJ{q0SzuxVP~pFhUkoY
zHwNPILvoR9=!wu=(wb?mc+2R)=NM?o@&8@`juynFy1Q*bt|QxON~Emnn`HKmQQS;H
z;YAnn6dDmvrv_I;LAOlp$h`#*bSWfnLRC-&7eylt9OJDq8>Q*jz`#CqJT$~lkYP;<
z9~jLfwPTu9&T6PgBj~d{q3M$}dAY8v>XeOa)0&@5sO02}c6#(}dR{rwAN(Ed{{R`I
ztld!?8~O*ND6i)$ow)B%VpQJ1KE@bf$3T9|)^Z`Q$xa^kt{{=|)<ukxe1n}nunH>b
zGqWD?3#3H1d{H}?E#fVeLZ+8~afH$KEE^UDrWMUd1q_d!`zzWBb-k{;UwyoO_UWGp
zzaLL}yq;gST01yswup?gMr~9I6ry%{{d$SvzxeCAsCSsmXZpOW-J3M9Jj0$;$vo@i
zDNpA6t%cquT%XoV=`_iz2c#I)AHT+fXV2XOv=40~M+zMfr{XLHdKq+B5NgGWZE8n0
z{lU11ac{;oJY4oU<J0)1cm6Z9LD!p)S@$A#6{)tl@62eGqm|#vEx08V+%!7+VFk$*
z!vE*7txM;mgj+a?!7K)?gs{$&ulDG|6#O_cC(ih*7>PIpvjY}9h0W>3Asa`VXmuW8
z5%HJy&~lxS6G6v2+Cn00Hyzk%a45ekqtUOKEjvUbVYQ_xi&q=obyTZECW@e4XT13r
zw*KyqgIXq<kbYSDQ@YMlvTS|TcCe`V_bB_#^EAr5wOcZ@O-&=nN1N+Hmi<{lwCkMQ
zULO7@DJZ){d>2U49nSTjIla~lu<@8f&Y%5-rvsT79iKs4E<~EU;+cwhLaRXe5+;UD
z5Xegov1?1*{bNXRUecX;GNgLvxs%_@lR}xq;~JXFb<V!){(HMn*ZaBst<escA&dGp
z=>G;sO5^6@689p~N>)-;N_i|6cLun*5sMWXAh_3a-|UmPK*cQqyDjfD-kgVxm5%!i
zJ7}j2t}TJU-(=M;-cq<aHy1(-;cIGlWRpUV9fWiH*y;_@crwGK9{Wl5+h7gi3z(Is
z1kixwp4YMOjNaakbdov;mp8(wk|o$oQcAb~m%h*VZW}K(SiE<WDxHws3;Byp#<R;w
zkcL;jLpC8<&QDLalYk%#N3s$9+7ZkYHBsHIX&d|f&le}RF)g<#p_nT?l*^$noRg@f
z;Rlgdqe_Ero$;e5hg%lozlnO9E{qcQ#tfMkJSdxZQ2{__bA4Q-h{8T^<4{e}K4g|e
zU|l)F0#yQ9Ng)h0m}XY4xpw73khrJr7Q~0(>5f-(sM~6BRP7LyPL&Ya<wG8{LLH7)
zGA%uo?8eSsF^s>1M<uOeM973Wfs|3RYeRi=DT{@mz(-G2BBVT(E!HRqH4=*aZ+==5
z7iuu^Cn>w(U>bYv=l<z54{*eP2J>nUfEv0P$7$&7(Bfhvo8vxr0_t~GPd$Wn-OfkK
zsiAxft#RiARo`^P;)1j`Qol@H_}>QCWujhaP4wu(HrB5~>bw$Qk;sPj{P{KCBu+;-
z8`6^<lemt5rE@_W*c*gS#6wE{aVrkgEJ-D1U-a$b%$D1cg9LBQ`j6WL{%Ksl-Kap{
zD8E8-z4H^(cm<|MVcK_Ghk87&yKChaIXXc;I!_7?R%CE_vt&k(k1b>e05XL(C+co;
zDcuoJfk>_S`Yqo?p<ft<A|rI!PhP$qMGd|k!urVG9>xm4K<kK;_&xE&kO+o)U$mx>
zE1-(j!E4<Pz1Nx?+Ql%dmvZtr9}xYA>)E}X?B1GqId9(Rao_YI-1OX4aCGzt2At2h
zXhP;bdp1fAn(QIl;7(a=g%p5?ay=#%jC`l5-F%K<#3tb?gz6uL)$VAwdcKdlm;lk}
zWb4yLIl@xW?ONLC(s9g*HuDmPyZ*4q#IYdam3E>cFO~>OuTPZH9X>6z>3d%C9Ej30
zkNn57V&&Te&p(N6wCEX$Y=a8Kb&{EZ$F*EuTGbMfaQe;Jx}^M1ebwlv=Av7wZX_&X
zYyMAGHzj(jHaUk~?wS1<FpZZ!h$>$zD63fRN#sul_<1ZT=1)S3C<|i2e#mx0ea#N}
zN<hu*T_e2&D>wB`GkkS2>F<jO0Y*A!N3+r;NUTqM<W{62nk-9#pcOcO8rNnJJ3fh%
zcf8}(bi@0Ki09ET63J&V(`l&%SVe;qM`#;CLNxu>o_yVgbK{katZ|u(zW84JMZel<
zQwp(!eN<zzAHk%;O^E+zyh~_g@F`*)+sM3tCXX^g8(-Km$*?C=yCP0_gJdO09;+^J
zfR_X9a_Daa3R^0+AQHJz4?IfhBsLyKRIAa<gm~-d-GpuS9?(%Ba$T)qw;HB5SJlIh
zbOvseR3CIuZZnymi;HOTvOMWG07~YvVwZ}G+P);ElTPE=+@Npse)-3->7&?U7TX@<
zgl<2XbGg;`Pa+b>S&F!o=Y_ZVE_e3iB9njh5;Hy9^KF{e!zpxZ(Pc27MH;h01~J#}
z<u1*6XN%bVCT|cN?3{w8^m`sP2nWO21Nl!byKkXj?+L4YS25?_dXE@h!Txxkd5adX
zPy{}3Agt`Ay(N>|Y`qdRuYBwb@a@%n;z85~p9c$tW<YCBf+k{&l4X11e6jeEp|J21
z8?M+WT24)n6AnNE)I{6cVL-bATjua28)DI_7A&}a44xOTmAtVRYA(>|{G>vP|4g*D
zcy?^P0TtNJf0iCY0oKFRFiK=*X_ot7tN@^m8+q8d0_D}2+{(#7D+2))B1hv_dd3qk
z29Ns`q`AQVs7h2JQGsnyM$EioOf{&fhNR!}jcSnZgRE;F!kH|rQpj?7vsEs|Z7R`U
z25fR&Ov#JLiOWI-NIY^=XY=6d3<=v58+7%hx}1pGO!w*35sCQ3BVArg>sfa5;%G;{
zwzg$Fz&5~@Ana64TcZNK#a3>2*}fzXZu|c7l8^Qj*sL407(9cq#Q&?N07diMboJIj
zTSCa1YIw-qz_8{-fh+T!`mV{eM4KJ`G;ZJ$+cP({)dLn1>w{v>o}?EF2cetH|0(3v
zIYHv{5+kv*$<=%Ht}DVPrj&>!0^!SBVa{fLewS=MSP6!EGW8}wZTC5K6_N*6U<%0-
zk&xhk3v326dHpi`E_uI6Lj}X3l7ia;X-igD`IobC(b2)pn34H8tv=6AOHq#--jkap
z3#(w=Qz#Gnh<m*STMP>KdX3xQub|ZBV68Wap@`~qB84En4B4i~fmSG!Zy)EI=;oQh
z=Oty+;q*2|XWtaEkHII1j=8*7R~Sae=LnYwpO{)2@ppa@SLauPXhhB*%&WHx6<Qos
z*!B@@g}bgZLarw=e8<NytgTdNlU3SgQ_~KyAQ%X~N&?3C<jBH>q^bF0vH3)pMh?>J
z2O?9RyOwPaf(wsAqE`d9KF3-j{s~;;SKj)`6~~Exjkg^-UmfMh>g+m;XDK#+{#G5{
zJ%Bc4xG_rzW%gHe3yTwQI(0t&)&%aD`C_TAirDZSWkFCquv73<dC_2EozpA?IM7&M
zjvRBrzI{{{*KoR_GCgN5DkjxrK~R_XEQ)XC9U;*-<#l$v92_w?CT%6R<05nda*g)<
zU2jgYAi1tjV0<R?ZRv;DW)0DPY{5+cB}BGqLepqrrop=8>LlC<7*~S<2mVvitu{rz
zLmU*s!>LIoHi5$b+(a1c6u%ia%w;9mGz4%OG=vDdkfUbhsoB~RskMf|kN!7n;e+o>
z8rYTc4yCTP6SM8paBm)Y@WFIOI?)#p86rTxBs=M<9LTzii5ivY@D2MpYgkswo`^G0
ziFZ?%GgMgGKnb4_rivkv!W?cqvzsDGYijU@oCO7&%S}t%cT!UGa<X@1WnOeX6*`L<
z>bm_l&L<z{Lk`!-4oD^%hz*Z&Bc@pb=?odPjaz3pCceY9bW_zoe{Ck`lXm!cQDVv9
zIDev<EKGMQ7Ru>5?;`RvK)AV`2t>?#JyzP>=ZW5Yzv$-Gresm19=bOAt+e%=m@<(y
zXrd%UE&b5)`Q%8{ampf7Eab*IUQ=W2css5Gcr}B1!}5>T#&Uhku<ybj8ikxuomm`1
z`ub`6%OLJ|jBaRh(Ywb-tE$J%KaQPJ+V0_v6MG@=_-f8vY1`M~LxaTk>A>Kd47-g8
z;g89jmZ5Wi>;Aq*|5XTjV&ad8IAFGe@iC>945#_Ga!#v~Mgs5`^mriw5y6dy+~!de
z0R^wNxCbzQQ0bzjEFX;XowA1METy*CMVK>|m~o1UpW`+aS<ggCqC}OH`tGEI(VvZ5
zfqVj0t*N|fkG?vAW4O93%7Q8#NqiWIH^o1Ri>L$~t?43|aWMn7pL;tgH=jc`UV(q0
zx$N(nXlFM7$~O)|L2X6Fx^s`xJ&Ku*>ss=lgSz`f_?eoF7x|9FU*CI|UMd3jV%k1X
zmY!_TRZwRx!~_RZtccP?%|`#7cv;Hp&ZmwfOZdLCYhKFz3@@+)K{oYZY!k8HqM?O|
zG^&7U9SAEgqf~~dQzP_90QIT4eCVH%NHaLNHBx4<mw-RYtwC)kj#Mb9(cUfz(T6l{
zWh%8f8{(meL*YA${rTL`=JsFrJvl(fuYdRq>p{9$kX(zu?gTIjD(!%BS#^YS$Y!iS
zXLN99oULz2UTHHHzoJH*upS+;mHwL?NU@3~xQ!jtIqyIfK7kAf2lq_QDG$)MLf?XH
zTm<Z><#OvuD>hQ%7#!Yug9CY%PF`pQr9<!l-Z^N?msXq3dpAIw-}Ao4^~>pI5whQR
z^@e8mUJH3F(<x9lpELsv>V0X-#FY^RM262CYo<`&;(t|4#o2z6HmglRxJRKO!C=Ge
z^5$x-iBuQ=$(`|He@Xu>Wp*}c*Ot8z`L^+cyf9$>zT-*){tER#BBlqh?V<xs-~04X
zk>>Yie|sqLO9&SajUt&<Cz_VTpWytk-SMUHmdCpY3RTE~XqX-!KBsv|&<(%SB^=r!
z3rDsQ(W((cyK=>Lvb?P9rV-k(PT&~feMVJ!FoVg(QrBTr$N^O(mVWu(2zdJJ%A%wN
zdwzet2KK$qPw3)hrO^o_MjQm3%4FbFR%_O@bC5RY47&$;fyZk5qG%GgRSveP`RDnx
zdi#h#ktuy}#203R!eL1nlGbxmSd5h;kyxA&8Yh<EI?0d<{)F0MZ>R^?X;^#?8$B8T
zxzbmCS>PCTY>6D9sm0Vl)JvDj9BNfx@*(pOkBx|~9+UCu-Psvgn3N4MY7;z4Wr!1v
zs3kYqWgG_oL?Y;VM{=Pt3zzxru%nW7bY5>JH?7}HH~}<(M#8c;Z5d-q9Dh^k85wmr
zpTG7iu{Tnetl8l^?4kqxV9>}Tb%_c$lk4uYsP=CWICox)_PA4)l{uDJFYbq#I%tjy
zpVrJp6J9S%<{t>cIL~9lopt_840JTfZI-ZHV(F4M$2C(aEX<uo!){W;dM3t~oEl2x
zE1?U9>n2(aw!|Zn#9=y?WwUW@gHa_+C_h<|%^3CJSFhj1EiAsFwnM|R;@Rhqn#R4C
z@fqt<?p3$$1*!Zm%dHAMG9NmG9o+{CDoE42s-$G6rmZ-~PZBtVQMf(-W6@|iem`-(
zCykiO+aZhywDmfky&Hzl@v{~)xXrc<Oo0tb_Ge9Pj&u4H&Ji?OfE&$AULM#}{x4f1
z<g?{)vI7&DgMx?*PKu-5G{=Fiz@&|v&#+D1ep-l+o*d{GIDbBKx4(xGzvBEuL&rYN
z!DpNgHniOaei3~Bct?Y(yf{;osK=71II}(j4pWq=J<WTs%qBT-kYQKz!685!?JxN3
zg}rwvh@l7Lg$s0)8WSEoe;q+hn1G3mT%A8UW#JlsQ2!{b79X+2=iKWBedj!k^pGNu
zy&T>V^s7vf4c^T|XkRJKAUQAT<hN!8db`bK$DpC&gDZGC0nF|*>?LNF!6Lq|w`tOR
zaWH03`?1mx(vFP;c!cvy>x~fJ{FXscAtET+Wv53wDC~i4)|PQae>*FF`7Ac|H0~_S
zQV+E<l8n5lcRT_u<($ktfXA7Z9hDM?Q{>Mg7){w@VU_+U>7k6v%%UrTS`%lT#}@5$
z5Hci1xp#s$795#j3TjNPz(4xTrwbjae;Z#Sg$6Mq2<HkgV*}eQTjunl`({j{lYLsu
zccQsifRPK^ObvQN1v_T&$U1yW9l#NhLM(Bo9-=l~8I2|;CvM+>4O1pjMUn!$tlV>D
zmT&ExR<TYxWW)6rU|Be?+bVQ{@>LN<?Q7xh+EZQ=-A)edfs8uziU=%@z92L-f~c)2
zGHAL3#I~8wdc+Vc5l#i`4Ym9IW4D<n4S{a%60^au3S~?nLI+lZxCXoWR8n0${7A$v
zGJs4$ZjX@x^b?HV0ry}|6hY2dI@>E|2*uOxuP^<y&WA7lJC~$S*K4gGq+s>pol+D1
zCiYAB-|q1=w%1E%FqFgWF0W*lRxva6&>4GiKVWp!<j26gq!f!_i$%|lRIeDWV7G;l
z%j?^fgx)k#$^-Zl;;2+yPc|O9H<h`(qd(NjqoI_z;`&+yojd%Iy_9}?+_YD$ejM+@
zh$_LpSl{@s^3ymDeD=6!KTT$ep&$$U#LK8hlQBwQszEB{AeDaQ;^AC*msCx4^?f1E
z%rQ#A9+6SgtcFRnqT!~-r@GzeU$?0$t!JLvjbCN;h>UNI;~Hr-@CZxuCxUZ%abb1x
zmOR#ip(q!TX7sIJoe<`B9yn;$+^XV6;VN4DXo$VTQlNK6%>_@If4ct$DZ4P>f<k<f
z_Toedq;SFFTF72d8VN`d@|<dJZqRsjxiPP;T@<#FOq0J2ky_JTmBK(MWe=G?$ksv7
ztudv~$)BCGNga&t9mWislVK#*@-ZxR{t1s*SDYD}_&unE4{)W`SKedsE%c+{P%koQ
z*@9#Qy%LuyD|u^;M-#a<Qw%3gV26msrN_HL8`d&NKAdog{jXkDIaT4emdItU84vPJ
zbsA3nZ|z_70*iXsr#UqPk^y`zOuJcsW=y66jD%J~omwsab=j6gI5%azcVGo{Z032k
zU_EqEobe=uwy})x|A7sVo}~>BGR1bP^>7(C0j;eW47F}n?YzpU|MjNDp9^Xw>TNjH
z#oy6M1ackM){&D83<&(G;U{z~gdGb<9ykMrz#}6CP%ue9!Hi3Mv2{oIdYC$EiQMLs
zR`sk+i*>Co-2LW-D<Li$_FFFHznn-%V#eDzw3(AxFl^ZLKr-vk$;?}KiC;VR^*_fx
zEVkbyNXN5z534!M$6l1wGY_Ksk#JEZStIOXV}A1y6QjS+?EEg7-HX=8Xx#(fp>m26
zOc6dtMo+!=EZQ|s)BTZo7uu~ZW(msW-4}Nramk<gjk?|7B^i|eT|Q~ZWtXSBxTB+E
zV!sM@7Py8{JyolvprOH~lxwnW%&L)vQJPg#J5jZvgDl_BOi?>VrBSxgvOj+Qd$$%u
zC6Xvk15>2-blW$kozkhRkZuj=kX8=e6c&Sl7tR1M5dxCy7##1uQP%kJqivmNBUcua
zDL2c(`AMz9BVmXr`{JuX`duoE_5^D#1#tGX@XU^Ycu{kHsA?1}vH6<NU=T~Lxz!=t
zQW8!-$WlMJn1^Q()7S_m(FSP`-GsS^okPuO43n9Rn(f|#4bo|Lqj5#UlCnFi4=P_(
zP|Yw)U;?!Da_B5rbBh$inQ2FXvwB>xa}SE4ji7t|y^)&x{oJl*jQdXOn(|Hz>{!#l
z-d}SlRu&oYT9GvFaKvOYMikYnRzNZPSWIeEGed(*R}1`-y^hm`T$K~Pkj^l&tgv^=
zj%MYHA{fuIQX(ko%#?BcbHHLvw8k)dfb}wj0X2%|LLkD@%%B3UlSP}7^r(kfc&?gu
z@{~cq!iOvaIK0rq=ehc8zOhGA`{4A*ASgK(#ezf^Ny;8ZJ9N?TbBOOuFeCOJb<pS)
z={U1ql(;!jQd-7+1}F1CACe_SVELGY?B*9|dI=*b4EWz}bOw$Z@rPhCf@=as`MKA>
zB~_kB0h49~<zq&knK@zU9yfuLviHDelOBH<IQ^s;+JV|b-}$f*RS4cL3X9hj*$H+y
z_nE}UTAL6uO(`i>Y($A~qj>)f9tGIieGVS3i-@S-4Xg%Tb#~7;>ik@?;|G~hnJ(q?
zZDqB!Y%hyod(-pm<%i3)lHX0jZ*b?Y2D*#unVYy~<-%{V7%_Bk5?~__EGoNycyIc$
z-Zk5Qd`CM^6(ld{{2u?h_KW}G=bGaO;W0`0?<n1e3JSWY*=N&e?LuXwc&MRg@}Rcd
z+#bw1J2WM>GMBudK7{=kYZtdCWW$?4&edBruSQJ;mDq`2>Y;c?<#$7NbZDVPL>B4n
zMh-<3r-lq={0l)e7#XZ7MjBE$O*xb1z)i1#F>3dP4dNy_NOU{H=8SEIuFlgAiJ>m=
z{vdK4>tYYWI^7SfHrL39rBSN7XAX<4Y%3p&sb^3TGkmwGxd<1Xd#EsRmliV*us9kE
z>SQ#S%DD&MccB})F9ZP9U~AGz38#8Qs|-W}sXP!MeIDibccVF5g-puA67p~NGQ&<*
z?A6KS9^MXo1wm|!3udWRL*Bz+9`Bo06DpK6&_K<}t}Z$(pKB%Zd5`f$-SIbPEMpa!
zb&K4FwO?>zW4rp)Tj|UB%w~zwJt~QiODh@^5=iLqGjK0*!5!e<50O7SB8<Z<>vU(G
zr-qk$Nan)P4!EG5E*@n!8*DotzJNyW7a<u6qv+O2DjA~pkhd2)#*nWtgVID;Uh~%5
zd1v;JT)ws@_5ozXx{!@j0cQg3il)RdQc+?dNp4VT6E;T=2N81_H|PW$q<-Xn@Q8?_
zA`b9DUUn8}_U;G>*<s)MEx6B*bF;t9CGfIz$)=h_5I;9$Z^BsVWBg?+#sGQB$+_%d
z#8m*ao#u9qy4PEt4>F2Jm7kq4YwybZGe)v});&8`H%McnqQseEbZ;_q{HM&T{@MZ_
z1TG4=REkSg`VnwTJlSjO>YT=UK&Y)IDkxroiZ5m3%t91$gYzYw&I0gb8&1E?xxv9o
zMiUbc>_x<PEA(!1fa%K3Fe9>pGhdWKX|Inv&Dnd#zmL&VBT@z&{#EDNb6pbY7qIYm
zs)d;Zx_EiGH6bQb(SxyK3B5b|h5TCCnt$Pf9Re=AqLTs_*3&T-^hKrHF~(LFlMaWD
z{B#JRphk%3=UhUe^QS{?6eP6p2u(f@6tO)W+ns3Z%AktXt@70)bT~!YA8O@*7)e(b
zy_82wr0&cM{b98aL~u31>C@4x7C!)FwVbQbr?cpWg_4w-Py=V-UBJ>y0YWGfM8=nX
zImErrXkW9yc0CrE6N|IaeX)+B4}sFvv&jTLMGdaU4CsKIsw&GaHcY>>@r(K)>JrHS
zh2}{7wLJk#Vlsq+s9o{WzM?X45>nxiz{Yzc>c)iN&pHu(#MkOAF7pP<5GpJ$lUxtY
z?2S7w6MQHudeI+K4Ybyio&BP)4|FBRuF-+MxAoZ4R<kBrdPF<vDj_S$j2Mq;xz(~k
zpQ12<fshi?z;7Yn!dr96Qwebx-U5TD-?=QX3`t0=41`XOhp-b|M-zw%BIsQ<7T@0P
zUIYLNjBusNta^a3;63{T>PBbtSKo#vt8)d+YkLYs#gy)Zk4H0-;5s#2mWY=k3c52@
ztrrK&xeBGxnJ^XnQR4fL_g7_o{Rtq=Z!eu2AHY(I{|e?n7genFQQjbOJ@7eBWG$|!
z!?H2mxi}Y$uAQ?&%U?7!i^rgEHYHn67Bi9pau;4huHGwYPO&=?YqKQR`+L1U3#`4V
ze087DnM^MYCS01+%VBnMUx2p7ZP81=PyI^Bzsjtek0X?zfi0cYDByL$;MvQzYw?{k
z8X++LlrA&8%_@sITd?)DZPBrTL4jhyeJ^t5wv{MJma*FcQvsarE%R;$Jq6hO<1ZW*
z8~Ic8=Z;4Q$5_`*KunIt<tx-+hW=wzczq%9dr}qKol0N>2;IV*o0k?5VXDe5_3zJQ
zemQPV9k8U_N=(qM0IIMKb@BgdaJ>7I@7Eo}vGq;WOXevX{)EflMR|uq{}htqT7#7n
zg(@_@E1T9Dl5w%c@U{uArH>Bm!a?LA{u+YeCJAYK?WlWHLgiV2VytUNMm(o=SveH}
zt_3laXPgQ`A-opJ@Fg>h)&=~+on*f`ROfTvpT=WRAyC0K#mqe;DXUSb%yMF|Itu;N
zd`4VTF*JHOBO7<(_h>jWHNf+1E*Wt0E5bk~8p2#hyZs6A)gl-m^jUWJcvixDkl34w
zBNd)Bs-cWKj?`Hi2pJ?SqaeHa>{@@9{>;BjEcls4@sgL9;>*Efx<Pv(aDqKb-5mCV
z(tVB{eBrlMR7B;<i)8(?8#H`4s-e{`=Sl(<h9^TrF}iyox9C!Pw*V?NBGtXPl4<(M
zY;|x{&a{xN6r2e#bTAzHxGO9=I{*z)Q%fGDE#M=-jyG%ci(3GJkch%Mmv3|`WJy1k
z$aq!*m~sM|;7gVR9sE|-rYf(J3vKH8o#)K~6Odkv$6uHgg?z@M{nz>+nuDvepU%Gl
zt@ITW+Hz8xP*9R#?t!U<(D`Z7!PbPp__X00XPNl(wawW@3EJKbNQ?&(k5uJB+PZtG
zXy6AI62YrNV4GFl!SzV>hA6<W$m*O8X{4P-nCrM9`W+_l&L)sSPX;5-PVPbI7^FB8
zK%K+xKlZ7Zu`;YrXRnn)Ogcf%5#8G-q{cw^UTtI;y|k_zN~naBd*hKjBpm;%0S6_X
zfFf?AMLcmW-waO9SA*K7GYQ#}FUk~%s<{p}pC?zpgH0MD<64_8Pe*5sz00bB1KAkl
zpGg4wA2B4Do3ULQvaAK%t?R|Nab9t2oUpYje9RdC?*(WJ5UrAa7z%Q8{(8WIU}DQh
z1tbpw)18)GsEgqO_*{DDbue9f7kBnjWu>C4U!MiRj^+ECea3a-`#czQCf_NNe>HJe
zlTLL`R<t{t4SUh7x0@~`V~dL_Qk^!-C+0z72fmUtjwdB4m6|La00jwRR~;R~0I-HS
zc%E0h{pX=k&`0Gpt2(aG@hdtl6J(P%;b4zE<GmHI!SY~3_mAo1UZ%OPGavhf^uPkH
z?37m_Vl?HCIh5p`g?ca+yhy|&aHZW&P~+eJvifLaWv4VtGpAFM+c|{w^DpIiap}<m
zI`s{T1pjUXg0Me9e>@V~S+LVzJoeVJBG&azm1lJ#IuCEx+HpL0<<0TowRN&bab+qI
zrdApSASc!vm_z!K!HZCS)O!V)3Z28vgsAhwazoOUzp-MkM4mg2pf3-8!vJIFVS1Os
zSOim-)$KNBouzay#I2*TkV-)v2Wd4@=F9yg6D)%L5#rjG!4)&jc<61a#UV0cS#6lh
z&<@Rr&|C}x5mDDz>{qXmn(B58Z?A=`)9&kMj6~u1$T9xtOg{^Yg7J-boa%~L%x5?a
zqupKl5=&a)2bu=mB|3{yKFi~~0m)J9y(tEShCTk`%htGVcf__lQ_*MFDMC1ffSbm_
z-b08xnuRGb1Il;TT_Vu%6r%2<X5Ch)iZ{j%LA+7JA-QLcIupk!8>QOFbsRuJ0Sm%Q
z(E;x*XgQFkmlpQE(XDqDhV29F?3h+=*CPcxxoRjaTA5oHEwok9Z#;i`6`Am*-@0rI
z9Gn(=9forzUw37TbQ+tTIYV2Gm=?~_pOoyX$pYXavOzS9;Am$<!`!;EH_giPQ30(s
z{I`vG?a8V%dvEvUjprF5)0lG8xNzCR@Q@Kuk5iBe)9`O>EPBg^Vgx<aqN(NribEiK
zVNdS;K0BvAyNP|b`kGVGFOhM*dQ@p7d!Y9yS@wRe5fUnj&Y2Z=xT7Jn<x-W;X>V8r
zsA-U+r18PV;$$|sZQ*wXKc*+)=mtyqYJ$S!@~U#o$whR_bpZ@-7$>sljf6GP@E#F*
zStu4bdn{_Agzh3;Y6YZtyf9t63&d{pwVs|bAor~HMnn+pT}bHzxs42azyCBkWfX;C
z-a9W8jBc<<SqQ_fJ)`K0wQ;T#+jsa{9b#gEVgr?w_%vARfA71W*VU{7)DL&I5KQs4
zAjb9VJbf((uIdDwT(CQ?dU7;njtqvHvjeX+86rsJ(LJS9<2>mQEa6l^?nfT>l+g<b
zk2;5Hl)36*Yp->{YZo@R9L58&e+!Wr!On)v=J`CY$5Zv<ajQXO%zex1`3aewKNYF=
z;I&>f0~_#Q8nwLgPq?plOpXtg0|vlFw~JaKdF?J864@USY&><rwKP(um&{@%Mro<U
zIR7TT2D+3`phawvJ%MX@1A1<kScym&LfCvIzTD4+(IQHw%lD%Fw}*C}3v2@?q|~XH
zn^7`oEgV8bva+&P*@^XEUfvq`Pg&o;=sy-(+1l!L7)zX$#!Wrvj3U{kRO_-yzJP|s
z3B1UG%}q^t1qJ^qmA%ClbzZI>l$B~^eAX_O+eb;NogWHiyotb6P~iaxt{*r@ab_Gn
zhQ;Ib$7H}m62;z&+rqqkGsbilTx0iG819_!MyJQ3r4#9nqiLe<o-T8ufv)7(qhusb
zzl+@jf5t1vi&e#otWA-eS5R*@?t8F-`y89FH((X{T(i(E!*=?c9vIFpm?T|eL&9v_
zvRHATk1LDIfF4SGclT_dDgQ=FEp16_Icn+IWSnFGUDMoF6uF-E++7vGRSCh$5&^<q
zf_3Yw>P6A1H<HNi31{*IW(*W|o*xL()i+5^w5<x=)z=!hxLbDNy0l#Tm49V%=b=8S
z<=%zYj#oV*L!a(|JDxC`(U^NAeb7mK-(;CiI6FK(Y-Z`ywr%kDTRY0Prh%R*A~>-G
zf`McYyo`k9(){{j_)caNSZ@XyK;W;ej!m+<%NVKa{L+@=Ol;SbYFd%{4Hk&D%yxJD
zx;X^QM42WBz30aE@<9qfdSI0<DMtY{@YaCHG|1&HL)_M#<m82^*D+utwQ8`EHJKux
zItI1!xEdsm__30Kvcf53ZHf2ROJ5zx*GC2o2ZIR7r9cS_Jsw73Dip-W#AI5we)2y6
zctMB0bY+XL0>0wwcz$n<nsz19mG&ia9yR5BNRx@57Zq8Ld>O`mE&TOv-(?v8`q#e>
z_}~MCY~Q|JW6HIdbFy-7ULL)&R<G4NQsPq{UL3jfH}Yg6=TR?TCR`mg0b6*2x}~K>
z6c-n}r4P?;_*%TtldRJ6>G<%~Iggh$?d|Z8%NMAZ#VesMO+kh&U+5hvf*c>Z#zc{K
zXCi94Dn#pLGa9cHi0xg4*m9boEN*$pBm-Lb05#XvvnDQY`<^GL$4)bHS1p72s;dX6
zd8*O+XbEea)CsE_GNG(bg{HxX)Pn}xcCG@ux=T>qSByPfCD_|lh3)4yp!k6t=xrM4
zZF<DoX=Avw^N>KTx2FqTLz18_G_hGL$XmUqvy!2^k4DkCJEoMs96=o>9iZ9!ia0lf
z24~2VUDvyoR&Zfg=NcYm-`lf^Ye&Zh-1K4vsvawV>1Z-9B1mb|(eMl(R3^3Ps02N4
zVzZW_RYhW}4hhYAk<hG%u}LS4O*$By8j>%B)~1B9Eg8BdqoBVkR5l}rQ_&lhwmuQ@
z6dGkWAi<#l{T??zYewzhMl@f!9*vjR!FHj77c7t-E$^0W?6Z)TEWNhgd_l5}``Tj?
z9*`Ei!;<1-`&^&zAxM{aNFP!%9(CPy{rRXLEQbBUdhG66i}HuFkm!iz-<hsH6Unx0
zr0vPU!n9>##)1GbJA@AR!$okg<oqCu9?d)O*m&?lhL;DZzv>b3@$}{Kx@qyRdVX)|
zgYrG1mn;(mYF=*Z0`<Ik3%*E6NgLd_abv-{b(=CPD=RbBu3ek9dGjran>KA)LJ`sv
zNgmSz@t4t{Uw!q}ImJ1}#s#5^P6p0W{ATV9zuyGR41C{jrvLv&gf0GCz-+}|!vexT
z2@aVj`~#%?R?@^Ml*wh!BVcn!Ef2i3w6wqj)Sg}Rcme<3TC}f?;uB_fOtPWHXCj^t
zP|Mx*m@b>`d74;38a07Babq4*>T{rVCPCYhA+*i}nC?zOLthnIub2qbxV@tQH@-wL
zF2c>H3UJfeLMq|9x}^^p)}wNW$+NR|ch~YEqX(#^uDZj-Lp4_)E{+Lya)X*Tf!9+$
zbc&#EIOTvIThEj+sCRW23A)~Prc_iM&qG3^0m>SUh<BtS){!cd4$2EjV^GsFRdt;K
ziB0i>oFhBWRdH8b-(P|{TCmIAqx7ddZAO<C99TqcXDQp<_O`DRx4l@wK5ol>wCHvf
zG`1Lqs>ZGs8k@8jSLdKEmvnWVAb+;TrjtL<+jQtnQrAc;z6|UWCkQi$?FlT^s2mAg
z8b>ncoX}&?im;^Cc#(dG0fonsP;opBwSDVp>QYcf_Wny7MC*k$EWJn_uZ7?$XbTM$
zO>B~lkq<HZ3x%yS8_u3Qwi>!X?e3;I<C}B7O(bc!NAVjdTDIE?%2pwLn*QRb>&+4N
zVKZszoJ>f6F{HI=MWRzp+k*t<$|TojK)2a|Ija?zG0z{fgF-|=P&k4@7}V^grWlBz
zphXA?S;SBan-@A=Ibu3p?sVWQ{#DQK-BD9|9)VgOC#PUJc{BU`1&cmcD1twnGso}u
zGiT2J!<;#OzneXK&hO{W_5Zb>U%;DHRaNV+T)DE~tC~w01K;)++Lu&UR~v5Fv?+7*
z#*GEnt+}q~mg{aQx?$Z7g*R@vrRb(jH(Az|ZLHW>xpCK$MN2LP&kgx&sDIcO!E-|p
z;ui|V>>vcp3`EeJVE&jO?dKoFKLqNi3Dg8=8mpG24^L2AtyZ^2?W>cXtb?Ae70(xx
zJz?(MMSFM5-rclp%ae;bY6A5VqY@cgEJ&)&kU`D*t@)l5*az04^-2Mpm-BF2yGeL}
z+6`#Ayu0dA?b>%|eN{Z_D5x<GsHIIYuH-!eHFc9DSt#q$3DnTp6B*REoG!)ot|IK{
zEX0nE5^Q)X7fG#ZsB4vy!=pZtGmqo!=^R~3pr%MuO|1^uhtsh26lvU5y!NZEPl8fi
zR}LSdQ4$<2-L3B|!M2mRSpRSW%!f6|*{?)eqYCl1IH+smptBR0^_&|*pe3n=x_2(x
zOw*Xk#Z!-tWGShS-Ygs`e3(fR6gf{Q7>YW7l|5C^uEv;#WGX?gJH9y+Id>PJ{IODO
ze6}1npDM-9&N5znV82j?#-S4aeqB?79E8-`L%!=`*31dAvU`PqY$v&*Tk?0yMN1G|
z+BA31B=gkw6bVW4DRhNgjc$;qY!w<Vs_)4`byp^bRZ#?Nb^jV{cq$L7+T}=UF+lIk
zgVC0Yggq&UG)H2_(z%#9&mVJwL*Y+g4pBf6JPPXI;0WOX>aW^n_f<d{UuSu1)N<Ab
zfto%?Axf^95Dr$N%nyHm`uT-$`S}IVRm_>=_pzT}z<aBfF2C>2)`O<gCr>7P<B2Cy
zTN<3XmDbY2Ds!=^tk9ZQWwB&i^9r+W-n=>G^fynh7#SG}n$S7&^wUqrEQwlnWcl)y
zy^)boZ!BE6=qIaJ$NpmF%2mHyx^($3V^*tvv2uCLFIOy&eQ){FnBOd2vf_g|vje^e
z2nfK66)QwzqXW-8^R#&BrI+yBbI;?Ym(GYskDmbT45LFt`CW+qe4sQrrAou4QmNcq
z$eWv+QB+iPl`cKO;owxWIwrH+jqC83;Gj@UrK8rW4Opd(6H78yBk{H@#M7UmPV!G@
zz}OUz(ua-oC$ea~QUUu&DYl$W!!2iX_yB9`87s>mTxU#UO75~<u;z|>>sgb0<?fpF
z>)X!Jp=7~mr+u~vx1Y1HD`b0z8M_Fw?fGI?XFhg!6<}va9@p-!LhR}^q3|JE6&6pD
z1vK>;d{x$|k$gZYZaQ0nTiQ#oqvtxY@wp91JD4x%Yt(fV_@Bh#N->T^#M%>uve5{Q
z(*Ug_4k`Q9So1_Sc6V2yy0;vAx~yV%rv){ARj3)f4!gQGVe<=XQ1zr0Y4@6-JD7$T
zhY_po35av1K-ri{+et*MJrgVI(#Vf3l+J7@owRTugWnk9?5ToA)OB?!Ff^nIqdgT|
z4MxN_=wWQoAi<_YLj5WvJ64K}=GDmAAA`a>l_))?!-mI_apO0#u=`Xxs?TOKXla0^
zZMck!@<Jrb9uL+Cx=O<+<ltaSpCGH8t3w`@G(5_+0iNHGJZ_Jvz5Ru#p~F+^pgYa5
zcjPgkYkLa?Nlv@F%gKepmPT9u8nNSy6*-6XFf^wNT1b&xTZqgWi%7gN3;r=72v`_^
zfB-+t3l2xv+z^BYh9OuH#-q`EjuhrGjW~UvUaNHRb!gOLDvvKG1IqEH^3~NzW9hP0
zh+aZl$X8==<Wf*%GY3`$g$Rmwre)vHoqR#Oc<MCW=6$p4)^EhT1@lFKBJhh~MaW;~
z&s+GTMGGU|2nz{+d-3Avf15vl;m;!?B7Ytoz3gX;=12T^Uf8@JELsrpR^;O7K4pyZ
z?!7zqCLB6+XqI>TJ!?(*nyjeB(ccMHgnTk*j^96ngG0Zd(@py2@h>na1fe1Gg(5Ii
z1o(&00!)rQRRo4&(V|6o^wCGfhaY|b;0t{E>8HGs>)-$V=i-%@U*|=*av&3dn(|#~
z1y`I>&E*0$#sl>PQ-!`jJ!vfIG~^CnU>+~i!xPZHK#iqYt6{u7(+z5!Qv!9xqe-w|
ztc3GYCF(AW1@$ebEuNqjt{MYsPwB(6yg)swU7xc^#TvHMRnvft1m^<mXwSvYjsiER
z^X|(>Ts=7(QiZBEO=ufZ8PsWqbmHc7<=ED}1{<HVi0r$vIkZVto5n!ry@&M%p1xdJ
z7cXsDZ`4C;Uk&s9si1?%U0vna)m4VQy_MM4SB358E3p2l0(OBIn>End)KIsjLe-p%
zxW;6mY)TOX>R4L}R@Wzq82VmF|8}H_I7c#f)3Nom2sfVoS`lRZOKV9&k~1Fh<jSa1
z!f00``=Ak}59HvwC(XG1rE=^(w}!{z?E@R&7~BBoz*=&Nz&TJQhd7~isFd<X1l{(A
zGU?6)Wv}ATjR#=4$oVl*?ddb2nmTOqsdt)%y(^zVO`GNSbd&AUg1z14f*dQP-&Z`G
zgv7=;cG-|mJ-OP1?3xlpn^t2+<ZR3d_d{TyKf)BD2=xz@LG4~*I{~OCnhN|^jfsn|
z`uXK4%ZWf86-}F7R*FRt(IS|KfEI8rHRVkI?A`xIdlSX)|NDJ>_W2k1-@p7H=kl*v
zw^jrODaajy0KdR50{s<SetrQWI5<?yo$D_G0u*BIY(EhmI`4~_GiK4$;}^mHioY!g
zo&W1wZ@e|Z-A&VthaY};^@^n{2K?sue;yt>k8LP9Ie923D5R^fTCFgfEy&F=p&-8q
zrUEOHlQP7d*#Vpfuy5Z!@!^LbGNeEJ@B{JAJMVCi_T|ejV`y*$<|3>71K?mL0yPEc
z6Qt#int(=&1AKsbJQv4!ke<jRJ((u$>%h=wDxR;-d0b$tv<&KH*)bwvTNaGAtTCWo
z^F%6x+A&fgYKDp#)LYJG<A#^=vE_7;aD#emXU)KNNg;gDI3BP)K+V2vg7oNQBZ0X9
z+s+Z3^SG<t(Vp)HHR;#{YSM8@wur4sWe0((UMDgSC*Y>D<=EO@DNOgL@$_3<O}ro-
zn+~uj8${B6T?dekL}6&sBmGW2t~*(Tn!%0O)l-2TUH?CI?*SgweWm})2GqMSrh|I#
zz07Dv9Z7%?5(qH8BcU$9Eq01+z<_OVHwM%tR6&ShZ`@lF@9vZR|8_UKiL=>w?Kn>J
zCbqE+d*1(Z&b@bZH5v)YHoHll=R9|2R7R4?XWn_g=e(y7Yn!uC_-GQPeJ_R&^uRtd
zd&yDzlE}9%2LAQ25D+&dDA)Q};!cwAee54c5?dePO<{=I7e=vng(BttDCx`2Ig)}E
zPo|>cd6W3(RRg7{9V(N_$GV{v;5NLv3q@!cE<)qQV%mSPNQpEZE>IHqIK2N-k*1(!
z=tZxV`F2A;hfr}Vp_J15tt%anr5$gAvh{JQI+ugW0p4k85>>DG+$I_O-`<sp-TgVV
zmnR&rl*yrN%6Ebg*%%@=568!*?8!#T_8d$LbS67*JK2Ni?ydmZ!_iX@YI1h>um<&1
zTj*{y{ykMyO*i}bHBf7ohZU%4;Ua&AwA5|0=8BqjbN80d-L`!vZ?_`eX2nZVKKkwN
zhyeWM)6a47@+Cw>MGC07Qc}{$Y|chfQVP=34SXM&nP%Z^Zf-u35|Zim+h)rPsMB;u
z@^EqQJaOpITn*II(vs84yghwB<Zl)f5G=d9E?&G$7cN|sE#iZNgE)6?h|ZtCfY)Aq
z3opO)1`a-S6m#b+#O&MW<H(UC`1s?G@%iVU;*Wp)J>GijEm@V$n-2yDF2J0XV^P!$
z>e+MV@p4-RwQN2K3Sy61S;eIT^@Nj!-!M?gGEq2zlC}Wa`o6UvZL8};?^O$^!~Gf5
zh~1Wsn1*y>Pc*DCnfP$3^qEvNURlPV#-8&zSks<@bsYv;)5?d6ilScI#=f<guUOk|
z8fAfSE8pmjkP%38KQ<4~a9KJ*x^hWB*~sBfoGYRMT2a?#+SSLNwiy`*4G3wB5U(~+
z)N+#e&zT2Pv8J^c#ZMX#e@~dGY(6OD7Cr^c@p32^Qk{m##thja9(Pw1%1-6ej)9d}
z-<e0Nn@uP@k&N{3M<Tp25JA;}63oP1F=35~%HiYwWDabi;D$JGN%uuVxV$ig)CNdL
zNBaHI$T^&V<&USyQi5GQ%XqgU4qRD>#!E{r)o`&`fZTMc2nSwRM)$n93_K0WIn#|7
zc%Z~2z1otJcPR&VURKwP4P=i2Fqg!+N*4F%(t&#-AWsBt%g3tD<w^TvRli9xRQQ0k
zsyh?AyE3t(%P505wZnzjJ5++Q=Q5?UCHep#mMX1~={xffv@`~Gv+Q8!H4RRlPUPj~
z1y=_*a(D6+NXzmM?gDZ5fUD;S)I4rp*Tqz!N;m8Ib)dF*&-^iMs|zb?R@0jG!HQb7
zKCphnCfP!M`O1rU_wWA^Kl`_z<Jxt?@Bi>8y!6V;SiPnK({G)DnclbI*s({!Ouc;h
z1sWJQhrYf6>gyX|whCv5hcBVNwgCZtfow~W!>#u3mlT$)=W|25pZ@fxE@2@NcX4Pn
z&#!OWvK>Q1!|3Vh!&6T^gD0MN3Qs-tlx#3KeYzO~{X-b&zkvF>{jwM!B0L7|?d<|;
zqU-qh<B#Z-S6(4rmHyUS@9;)*$~0w-yshHH#JTfDQ3nJDD?YUj)cg1EAJ6)*HDP$8
z*1HM&qo?Rej|p3{fY{3J(C2*cZQj(*pkA2ahq&!&3~D*N;z0xkb@|B*)W5I{^)D1-
z=YUy2UD2M7HSO7`XwAc#c799;YPGCAYZcU_b%ijbH*}b2L#Gj3iXD=psA*kR2#>38
z>NH@>StGXgWNM(sPF@_)VMfyT6A@G&CS4zVm>5>aiGN8j9nQpxlZ8mQk5_30sL6M!
ztf+|(9C;d!?T4sZBckfkrIjuF;Y@7qDZ~1%V&ps$kMsv35Vb!L5shI2f9|j5*jN7B
z@L?cN(~0fU6hl$_l?lh-8h=C|2uAk9saSO~PZk)kQm#K=ihUPW(1D99h@(W+q63!;
z1jcv0P>8!<ERx&2sf7>!xb?4TC`WApR0dA82|+p7W1GQ-$2@^$K~@01k&2dy&WWn}
zTmkkD=26w48C3&DnF8I_Zoux2OjLE7QFGpm+TjAMZ_na)EBtqo7dd{><X-QzJIrtk
z_ko?yEtu}*07rLc>5=AT9~@)KHl~2b-2={^o*Jk%MLkte-Y7Kbo5B@0>-nufEs$3F
zrx$P$1KY}@7EtrP*efsm9bS9=P5kT6{+&Mi{0sWzzyE?)Uw;h`JoF&(-;fvF-gp1^
zaJHvU7Th+swDIaK96#{{o_O+UVQq7BD~5+IV&nQv@bd8HQT40y<}5h&^2;x~+WqrC
z|FdgUWYi;$_D)~&2TwlxyiotiC!eOnhmXjHaaPR7k00m5L7W>LMqlrFTDxW=W=wZN
zWJD|m1_tn(-~5KIU;hg4zyF`IHvRS2U&l)?y@LM!L1>^>w;2<IngQ+SA1JC?12uPj
z=s-Ot<xUUn3356n@}fs2-%Vh5*z%*tc+Xa#rg6JI7}OB~SYY(0xb11g`w_J+gQ)#c
zwCZ_-1=QR6%&2Hj#p<>UTGO6QI#7cZwxY6CXt$dz#a4)3St})=7Dy|%Wy+DPKuvm3
zZ&B5?GG?Ajo7&7s{2q5mL_id7T`K#};!~%7FCE5%=?HHM;&Ex>-fG@x&DIAG#jv7g
z^&3^4il~}IWFO3>Rj10R=<zJ1{U92#_k{AnA~Ae<7h_mss!Tp|o(TKfAq{a9u|EM(
z`$G`X6ol9VA>fI?RVVX^7vt7nT8oB@tI>3+oG0-F&K%G$b)iU2uq%{h14>Q?AK00=
z1j>?Br~1s2pCP_7TO0X&<<>f??^Q<4l@W9cplu!ejRCT>7WSFOg}C~08VAt)xO|NB
zQYv`~@jxba^%}6f(?Hu>Gf>sRxgpuI(Y<!Kkcyv5L2zS$yaVC?22l-Zh^kLUY+)ko
zZkvYbGo8rZ%Y__VTxFde1KQoqhn#sslbfeN+J%+&h@uwAOcI)t&C-~xQl9MOBEF61
zXF%If)Y6j2mWS$5W7h5SSW(MFr@Au{ufOpYUVZHidiAw8L{We7<u$QB{_dq8;=~h=
z!_O~3Iz#H}8)^9BW$Nu45McBE*@q4uriYIl!=b}RWV!7tue^r3x(0Z<dl7GknKygh
zsmqryd)vMD-g_QV5iw7?IJti1XzxVNKK-05W_<3s=Vccd*NGD+=&{EhLuY3<dd?1@
zv!fUJdBw6zF*zw6FTL~<KK$@Qu|7Wj_#?dY&O4&0`AHf2CUdr><3qJR#GlrKnt@hd
zUr*yG>d6EuP2@#Sl-V&VvUC!D^bN~OQOkYKp<ZD07eyV_n4)AaTR@$Oy35N@|Kf6D
zP_OAoLwRdDD%!KLx-AbCZ6>N{GeIjA*5fMc_3h?S!!e?&6;P{>DJ^{?6OFu_Kp?F`
zJ5$LC>CVF)EhZ#<FNs2$BE?r{TZ0b@gR2t|cUOvxOouhHpBxF^rx;o*)(3?)q=-!s
zx-Sl4)v?lXk#}?nicS<F=B{W2RQpQ@NJv8rkCH24Pj#sz*V-6_){5WElYU6MKY&&|
znU1P+WjOHC1{`>CEgCPcMAPLJIB;bJ?z&O}?p;1GycBm16-(49C(G^Q;G#Zdf=}r=
z*5zcV)zFtuO#@5N(6<Ejy?IpMTL3Oz&f7Flgr@$bk~zX17qatFEorxt9_d`mZb;q7
zsirpzmSPz9nNZ!AWvghM+p=Vsi?{A@Xx5gq8Opn!4g+?y8BpELeb+p>$%l#gNP92>
z!A)TZJCH#kbs30hFd}$IEapcoCOgj=aP)D3v!}Z<jp*V95BHgHbM>}>+QrL@T)n;F
z>gfS@t`S8&RaHC{+hQ{6mu~j+tDq)5ur)=!V4)u|q*+ljs1-G>9KLSYxLK4m!}^CW
zy@H?q)BnTOFTSD=fAd@X=qEo$PhT&Rl2ggv!3mqUY?B4I9cO!RwtoOmJo7A$Klv0L
zJaSY({pe#Sh@Ff*d#WV=+J3sj^|^EAw+X2K<3IkxGbTFbafca>U-9PKQzuUgsE;3i
zoY+(0di?Rn>BNZ>7+jWCVE_Oi07*naR2Vo%y}kWtYwbc>YNi|{vJuWuW<|}Q{^XNC
z;)g$cQ9SCm-~N#(YWAo(kVy+=Vo<Z9_74bBx<3K~1!guB^_XFn8^L+1Hpc{zw%pf&
zcOqbuZ8gn1Aw%F7F&fmt`z)Zw%IA#?YHIkq5^PpMUDlF8745m!pq8snS?fVfnz|m(
zvmQ~}*`r{s95fn<)imGc-0Q8~d9<Y~4{Ohu5Pfef1=fdg?=i9J4HsA^A?~g;*`F9(
z8w$>tmj3A41X0GUsJZ)sx41+$#v$&`WW?Q_#GfYzlk8oyLg#5mQPPdcBxB`u(bDOW
zbZ;arJz>Dcc4a)g@nR|VT`8re%ge=UW{<h)k`kb#Ofu$3a^J{^bpe|C3eecQL<i+O
z9i$6*aD?HEx<3A#LaJBc+%Qmt#=c_W$Lo6vEuhvW1vNM`lo`YtoHbC7g0uo^DNY!i
zplIy<Y;f)AHPN<C12%SKki3X?nq;BF-m@lo7r-O;>s!qf+~kX3eqn4fNR(-8l@YT`
z{NZ$)3ubt*<>4wmw395T_JX_HZLqg@m$7kYcQ0Z!?dIhTH!n{HwWw*{2lzETWqgZp
zrJMcyoU5$?THElVfqKr|g~av;`_!tU7Fe_BWb1=L{mQGa(<`sOj`x1~D}4FYbug%3
zd*gKsoEt=bK_MKSTtt1dnm#vtQ9%9p)6d|chmYX!u}5&^(Z}fEp@(r{_!1f$_rcqH
zChuKjP`CH@_xsrW{O3P+kBW$S)Xl~H8b|j%^VGA{)pb^s^pPXSpjjU$Po8A+8{OSK
zXg<@9jC7N%LeI_3r?=mJTP%;Su6-_w`pq|AC*?r#HHJH~vU4qc)cm%ByFP+~Ly0|V
zuE4-RVxTdo_wCz9X0usf%R?`d0JAL*+LnU09$Xo3($MCi;do#k2hj5SXcZD99yKwj
z<9D!Eo5q6{#KRTQ2cl7W(m)L_l%V#?QfwW_rd6%UsOT_3K;4>eQPKiw%?4>VljW*`
zd&CN{bcArN?=o}I`mStnDUi-lryI@K)NP{8XU*8yl_|qEDyXrwdkIRPN<-LzNQCW=
z7Ddfa6;<7kB47@yj}yy-)wHbY;t13FWMzu6A>MNMC(2p6G!kXdL=yCP_@yxs(fgB$
zCk8q9Bk`^<Dtt5zTf3IZVc@<?t8w=WteThMz@=gfnCp3}Pckq}q)zUslYBg8UO+r*
zu2iw6d`CgHu0M}z2Y3)Ak5`Ei50J3UAiy0^2TRoJc-Dk%6+HH_@j<NI)|Lrt8{oBd
zXxgf@?VYLE+L<OHT^uQ}xt(Kavq%D%&KJ<$fg)rbj6&GHa75jehJd{(6jPIpq&+#9
z5$^#fcSkt6^J*<VBk~kTySn%gFRqnx_abL^FX{Gh_4FVW)QXzE@xH{#+7Ocg@l=3I
z-{$k{0nJx0@0pgxwtDMB>-x}E3vSrBnOIFTq}i+f`7eHnPd~d#e3<y=+i&6A(0S>p
zc5rm2m8&Z-cwtx|eYSsqPPew<!NU*Z(9vVWz&>*H5%dq7qlShi*~#eS<Z^xX?0GF5
zY$u?OjgEcH#mQAb{q&R1$U)+X6HkbmW>6nJdX%1dMtPiJ&5AlPAywwx3knMH&O2}6
zgAd-vwd+^$+mAoM>#x5mogc5i{yOoArV46Uff_ncLkDV@OeO&@54udE<!;JDER#*W
zo3Q2XM$?E2q)7*AIZR|wb9<fy6se$I`D_O2uPoO<jq;WxtZvW5>b4xLY8h>P=s;~L
zeK&~Cv$nMGDWFy$tpoMQL}OQ`6noiXhje6PYj-}jb`?o$Tj>4>;yh}e?Bhc|wl%oe
zr&eJt*AY-F#V<w->!7As0d`=WGBL=%Hv?Kc?7A?7)&(N{`?1nL&3)9hL#5(7ORC+_
zGRp=O%`28kJt?DFCLaEf;=z!;gL&fX?j2l09KospSEl?dWedK02l!ymJaQe(l&j_y
zk7Hd-RAV4+OHDJF^`)&v+u5yjb!=%*pe-G#a;~tcBS+S+@$c6#%+s9tSn+tW<d|^J
zI(yTRHJOO7%z<xl6xjthD<k4=u1YkgKw3Zz7Z)GS`e0DYL86O?yVxEcV?q7D8MO3m
zejl2GqPAEb)}Wp{ZxPu5wJ2(~J{Zt1zw(;Enmy`IKVuI59&fz$CSABVjMA0m!afFd
z|M?+w_4c8=uOH7hw}_(FN(D9Q>l<Z>E`xf`oO!Kcef;caKXZ$ZO?-^45AOP4P;;lo
zV~?E>NGtZo5j_3$(_p2|pl)yLruevIR@9V}lZUt7dV@ar;C=e?tIz1SAAdlvz4i*;
zeDh5%1~qXXwdPUV05z$gCeEX7YHDIolLl%A>ja%0nis7d5?UV?jyXIWubabKRZl`q
zOKA$)s`Q|ykf3lZ4h@j@ytwTd7EsG*^8OfF@pPJ49}Ma({aFlZTGeL6s@80*YRyGO
zTh^#j)wEXH;o?Y*R@S3O&^xlRo=4L=bFiUXO1eTec4gA~_Dt0x$)?R+1=!e8fZ`L$
zV1GKKDOydyOA<9Lin=aQ4i$Md7Z*pEhSV$L*J|-?3T#T^;S?FkmSqV|i3qCW!^u!2
z+#60skEh66_u31~ap1*L?7v(>`-hid|8NQJx>zcf1((HE=rd6@`@RF2#4z1EVCIep
zsmgO^svOLQQn|#%)&MWy-8-NaLzxw<iHo#r<$zJTDk=wzB-g<VRQ4Oj12E}Sv36Vk
znB{S6Kv(scq|~LtqM-Sz<$!ZA7WYT97rmuD1Do3uu(>@2TRU^GwIdfhy0fT$xR@F)
z7R#dJwEM#-ygq`0tK%rRGKG?Ba}m420H<&tvYR<g!j=?BD{9)s)k`2PS680MQ+kNS
zmsU!-Eu9eF;{nh**vR@Z{o_+r#*_IP`Zk~6%K9KHP)p~B4%DP7YGP3HunQk1vi<RI
z|NaZ&!$h_|UVrlqx^(3-tt?w5P%kTAEg<gf=@n2vee!t*G(B+WFe_`)ftq}LZWB<?
zn>WAJqNrn{;vV5)7w)5e?wOO~Q8TF7`rtZx^kHI9x3;#5^}&idB{@S<q|(wd@Wvaj
z5nCUhU;Q&a{@sVf;AZ=Sz3aij^T^4~SDNW{pyoqFy`ts=MGe%MnVAAr9jGT%)Z@T;
zOn1k49`poCdO}65w>qqB53N+|BOJcL{=}1s@mr;jT0B`+rBO}MSoTCRYA-DnMZH}C
zHCDA{U{$MG12v6?^=M^1s>fOZwO0B=Mj4!8P^+*OD}-UK@3~eEA9;~(A?|3+NAANM
zP83BFP$YfKoRyI@qNqnettx6!(E@0Jb$v4Y>SfzF@vw?AIT*s}bYwahhqC7ks61aR
zDRcW@EXMvTMH1T27Df%jxwk+9nQD4-`6>ZT+98_;+{%G0;(?GogC;K0Y8T%h$Wq|k
zpGPC0&J~NHsy~aT`(&6zzP>+GEyJkNl<_3}<uSlk!AyLuJe#Q%X&K%Y72T7C9o;63
zf^=Itwsxn|=C(9!X)|G48*kvr1$*_o2Me(Daeh}8O58OQUXzBHy=F?;lTH5l;bb@4
z5q6&TS_TDiue72B1=OT~T3uAjH3DiCVm@k3X;8%$FmGf%d{bpi-}L!!q^KFx3~XD9
z`t5gqOsuNe0{O*z|3P0}`ycxC`yUW{)I9XUikhuozDmbO{{VxUPCWIrSRV}P9~?Y{
z!w(-tU;m&*Q9C=kUYj##UW+Jd26be3^f4y~=dXChjCz<z>`@;&^sox+!`%6SQ>RV|
z#9LcBVKijPKY;l7M7;9KOJaR|`q?K8YW(O&Z;SoGZF=X=pC<;j)<ezhc`B%34eHw3
zS~NB`!e}%KWG7J6lO6}3=#X#%NKe`7uwi>xRCQQj1QrJcU~aN6;<ltyH1A7PEd&O2
z(eVV-4i};B%2Mnc%)zSGWLn*pfz@qUa+s)Gvur7ADSbDHtwY8&?F@F4HrYrPSX=B6
z#U4>Wox}Me#GqbtI#=?TgBqeOkRAcG60oEcx8cQEO8Gnm(!uqq#8ZXg`;)}0_N(IM
zw*DwSo`M~{#i+fo6#K3$mxICj;T-Xw>jra`wzS@CUg-s1o~spaJm>A`T)cdji(A*E
zRNz()n4}ool>;W?tt^~#tz7fe`}}peqe}IN^(t2_^EW90w5}|Gwk%svl{7<oTPH6x
z&ZI3Jnb2x;w*i~l)3B}GfXZ%;edQ_2Qmkz@Bk}%l1k{B}*G%}{bR<{jBDx|4?qM@=
ztG5H}J)A8aR}2?NSB^3D0v9W38HZLD1W5L@hX-G^WdS~L_4N6+ZHvja(S6hB#Z;c(
z3e+|gwJlKd0pXi(y(5t3`uCr|Cx?l@`p@^pqdtFOhzgbzNqE!hinZL9N8I_**>x62
zA3H9Pe(2y~Jn-N_>HJ_&H#9U6Z<67|#5uF)wa8&2TOZ+}5s$J*?dt3%?Rng(q4iN8
zJ^F}%nhz9NRkKgcpe|gpjOWx56%~W?=Lhkd-+aJ|nm+pNf8obJe#Zjp;o)KA<`w8c
zE#ccbP?HYS63k>Y8U?7_<uL)MZ+M6}NiSM|cxXKeK9Q2PZowOKh^Q5V+BYx&bCVV$
zZc`d!>oR0~JiJ~&O$A3|P(8GSd#P#HIabg-@M56VZCNw{s7JNzsh}onP_x}(1!^gQ
zwHlwgt|Jq7bV|1fF{n3n=5x+8tvZ=SsrLnsg0uo^WkbtYNXHOIgesrUpiV_FA3Sm>
zQ*8)B8-kGWgBYwn#S3p4(51NZ#TB&gaxof*IO3ES;$|uX9cPWKc!{U(_GsR1Uydx&
zRVt4vd-M2;%Km&6wycsFwu(|#EsZfiwki@xEAS`nMWC`bhj%{8-pBC(Jjur<^rZLn
zW=RgX3Ta{`y}4b1_0~=km$Eyv(;$Br?rgdHatW&Xiz)Y!Bm_1D!k5SU8`2P2WuSx|
zW-K%Y;TE46aBz2klZ&Ipc9f+6vKYYA0%~`6Pg%Dm<>4l`6<B+btEUgwRABmb06Wp4
z;#9jl=<7beb$gzd_e}1grtv_{_J;;)o=j9*^ypuI_V3)DhhM+{fwbp!_nbw1LK3FW
zaKMh8yV2F%BdYrOQ)j?!c|SOKh#q|C5V#H<K0?f1K1`f7Yc_X%d^LC0+|w41IwUCU
zsFQ>9mu!6;efXF*@B#(WilRPr=ny^n=%Z+DZI`Z(9ozSa^|5%dA5NTjOu9b4{OU7&
z_?utj-FJVCx8HtK4ig#FdHG8$IUjtTb^9FBtPcrh(kW^NwZUKzaB@qY4%AZ$Sel@l
zLmOlnGif-PE{}<nv@JEwzgI+HBo+tw)0_lf#B4~TnA!~DwMY>SsiLT}4~C<XqcE>5
z#qRSw;F8LqR)E}^qk)>n0^4M>ETC@B61zhMHLdN)!rG23(rUyOQ9vyRkK$h!V0}js
zRy>u7*!{lh!Dj-g*O8b|&F&ZhHLO5Q!FBxZA(V$!DC=+nwsaR!)8DP4eOF4T{z8EO
zT2ae+;JoSD{v`s+ojpcu?@7gu-W2TW&%o|JBXMBVo_@1{o1x7Xz@D@DsO%|Fsy9!*
zk41s^W=o5ks<er}maqH*pp>GZrBpz(V%IBpF3m%>KJ=SJ$=7I>h~{te;|yr-=-@*`
zR?(`Gwpn+y$&@JZ_&6`!<%89=&!r>&I}z}2h=6|+cheXUz1Il;l4!UF&%~{6GvMg#
zK+aAMaCBuzyOFYH%Y)QaTclUh-tKNvI#7$6cJ-L~Z9{lGYvN|8Y?|!z-@y8i$wVtq
zTNL%%@BCOm&GrX_`tz$_3aH<F`z<>5=p)h-?cm@<ci;0Jw6%9~${umgG`HiilICJn
z&Aer+Sga54+u-cza&7LM`OjUraKX#&!w)}n4hagmf5tTXtIm!t`0oARqsy0H;PyP3
zN<4h{2!om)e)wT<F~HB9Zlmvg_d#BvF0aT<O$~VOy`R&y>sRT65C0SY@DK0eCqMa-
z93~D84QZgZsi-wjbJf(;NHCKMYU!OG$D_8D7j5ySr)YCb*mgG#q(^zu`UAxYK#jTa
ziy732t;yj1b<jX<elV1Sbu>_u3Tj&2nyG=>0%;Z0s%NeAR%>l~`aWxmU){zZGhuCq
znIUZ{{+f{#J`*-{tF3&UIdn%yKGwDtQ1S6Jgw@XF14L;hR1OnGQL95LiYKjtnm3?W
zDe5!|s!c~oogWGwHDY`JO4JOm6q~2<Vj(Y&MRkuEH9h&L>MFqQjyzO$6%g-W+})c+
zI|kCQb1)6N`qM~YJz&6Y26exg6m^})fTqfxLR9t?(%zl|E>xe*Q>rJ2s(W&D-m_Ab
zeOf7sSA(?*X;J|#SGHahKidLqYiL^z18u-uX}eQx4^2^PT^-!fv8^LRylC;H6)<bI
z2eGo=)MnrWMdBz}p03<~&cyxGwB&FELhAhyv_Fn~`CU$928HiVBagKCu$$!o2TvC`
zJ3Er6tk)7y!`{VRiWk?iqL%O_hLWed1=QZ|+&}FB4|hdPtDv52kMp;Y&oP<9Mf$d%
z-$r{LP2f@MCliUS4?alba3%&dcYXZwKmHR}UVMRS>+8VI11FI31fn)N&S2IokMIBB
zLAm|tqsMXn`~~8?4{uK&a&~mNx?ui-6BjRDbhpFHFHesRjoNB&H~kNsPn!@OkLJ@Y
zxN_+Q^mO;4qpcHd9qs7o>O@OhE806d<jRjl$Hu_k(LuJgoM~yspFjNze*ecm$Z6+W
z@4St7|KabskC2L&u8_1TZqbv;#JO{13psxsS74w&{QZ4JQFCQvWLTiAg(7`};gwNc
z9p8oreFGJ3Y0KjZ3JRi#06zo;1<>rsAcU>RKth92Mx(hmIkYJpsozb;&Yo4`*VYW@
zO2lb-a|TLUj41D3g0i-3t1?R|hmB^8f;i`cbeO54W2E0&da}i<W_V{~U3(s_Z_C4m
zwk+w(<!%r5r$t$J<YH~-60B-2M(lSY5YiNkh`JQ1k-&Xr|6yQL3IZF`5!`5k@7@dq
z)fy1ikb%IO7+JH$F{P1B{<QMxC<%FLdZ7edH5UqL@A(3GapFKI&cmLlI2_7WvA3&K
zma4KXMcQo!{+=E_fXmjd*0(LiHiyl}EjEU2<vjAdIa-nawses6DJ#x)bmd`NXCZBE
zFXA*mZ0^ieHqLjZV@p>GwsmJ<dzTSg+s)Y8nvHF(1=!V@fc?XHsJ~Ds%YVyG<s#~y
zC@gA<kX-Jl#w;Z4%0kStB;4w52N!n-0kpF-Z*Fmucd~q#uMM4Xw*tdRtFHmmud8Ig
z3BYl)o?ow|wa0vB&XQ#TJe<cn6Sc@wK40UrIfgHH(rnwd18=_m7T$jI9lY_{oA}wk
z{2M;|<Wu_hfBrYLJl~AafDm$Vaz|Q<fm)h7(Am+0uI@hSKHHDetsUs@8^oEmPPtwf
zzJljZwID6k2#$}Qc8mRczKa63zWeUGGbBN8+xl&xfeZbH9d5P%+|$Jab8erDgt$bc
zr)H4JXhv#!8Vs36q@<-H!)SmxJBtbmmoRYQ=HX7R?rwZVLsKJK+uP7L(2rARPUG2=
z&(V`lKZUsXWO)VRKLlGJ{B^wHh08xMfFXu}06+1l8Pw_N>DFp_qW<VHpEFVG-3=g3
zlklNOJ+6ncEnthH4)7!X9cPCJ!oMh<66=hJY>G$N{#fo&M)G}$vS+YnsF<pU^02YX
zfYq%=tZ2=o(vCb^pe6>jW{K!wt%6!gYu{Vlo=L0QS$%T~Up8?f-yN;l+!80CUe{{C
z9c@Nw=VMT>X<vfkr?L=rcQ^&r2ZI;5a)yTv)MA6kdaZ_Z@~=%p<o+yHb&{ILzgyJ4
z2&8{6j#i&8!rt=*RDWqHxb_U>6341a=u_{=mKn8_)nFr#rg1<`I#3gXdYqDvO$O5A
zd`!9D%dK>lb~=kvRu2O$&#!~Cl=8D>V|R~%cAYhHTOGD_<j|J(JZx^u$Hw+tY;4cA
zfO>OBDsApa$Ch?3Beu8a(C#ipN%L?^?YSaUoH8Q*JE0V~FBF0M`M*ILg;g05zr_US
zAP+eBIKa_q8eE(md8$wj61CM)>MVnRdmKPdC5K}&(48uz|4*LZO?QZ>2lax5i)BwD
zZ*}2fP|v*Wc6sq*+t<s>2g{eQpi9G-apqJr+FLs?*nbYaojusLaVu{3o<;6XY$y4U
zzi$wq>v2ppWf;sb7_+1@O*zQS&V$LEE1aC^Gh4~|cXazpz~Z2XPM<#QX;~b=#9q0y
zWQ~`r=gUsh9Y32rYtD6!=HnlPe;|GZVb98$rwg53<uP78BP-Kg-DUL*o8RJVxw=bI
z6n_ri=dYc4+Z;J1_2lp8?kRw0K=T?dzW{$dsKx$BOG~pHB2H$2MgOs{VRcL<tHUO^
z$5YWdH7%toYTO<cfH|2VNUSkHcKPuT$^K|0+!KclttF@#T86#nbFr!0NEL0FC~e8a
zik57wY|YY&^uX5Otb&?G!CD7whO`FiHLXf9sM-6xqs=6c7ErgDv9Y@lYde;a>ETpF
z-W7qMdL_D4;!7LjWx7!Fss+@IX$WjcMF{s*HzrF0URZr7(s<G9nL^ZETCXm7T`CK3
zl_dq7d9A>julgDX*rUKbMrkX{cqI=*gC^hBYWLZ!sTPg8uTBW=?lF(**cf>(<@p)P
zI!KTFeqAFTG*1<B(AB2aEXz9@o;cjtVZ`Q+3~Xvo$EMaa;<mh<U0K-MSI7fDsO`_k
zuAV~5JRF5ZbqnCXpZ)0s1lOh`W|tYECGlkEY6n-&^KjwC08RoQduQb!Q6J%;rNd1D
zm|q97-<BfA&3=9xikehVTa+{xgPR{`rZL}`g^L#XV!^zHm^*tOvB355nhD2g4sf2~
z1UKFj>)-+xduMp_*twG{FAxxJ^7mlAvh^ep(EP5)*_9j|oW68$aQfKE(dBGK#pVTL
zb|t?5{`*c_H*8Is?Q{F_TkWR(%EQg`^ILA2_666pX*0f<G0py~TW_6yje|m_Pq)8z
zi`}i)rcby3YT7N+ue!N;e0huAt)DtNI&%Ua&73)lIEjycAP#z(Vec%UR+FiScP28R
zb)Y7;KN!^2)zwH%O&t%^lZ_{xXn2Lbfs&rc?iiz_)uM2JUjg-;umJcZEvAGj10ov|
zl)Z`jV-b62G_5&R1YSy7Jyf88y4@h4E@{p}X^YuX3~UY5*0zVP6lg1eCOxRx-)2y+
z<E6O*Y3}yOB)+a|=K+{vtZrFKiTA}I;y@I~n@ZP)QtX9lpiZ(BCjkc5M$7V8R?^A$
zN7Aa3IjFg~7Bv@E6L+-i8OXIjSOYCXOocXC!FoJU+qOp3t?4>Y3$)du2_bCzu~GNg
zPu5^P0jMp-11r+S(an*u(!C-1915t7#IWWPK=Zcw_Dtg294X7b^yap7+S-vJ&&R_$
z4ZNPLe;JlNm5#6je(>KPil76D@U2QfbafVD)*Im+H5=1Cr^C^C1}_DWcn1gZq&>v)
z(1oIr1|<IfBiFa&El*bQPIbH+H~abZ-5%QKuyWRen$Okvwzto1l7GUGmA|or6M49K
zUUzbEzV72Slh<xt_i*<3+{NDczo*&V`k9-f%cs-qZoTR}!|C%|>~6g}W19V6?Cl+|
zPM>biT>bLaTc>|HV}`@kY13w0z2%l^|Lrit;qMpDTYTq<6DLB(U3|+cxn6$xWlys?
zFFqk5IX5LGWl2UxMsZq_p(rUnttcrjwKy%=uskU#wZxEYSe}+<C`wOAUy_`ho|_b(
zy4Krk*3+IYUgsShTrWFLbH3v2=>DRsz1v$(&hEeCNgiz#*SrPu8PKG+J{Z<K@KRk}
zO(`iUTGz)!3VNcvj;S0PTJBG9P&gi>MMY~swpP+wh59S+8s>!s!YghO;&){rt|66p
zB%3#sa3*!h(|J^Tu}u71-a=l{nt>I~Mq)+1qS-VatVLm4cZFyw+uFmn^j|BvAOdH_
z@-Xr?8ID!OnzjNeekunM`@$tlnm4q_RH9U@HKavhbI4NU{s;<h^hfG<!)5Vn&2TxY
z&o7ta!Hn&_9II-Q)n956U$>sk(u(-HttXp!k0aOi-W=ku)9&v$n=KjHmKv?F#RJxS
zYYp5J6peFVugqzTI#>IiM{E~G)${Xf3R(lRRy>j~#TG}0k;9cFU`e^n(9Yr_<!X`^
zy&Y!_s2a?qnxQPz4X(!emIB1y6O0A5i{XD~9Q+%T5mITO_#N4pmmUB+&uQfD;|lv3
z)0B6?uAZ3g<OT=#nHD9jSsvPsKpm*R$%Nq7h3j|#{a=56H{Btk_P7daiDc$OMGe&a
zxMj57-SdBZd~W->tCQ<FR~Pqg4|lH)Z%?1ozVm#Kga(9e%`xSe5@Qn6GE!1ZSw>@4
zMoLPK*<i>|OH0c$q^9P_#l;n*rluAoB_-u2#U*9sWn~%n?b{d3(bHdhJGl+0%QqUe
zE!PgW+<*W5)3vg*v%96Vv~-ToZL^!5oZYW!Z^0PU3}`O#ssj~}an{G)y?c?IoGjoS
zr$>4`i(_19f6YU~F;S)CdD0rF^(tDsEy;iZ{_;C63=4u!%tAzOOh!UOhJ^1ktRtGD
zkblgGy+bRp_d>C3^j_VPN+o9u&_KPS*+eR+<*KtoY=N4_2enC7d?}@Q(~9k}w!MJ2
zuORbK8VB^tVp{3!P)5jQ^_8^gHKefBA$~P)BM)uhyyyT*`+gWIPMcACv5Xonm2%dG
z^eQuCbwHNVfNlM_24y|4wfhWeB_~@2wv{cSQ?=@C1+F_eH)Ddb1#%72I#6r(Y4nSM
z^8EZRK--j~b!=$ub?ig4a@H&k71Yuny`h~yCmWl2>wK#T8(WPsnaFK~4C&foGq!e?
z!CDSBJOBV707*naRD39z{OkM?cp!%S_#I458e%K6;a?O3#|7?~?lO&BU7g|X>c;P6
zdBj<|I~-iSwFAVd9vn^vq~8`a|4*Oa&BkHk%-e1!?GTZbwX%|n7YEEG?J&{9!|ThW
zq?CGVCjPJfZ@ed+>JM}A;>Fu;pELhC2S?X0`47SWXy(qJ$ABhZe?I{=`_nc+J#N>>
z4F*?i*&a6Sj;VBZOk{Uh!C4P!Wtb-*khr^LQCI+Ok6wh(@)#u7WfG_8Dd9xXFg%co
z?Y$*3PQ9}~2NkVpU{IH~=8RF)*0r+LBnONtn8yHnbz6=+Hqz23kR}E-7q{-QnqJpY
zh^0^FAnu-6*;mMr=E0nxeUab|;z3REvPhPPD=eUHj7H?XU?kliBnuE~E|!SZQN^R$
zgL$;QlVM~aR@2rX)_`pd>+#A8+!keRWvN(Hw#7m@Ya$zfw)NOJ>U#vp`chvwWL?>|
zF0=fOn>yLXU>I|*w~|Dt?X=XEIPk~#Z=!)(^Q{@uY=3Y!3|nA(hq9%IJns<`zhgn*
zzG#Hsn~p%<xmjgG*y=R62G4@Mw<BC#orw<+y*xaLBQ-f++R??69MoNinlEibL4R8{
zks|)KhEs4ep5GeOe4CXsgITjZw8KQcGN{>8_VKyxi<K)^RZo?pwnXj?ziu*LWb2E^
zyKQ}+K|SmCxzA3Y;q(PJk@G(qZqH+XS_f+Bir^k<_NbGSlW77_+uQ^`g_u%(n3Ant
zXq%RYmEECN)p{j8MomlLRA7*_AubB>$DF7|6jB^TX*Jo<M#;GcIqCjHZ0Ibe-2=tg
zeJ+>oXivk+Ge%L=R$yjDO{4E;3arapOxB=QZ4maev%!7Yt6MX9JY7cA*<Pt=HA*k`
z>XuyIe@OX{nmJ!uvLk|Om8~lZq+?~VEFT(%G$@M!_<%8@A(A4S{IT*`BdX3X7we{G
zC{Kn=ws)puTSuA&#tbqB)W#0ZzE&PnuL5oDs@Wp8RJW?MNe61O)j6Us8-N}K=^fpf
zw1e9OM;@mMK+WG@RQ>kuEG~<BR(DfMX0%dfDXV3}3~%wICAPFZ6PwyHX=5vgFB#?g
zR-Z4Ty5VI4?2T<{h`K8VK@E`zy)y;=b;%S|nL)8Tb1~l#!eipZF{Tdo)8Xps3P)!r
z+2G>Fhgwc<vc*MzfXHw0ximoO-|kOBwQ3)mss}yM*Z-eCzuSmMtxYMC9@I)E^?a$@
zX3ge~4{4m>ERK~cSJh3#zlk_GRsP=af8XSr{9S*)4};pt+5JoHKtuJYl^$x<`rzWJ
z#LCJ_Bqk<W4iYs`-)MNn#=+qj6+NC(w*Hv4TDE0*So_di)`y51sHK8~uqe<M^THP*
zAS(nJdvXw6V-OI^v|m#smOo|2?sLnqYcNN8sY{+uM_FsGVt=$`D}MD@aF6N=;j5;s
zHS1&L88zFw-Gs6h16H-B^Qtdt0p#{QhWN&w6<G4PS(F=Ra<J0pRy$se#bNY*b<q^Q
zKNUfBNeHS-LDT^Q!s}xY*${@3C;1R?DeAARBvyhvRk-7<fp&CdU~_A#wn=7GZSKw<
zQ(MmFNNw%OwcOSf$<~=sHQGjDRja~N0BY4qVrdDSN{Ro>s{L%Xd~a6Is&dvgyX#97
zv<74i&UbVgvA!!)%~R33J+h?pgMDckYH3ZCP4Eoos-Ys(T`H69I*E7BLttYJznh^@
zUa(MYKtffnSRS|D?#PR3d9X#=@f=-Uh?fJX3j&BIjolnaeCco4Gd&pvd^3Bc>1IE_
zURkqpUhL~Hebij@7x2)_JW<!0NA2e3ac%YLH3x1sOTRXMZ}f%wkH7r#%QG3&u5Mmm
zXnza_HLGd%sI`F?71YF_PDn_w_|ucj>9AZUaacGJsK@xwDu5?zci05AI@m+LL5s04
zY$5#81Ch4XjF{?7gx04kc0yA$@*g$Q?!gl5IhRixI@3{dDiteRa-{P^gR~W>t$k|&
zH7o1#7Lx_kWz7O(DsMFksM-49Qb3)JinaojpDAK*nz(Z#xIR`|?KtR%LCs1!fTs^R
z;#9V=q$0E~4pEI!l=WaLwsb5f_SYLOm2j*mwsoardv}JY)E%rW)s<fpL0SbhX;8KS
zYS;kvr~^pNzqWYUDx6hdkLoPZ1Khg(&svqM)`q2XL#LQ!i@UbXU9&ngP-{CY@94^4
zSd&bEc4YIUAvU(<3#i%dU`X%m<-wm!+C7+u+KVe`Q|A(xABslY{s06vacg8M0xOdd
zSCxgZ@?<y%dSix{1G%_3F{FuM?cnA@_8zX_a&mJeS7#S^IJs$%wsd<;0(6sw+(b(F
z>vVGbpFY2vPFY)nS{ruZ$JzE^`@`Mc^IAp4+WRNs-<0f)Z}PvXd^200%Yh=d&sq4a
zi>v2X+8Ft~1@nm&wdFw3N>L{yB#akL`gQuGZH6aJ(u)@Gj@KVOQR&n)`35T8ErCJ4
zSRAqdi(-8#p&|oud(Gh8c0A$7)<VWZiP$x;5>-P>u&LXC(lhC_;!Ku++8Wljl=WDJ
zZQ>$XK+u{kkY-pb12CEDL1P}uTZ@o;+=S@6V-Qdi#*1aObU)%{wt)@F(lgB)!FfY?
zWK$vnDua=7Up&^GS&F^qSEKqu08K%%zA5&eD--~3Y)h4XU|AW}WwroX2WlD**0#WX
zqtDyc!v~hip{2ewJH^Uo(OWH2`pyz7m9F~Es)eE26<nh&jqEYS%GnZn)t!#Do$1P&
zv^GvBETB#81xhb<i;|4Tqw!T2@=!gz6g&EsBL9(8L^g&{M17d_sz=mkAgVGGv73yT
zm9z+UZgy~Tu?NGL%h}Zh4sK4E;jR=f3-EAphPRXJH}QvW#-ZR}?en{hRn*e;!I0Ju
zzHob<3hV26c?AznhLvB};u!V$ll|g}JeKi3pB43jMSdsU+`YfzOjce=!-t8iFu4}{
z`3j`@K#@VcXU`r{)Dy&%PR56xC^y<V?B5ooM~#5n05we()BynjSR4?j^o<Akkze3K
zS`fYvkxP>(zA}eGYK;hLN=M+nc*NZkjji3wQ9WEl+j>n{)ndeoGg+j8S_f;fK{POr
zf7qxD&9LnuD!bLlJ=Mxmf;RT5bBH&{EIV0%r0*vpu#UHcL?gH^jyT3tb|2QJ5FcKJ
zHl{0}-k*f9x^N1s3&gS$93{F+x>eX)XKO$dXPW`*+qkQNJ05s%qgk)2NeAmuz}CT>
z^su%8=TVPsvDApKt@pOA4lwn8xaB}oE5*(*S$t;p)AfK>OL@!&sP$Xm8PuGmB9QJh
zs4bCZ+R&DRO|3b!vDGBr^o|}AIB<$H$@iRJhQbqRlyGkpqPQKhI)=h(GZ0;!iIhFL
zSeO+A`+3gf?B%QswKy{{G*G(;q#4)@YIipmc)Pk<18Smd3|k=kHV*>-s-NFY1vNj;
z7Kg820Q=HndFVW9NfzW5NLN?)>q$u|$ELzdTaQm!S$~sn0APAWMaAOs^75o*OO~V;
z<rf*smM=Gym91VrfBxbhdU($KAO1tIN6nztY!4l%Wx4I{-MbMVA3v$6Qd_}EQ}L!X
zFl*o*&*GRsN!x148?ihBc;Yeu3j+eg>In|=gMYw6%nw<Jz^o|5?#z}Yq=EY~5U?+S
z*dMMql_!y>I|q~yCB34yp{!}V_C0;^fnr&6Cc{~L>e3d2k`>aPkCn|!U_NF<`2I-p
zuMXEDOr=;=^O9Olzzb<emygME+FD<ve?OADRH*903RIq3hV8w1^0r^s>0nu;t6u}A
zEi155Wc}F2v$;~6yRB<9ut&D3D>lR!Soh>wO0Uqh7Y5a$uvisboPVN~{&D>_cdeU4
zQ_dCzt&5Z8QUbBm5UkcrtZO!6eRGDqpz*}w-t+nV-<<gGSboxkguBBLULS#|rc~MZ
z9<$esn4Lz1tcZn^pBrv*pAHW%cWJ}p90`6K&WH3$_>v1by1K~fEq8Z!Ny58{>UFXm
z7Jn1Z?=}Kz=s+#ExkZl;7kM&~2l;p^(cRtidU$x`3k3zm*(-`yq%L2+GPyXvIB9k1
z>conYip7?Uj!8208w1?>3-#BRUw+x~uDkAv30M$NXFuKHUz}&Se8$s?)9j{Sb#ie2
zbei4tFI?TcuJZ{r{{h(km@{uKD`{z2<2F4jP*Yr7+&Aito&==zNq6I2#~cn$!sZxN
zdQh{X4hir@fd4`)4qi-)Q$i?mQzjznvM6X@Cj6Tci36GnjwKNvC{+&SVq;G}l{RN<
zfVQQqC$vDcVn~;sHVCM>Ry1eOs*YS*)n0(&XY(lGyE3#wL3J_QjwfnbSv;#OsST+Y
zFP$P96A;lDj+nawvEo@HYA=^z_xU9<(854u1+8sB=e%pH+-r5wuE3hN%V-;BG(c<1
zclE%Q+nc(iNWI!ToK&`{D`l;$t<<{aA8TMH?j={IGnK0j(sEn-JiUU}V9md;{`V6Y
z>me=ah5Wb3k<VS%l7Y3&$+V$0g|>HRND?3)z}8<}L2J%rA?5xE;=gf7Z7c$-lPI(<
z6N$Uc2(L&c=P+;BdEY8I(~gdgaN`94jvTn8Zf<c_;vTsBgY$Q^9f*@qmg9l$W*rXx
zRX)F)I{2akwOAjj{UK?3JeeqK&0O8JUh3<P_D-MiWHwJ8I?QnVoF@{UraS&?uwQV^
zwr$&dS;S7&jkqDjC;FK6{j+D!I>krC@Ah`{d3(CujQ{p<_PjpB&YoNy+~Dct1?L$q
z<T}HR+k|9{T=S?o>qC?@Lt5?nVC#b?6L;;}1s$lzvpXgl1J{p(->BVgqCh2U6+JGr
zH7{C!RUu7$T@(;Z{0<_-e=&mm7s5Xz0CQsf5ws?S!fUe-*kr_FUJ$!43Q6Ay!IsVp
z>>bX<mi|J$qSk|2Zd-xcmZDY;8Jjbx^h~-1)ZCxFx-$=@&3R;eI2B<BBEYM*l<t#c
zZQr5N<IM`YjzOJ9Jlqo56pEZ<iL|Z12zxIUVbA$IZ0%v2z#yPo*P5xU1sln}wk+8l
zwYyP)Hr+^V>mIWJd<5E~K&^S<+QHtKK4u1`RjJdN+9>^)k6T`NMtY$~Zd>xa)y+Bj
zt3GCyBV#!TOUCwF({V>z61H|H^O`TJ8Oq_%Dr{-bLDs<-gx3cltS%a%wMp==N=8s^
zCL$^laa-yFvYTm#>0S<UQ0QRq0(Xy@aB}jJMF7q&p5*T20e2@4Vmm~#C_FvM(c3oU
zrf|SGS!hnRk9n%_rJMcywiLD2p2r#be3-~>dtP2Xq=A}?mx8;wxYMn6(<GjhQ%Kz$
zU9UUb>hQ6*t5?U)EtRP}^*vSoj{Co}XV2Q#?5>GQicQ)O9~pZfJu&s(#OU~Y(-Jc7
zGp3mC%S<)jn-Z6DcV<%NUCFVj_a?`rK5lR4@L%?J4%a=MyvXTRXT*lZAuBx_Ifh)A
zQq5Ag&z>(!GPQvh&ic@-59y^I3+kJtq$iWpF~*~w!olGfHLZeLvbTf%7D@$%1>v^v
zMer?)M_7#+{`-trP{-@4q7mM(0P9<li9x+}plFOoZOaC^k)q}U#Ffn%Vtepy0d+?K
zmOY;(QKmtSp)wvWkgiW=FIx5;^3<dRG1X;C_eW@5v_zMdpUFn;<x=e6eT750*wB%J
z4ejZw3eCd0&TOpf%*EQSY^>2#rmn1kty9{gplm~7YoNBNtSyRH?N1hkFM(4dFrEm=
zdVuSpYz1sfiT`Z1IY$TSk!mf(nwC7QZOOzPt*O}9nT(x%si+<@qW)s8gjFp$5{Z~5
zKk(sUNOd%^<-zY{{HoGves%!t=Gwu|`xZEOIl<o92_8He?&<}5Cmw9^hKsW|LmJ+W
zp5O#bZXa{<_JV_tZSdWoW$$LT*?k*O#?2^ekJ`^aP?WT0e=xAMm{Sg-<GqG~fx*bl
z&O=#gIo4LJ!;0mlNJ~t`Ob;J9Kj5qnZx`<uRxMj~&$^ZCD$ACZ?TrtMX-tZY-=7!~
zb7x{${GBP0@%v)}qZ*@wBCASrmae>W@10@y-+#ZoO_*~iQ%+970sHCB|K;iB^9P@q
zv#z?idw${R<?{tk;PCafS+lvt?kbn7n+IRNw0CeK{-OQ-1Btg2{PwrMqd)xNPx$@s
z|A^oG=C|~(|N3uOww&{*mDM#2YBuNj)r$WR{sBSo_vfyUK;o&y9Xoc2N6kQ;1eo=K
z{x{0%7*{=8f7}|r6LoahxIN~vg~37a3koLA{0Q}3gwTM+SQI=L^Hcp1zbyw*wOI&j
zGEiV$jAU#SJ!(Kz-wM>7E5WV~GnO?cOE&d#KKMIRjHRcGu<T3`mbd26a<($sGO(i6
zpeX6)JSsbr2d?rn*;Iap4;wSEveigsZ9Ev0CBAgY^UGm4RDi%*b+;ieq;2F}k4S{>
zi&8Q@xQDvVgs9p$#5Tktyv7fOkEWseayhmS=403J60#hWb(m>wM-JAu=Mlfn=hA%J
z5p}J2wbpe<S2h=|Kbr-vJG#x5TGwS#!EdvOuUhW5)zxxa+sLll&Tgx88*fI}`i?ZL
z@6f#v$?ump@;mYG-<hucEoe=r8EZOnI4+jfv=?D@Yce);rqjmOBy4F;K+Qm=Eby&9
zSBO35R$}?H`3OG{L%ub!2(33DcuxjmE6s@CZp4D3KrJ5Fl7cs~1JP|vd?|;X*%)M*
z4DfD-NBlSO{BG*sO8=t8jAA}%2Z;=5t@ytMPk(y*+(vt=Yw^cFe!{$?Pd@nsfBd6z
zeeSvEFn8`;a&mGaXIGbNZXWKRy12Ri$=TKA6IT!S&)hvcuDW@+UiI+yxa#iie$~Un
z<8vP`?@!%b-9DOOH|^)aiv#!7)zvwTQqt$nopTHH4{5ZsoBlrMq4It&{z3SJbJ}!!
z*gH7MeeT+DbaElS&;KZ<&v1}`919mNMq674eg63u;Q#Rt{?niSfB4By{+?cc{Y?}V
zFSCTg@RfgY4b%c_1=KP=zJ2@li9l_=$Iuq2ZMNY}LPd``Fth<`R@b)RY<=7En0VB|
zLEsj>V1GXWb#TBUEC`&7If;u9u`V5vRVIYgr6IJ52Ta0{eJ~L_x|X5l+;UX)F2Rbn
z6qK}NU|Dl6Ejv?03~QU9Zq7z&a}KOQ&4-68MM<YC?R(8jkar>%vG-;OsJTa1z%0Q_
zlIvjsbx6G#u?_Kvs0l;z-BGl@wTO0|UyiCv%dojWi`I2zU~Oln9@MgYK&fm!sBJ=8
z4%t|Bb1{_FlJBXO6?n&h*v4&Jpq^CO26Z~tcNkR9I?M7x#Gsb#Ir4KFNC9>xG*DNx
z=Mry`=T^(rr{l4uBNa90a#4Fe4-FTJv8TTXCC?ZUeNPyI8zYoH^_p~q@5(@OWiA3r
zqhPndP7i5L!qYOQEuhw*t!+@!r@-9=r8^Z6{!Ki;oBH><5vbYz;K@V{)cpOoZrg!>
z{KuaP>;C0m{smXBUKIxZ=}&*c$&)8(=FFLLuzTzDX|mmY+6+!ObdrTDj?NC4;V@m!
z8+gfs!wh>k+B--js`Ct|PyHAA?>K(^xPwJj*VXMynCU(1HCGqUYYgiAf<o{QuzAZi
z?Al#Pn>KHi-C%dD-^lmnW2Gz0C7YGsD(u|3n?C;d_xPXx0Y3ly3;L&j`hR%orC0FA
z8*ky<xgq&}{EKP-u-NzEKLW#AfbGZjM<A-Is)#|&9<?@zGC|P)c#x)V&=+mX<{0zX
z4In+H>tk_HkhJIp`}<Ll??MEspq>>y7rw<&h^xv$M6Cgl`_m}6AslJni^0Y=Wt&IM
zx#hIFI~}F18CZ7OgypC6P;$Bm%TE_jNpm(Y7Z6CVXf;3uwW_FdWYC2V64iccwmgUj
zXjYtFg7k;DlOs+xp>rD^`_U4-GzQd}6xS4kkSc!^KW0MJ`3h_wC`RSQr2^?S9T}+T
zFew{l+H$d`EuZAto^65i4Pa_nzRP<Zb+@&_oH0v$wH0KRrM@=+wq7;gNLAYa_GqQu
zZdqk!`C0izO1Z5(zw$eqWMrRPEZ4UrV*6QxEZ?m;zXbbUD3_IFd?1@}Ul;=G10;bk
zq$ZxCsxy#Mm4ndII5>uR!Oq*xqMG%Y(%LcrJ*4%D`fIAzsle{*DCfV*=XV<cwS1hJ
z#&G6$`?KfFllDAqDv>>E^@US_y>{Jty#D%|^yZsy<E^*e!f${3Tl&ji{(?_G{S@!M
z`z~^Fas<kJxVw5y1#RBC1v_@_#QKdJuw~n3Y}~v7J9qAs`H@{ac9O}Mi8(W8!)dxB
zPnEvAyl{E4fSOxKLIT4#xjK9N-qFDoOA40CD)Yf}L-gcR&)~7+kIRm)C!Tzoo;!I8
z=ZA(dbm1btbKiI6hv!q!#~wSuHV3X<`yYJv*;N7b%P+r*x88b3K+QW78PwW8CiZ<)
zP|KA;%|NTFs=~Hy+XU1M)f?qVPc}@+7JO~Ql->x?G*O4gL>@J(X?{Tp^bbIgpDzLe
z7t?}(`Is3xo8}q=khm)sadla;Ly`Xv8-H&URy=Daep|d}a2eJQm{HcALCa1Vu>3TK
zG!+W4m!HW(X=@gPT7a!7YDHC#26f39?x{9oWlJt{Ph?W;y~>`$@TN3@wRC!L-)>X1
z94v|zQlE;DdIMq_LlN5)LYq4{-LC>W2A5(}5ASkJLwQS@_})s+NG>=tWOWPYikQ`G
z5u<w5?yGqtqpwoh#H0pj<!g;&z&vLAx=r}o1hqAgCjz&8Onm4LQP8><fRPuI5kT{V
zrxJW6KXYq_{C(E6rDH=&JocW;LG4hX#J*MymD8%zc}V(h6a_T|a%&_4_l6^^G9HP0
zjR-G`gG;Cvu_x^~+XCrPxzbu`$#{A-{Vh!(ex1p}sVL*Wy61P(g)(vfv<hlb(+q6w
zFj2Fj__}889bibm`s(X=_0?DLt6%*JUw!qJDC!qpctK`ESWUC4e(>N!7&teG{=oq{
z-Fya5Kl>Ct@zmpZ;)y5l*kg~OzrP>7XM3=^yh66aI8Ar{%fdMeALOPDS#BE|9C5dc
zlgH<t9y9USqfelxw;#tIc}(h&M~~z1!$)!C=p)1{&Ibn1qkrI>sBQjXc{%O#&z}bS
z()_>Q{q7I+&O1LQhV*N%y}_U+R@C}`P@45&u|HH$^Q+3%ty>Wr8!Jk8B2eETo>UtJ
zw-uVC&*qS_hU_F1^hCvWhgcq3=Li1>_x0ri(*W5G84$P_i-HznR?r;W9=`zLt5T3y
zosH0H322fojMRr>v8j6*cJ`NG>-ij1bY{?sQyC~ZorTgf1z2%9UqHQr2VO)~XX<;a
z6&pkbUJS&2*2|vHl-!V|C(VezpFQX>gg0@IbP^A>NIRag7(iJPAPZ~jlf{yWX$nB$
zBN@cQExQLxv9*7R<b{;Aq+w-qy1W>aHD_x@<t<sH4%nc))u7yNv5dBlDt#QQ)|Fyi
zHv+W{rLF&5*_Lyo8Vg^&vM-Q#3cNK(9_uhlDPL<sMT=Pu3%OP|XVI$W3|iBYinSf7
z*mO3XYR+ZL@`38}OU08ed^{6TcSj<)DGUL1GO~}*Ju!%@OhIs2I2?nVr47%?#|1N-
z94#KSHK4VU4Iv|tp2!~fHsCgy&-<Hvepg+>AiwL^K&@s`%b}vI;!<A}`EyxOvoQVP
z4__8V{p(-<nyy{DCaU_CS6;#K<Hu?K{Q0=$mRnF$S1X`C+uI|1XCFR#7!MwN07oA=
zhJyzW;_=5H#|xLQ;GVng#jKgPW4hgpYm4Xkp6T!J_p$rwPd{?;_YMBO!wlyyoE+Wo
z{K;nY_6>-FK6vP1S!vFoW@X*c*^R#bL3DNZ2z(tJoe`gqB&zw7PyS3-uYQU5-~RwV
z`q5AL?ST9Oe85<+q)1Ef;(u)NR)Xi~8Pxs(L8O72rxF>|F)=ZkqPA&!+{ll%<w@&3
zW^1K99&jgsvrRwRT1k(T1=Kt`PksTu;M|XSf%9>D#5`JL4ng8JlY}(!h<0F81VRr4
zQ_0C3+HtNNJBIUdM~_K5H%d>la?YXB<~&_LwVBHj+N3?k-n97BY<HYtwVg-VkEK&c
zQ=m*CM($7H;3ZN(%_HLpDx_mXZHG1_5!)hZ_Xo+uBtv?~;BtAZzpBN66{k}LwhU<H
zXUY-9&d<kSW?#I#)u2LJN+7PJ`B?x>V}Pwdo7B=Pacf0x(+U||BPv}j>&I*Xo9zs-
zG`QcqqCH>MoAK!V>UM){;28mRHY%EPsiHZTL5(%d2CQpK#pa$gY#+!#-Ov)$U090k
zy~R}ccsfPg6@kUIq42Md;Z7S0s!Tviy-6TFJ<y)*4mfx@l8cKA@hT_Xb{4%?J!-Yq
z6tX-ft5hdDIXD#{{#8G}s|sIU8OZPY0|JAERjj17erg7_wkViCf88A$gmrJf{Udtw
z%{TFjU;F}p{_~&l!3Q7U?YG}XcXzk!fSopN8a8a&NCW2vskgrmJ$=16`p6MHbm&2P
z;GqX`?9oT?@WT(|{Q2|v?tS0GygBp9d4|iixwGbXa002_M?d|@B_b^50S2{?_w97%
zbQ@Y)+hw&mLz)#e1DkD-uI?UD(`=2HvvLH~(J^tja^*#_KG>sX>*Gg1`U$=A%4_nL
zV0icvd(@T<<opkdfB8j={RGy2{(<D{>njI}d-m+1EnBt-sAV(C_^YyR)P85(;W5hM
zm;ky{0rNz5hh9-5&_9U$7At9iiv#?z(0>v9f_<?lU?JuP&82w>ix6Frf~2}!ifS@Q
zT3SF;2+|KFVoP5Ic3mu>O?_+~7_suSLDKNbTXIwYkMvV7Z&ga5t$5dR&{*1<OJ!|K
zQ24Y73EzzdFRaxP^0Yh;#r{Z8b|MO>V<gifdVeyOJ&{ONLn{@_<7_?{(q*96G7ta&
zAOJ~3K~yanSbjP~X#s3zJ0@?WSka5pR}L{to3q6m*OzYhqXbE*TWiRA)4IBCebgcZ
z>l$|znPp+ZglgPMeUG(M$~*F@ygdiy?O7VAp@EvW<?w1VQPpQm(t^i_j$3*%v12e3
zyN66NwYh6>DT<y-N9ch71T=;sh!@k=r69b{K+$`Qh+3Zt*Jv-YbGL)zOh>qRIKzIr
z17>;5vZ!etsI4JwZFfw?Hkge1oT@7Rn|yv(HxJT4&8>LcQmgvY7N1)3sMYQ@{@e4p
z9Xki?ApG!$Kg4_Qy~oA^{r>mA7lqB>&CAOp2L}hNU%ws~E?i*i0}Sh9j~>MX5B-3S
z96Ktu$e}}rXlQ5%`x^IyR~foFx?f*7cX5}1n%BOBg+xBYpyo-Z<BvUw?z6pk^sy7f
zkbdakVOG?1`b-NyPOP?1oo<G~Xp$e86*a%2eE8u<bp1MUd!GE@Kl#bu%i944b#7jP
z#iO<cwOAkusEHM|4%D`~J0=QKx?zWhEl@K^^&$V(9UB5#+pTxj-)9t@^%deD3=Pza
z{Qa=NZz24G{o(7s81wz-V_}RRLJDIkr790$RcVq|7jz(s!VZL?qJ1TH4=<su{khyx
zKxJn#B&S+JmN)`+1k|K}TC+k77ErUFUEaP7rekRcYVb#JL#Qa{z#5)JR6Odi##A*i
zkEax)Wer#Kfq2B-og{5`JI)nj*U&Oi(wr5t;&hsfu9uuPqvT937nPjJS8i+5lr2W-
zR*|2P{d7^@N(r!aTWYlAKRv*0fO^!%b*p8*Volhr$y+9)?rWef>o8GShY98FCMuWx
zldAewi+iP4Hyf$qOonW9-+b1LorAg9Gn9`#7jm(suLS0!u?V}%A3^&=5ZDwYaj{B=
zhe292U7}`@-OL$qyv+snE;BgCgFM|mWJ#*d_RzQESws4pS_~7x?dy2Te>2bTq4rMe
z74^LN3t3TXT_2=%eXtF}pQCNeS-)Wu-g)Q8d?rV%pnv(xUxICqk3RYctgwfNhf!Ku
zDtRnx*RDlxZ?8a_>+vT~u%Z@7Kk(3lbnMtM3=R$osCikgtApG1*)!*MUb%8*mMH3|
zh}Z|G-|FxskDxyJ#IwX6wPtzn_0ZuXU{JH7X6u7*r=+IKKbq9E4Dq8G&}@D1m0MN#
zF;>-=E?q%RZa#zBvNKV&K1lPaeSLiefIRH7b?a7&jEtPj5X-2(>G1|u##xnRZF!8D
zCLE=RZTQzZklO<EsK<i+f)rI9;4g}rODqsSKY{g}z<IPdJp{?yauHo+k^??g)gcEW
zk@SNUZ12m*&VeP^ePKCPHD?G&IL4F@7gx3C(+XDBE!kMsl7*tv29&g$sI=3Br7h`L
z)|w%ZE_^1J622RYz`7uWG)C~QMq(&ykml^^$i@_e)yI=;5^so*p6=|US=cdDgze`G
zv7v_(_%a02r7f9awJbYrrln_cu=GrxS~={U)ABQBEN?bQDL-G1`g1BjYiVl^@%9?E
ztZplZq*{%mq({NqN?ngu)XFw?=}gg;<-UFaux7XDi`yeh+tX3jZj^Tj{Froow3_(8
z2d!yN$Ewpw;AIax26A|;p7snCV#m2cIdn}qoP^N3Ldmz@AN~zt2x3pVI+-GNrXzZj
z2_A6^X~ukS*tt1l2HPDx!OLKFc7&VT$RWJmqt<nIOx6aN3<#$JyouoXH}(7;Bl{99
zs+zMs7}RWc=<N^H`ml7`Y}~X(IzG60;<eXa6GhD)_51I?k2l_U1D7sc5<ojTI#NYN
zg&Y{N?a|xcM-1wNhZRWw;K2tp>w^yLyHh-BhZ)Y-=V;c4qNpPtaCUV2($&QiCyqZQ
z)(3mi4Cy0B9}(+=J3m_6I&ik9PZV`xQi@m~Y3T-0&>w#I5kCF&bA0sC$9VVMf6#nt
z8X6kbKyB#<)qB*MqSipoirN~~Q-~$C3GA;kO=tybn#$)}1Din|;HM<$X`q%oZeKq+
zNL>)H0CS@kBYZ_NlJ@2ytU6Va>UgtC#69s?+ia#i=a-B1z+DLC%^4_X0CH*`x9F(=
zWJSHSIg>$+6&;ya+G3DC>!l}`ApLMELYu<iUlXi((3VwON(fU5!s-%bYfIF=1ccOu
zAo|WQlss2}U6+b!%U}W4bn;g8G_gEHO*dy_*{N(Dq?O`BP673qOj>>>Q&reXX`r@@
zzqgLPZw+dGQL=RqY4bpGwBpupW1m#nI?OEVN}=-3RPMY{Jojb;RyUhiMav84+SW8#
z^su$pB%rPwT8cdvR<I>PnFk}Vs6I?8?9N2_yZh~oLPAX@;x-%L9y<rq=6b@;-5qug
zZg6mBSa>TIhl?Y4dyDl!qK$s(o27EU>G%1YczzGv8ZQ33@_i0q(m<^#YCd4p4imNi
z4jVRZ7K@i%1<j-W{PWNGP>~N4>EgwUC@(J;MZIp_It&a92&mcq&=mE-!-w$Dp@VXu
z*wfR4riOi(J!=k}99*x@xqW`y(9qCK#iI_7`hlap%NGplCmw$W?Hyfo{KOOZ-uE96
zHO<QUi6@`t$E73WOmi!xXBg#RFg?S_{tWj~(-&WSC0B;@+i(Afe*p$H-2l|0EE$H}
zPspH-h={n6C#`jM=!5?CHEM0v4Ir(l=~0~;<0)$WL8I>TwA*7kKDdJX{1M>iFFriO
zTFQ?>9l)?Awn1hE&7+0JP#E?sK}@AVMu<b%0@)vj{G;*M*<XsSeZ|<)SAeoJ=~Uiq
zU_Y0ZpE7A`Rq6I<%_0Uh1A2L@nYflbosZc2Vi8aq0^TalJ~U@e2iL_(@KR`P0;_2X
zuIA9CL`3h4qo8U(q<%jN8@iTb*Od~i@8?Z3=_o#xf@P<Tte9CzQ}O9shBGZaT|jc>
zYR<yakxUX|aO+`h1#ImQRDT$%#JH*|+sY!*Y!a>HzUpsl1;ta&VQ<-@md7d5UsX7d
zQq?Ov5>VEWjIxe2v3>Y&Uw+z1Y<F<J$(9}yd(yOXD4(h>EhFwTFFTzD!$UC?TECbU
z)WyTEJ`n*m3I9KP=K<zcdF6e1iuzTZ-g}WWz4u=2aW~a8_cAk{;;~H$7z_>_LJxR~
z3t$Xx*qD$IoL>3%+iW)3BqU2n-_%VZ7);*tJ^yoc<tvS**=F-4Yd_C<uB6fE9TorX
z(f|FQbI8?)=Ks}{cXcU6RwR%nN+&cH6NMTv-_S`WQzRM8PVR&kZqkuf3ir#TRbFZJ
z#+Y(BnB!r#-sQPuwSjB>L$7aDjp0%nGX;Q}Giu+=MA^fRj9Pd>jlw=`CW;^a@P`7R
z{^c)!$)G-Y@}yYQvydc{nO3e`Nrw*~<_$(1Kk?|ptWoc}>rTL0+;h)84C?J8J49Se
zJQ?-U+1QwbeZI}aJa@qz;i397kUk!J^eNsfeBi-{IitR7_ubH`S+7Q>jh`W-Zft5{
z_!gIxp}0k0Gx5xs4`9;+sJ(yqSLx)*Q!`2*it7XA<JVt*J-0Uv(nor_EP4{0gJjcz
zK4`xzdAiIvSP{!KQpaRq%b*qjH3HdmT3VU_sMGNLvoa|*BY|S_ld1fwMylA{Ooaor
z<k?Zp(>*F~af>U)I%)0E#e}LrI1!Ll15$8voRbw=XxV`lfLbiv*C-YrXk}nFKG;m|
z8}mixfLre0F^nnJ#R8y4R_z)pA<u9H3NGZy=!0%@4QJ5&C#q?~iRHBV)B<t&p=RnC
zuc8HG)m(TpA2H^YJOJtOPDT1)fcG$@Whl!TwhU|)v?uj22^@@|YC1Kkb!)(&guo3+
zAFvU@;H$nqT{g|2ezsh!I8Z^CKUX6=Jun$(uiQffo%uE#?-U!3chcrli)iif9?|nu
zttj2;61l@!ls%Y5*&|JqHBcuq)|FHK`f4h^u9BRk(L!U_kk)A=y<{V!6hTHQij2kx
z&Z>1L3-^`QN?LY#%#cY3gVRhKYIDg_XA9eZ$n~w>Moda(4UIZ5qXx6E!KiE|DgjW#
z@c~r<K5Bsa%$YOd*T4R?c;k&XSd(sVZNqeUaou&-F^B=`Lx&CtxISRd1E}x0?_Rq9
z{`*-PxpDhV6df4@>EmpCOu|04=K<6?S+3jlTGM;TsGoXr4}dJ-`gr&gk20tM?A;%~
zhn{|Bls6gyY?OtglsqrLkd7QVMsL6U4*mJh@3Nm7(g&=00CkXz+RvV+1~rOZ@MJLA
z<pLTiO{-1M642_6#M#OmexX1ao22ZWPRE96Dy65T@HYrKGWc~!OiiJL%oK{ujH9&r
z9I9N?Ac}fxi5(!rWmGVnLoIh#(wf6dX~WA)Xw{J}c7ULW1$H=qZ|VLvmK&BG00bdR
zG}E#J?bP{HoyfnXi2b_gC6cqXTx1WH5`wD{hh#Xrhsr5$xPl6|RZ#YpEK#vDpRPMJ
zpEka-n65n1PK%$dr|z*@nm^t^3nrSVYYYLYrHkfIw9$gSvOdik^|)V%h2u@ovV#D7
z$_UmSaE3|j{#m!bt3=k8y%Bhw&;vz@!294fxIB2q<bhhA+Kxcq5A?R)aI}l1j?E_)
z)AfhuQ|BX9RB%%cWew%9vnFe>P-Jgzq})x7RJ5^~a#xfJYo3$lMa-jctCn<TmNwA+
zjsYF6x02Ri5qh(gj24Lu7Nfcv@qFeUo(~`|mSph{vA)#{Xa(3dyHmjIpw6h3aa@6*
zM#Z*bM+T^&Q6r=N+0TAP0QJ6o`$R=qIZxq%VsQBIVF6elIB<aOx$kZUwOaZ>roC<3
z4iOp28ui)On8dvdYBXcY%5dN61vT6AphLsyvFpy=!t46rN<<XEAftw#8X`L2i-MO!
zhhAcP9?Hj2N)AxVC6!;JmtQ_PlSa+p0@SdPc<r^<a*vN7g)7r;7zXKjH{;}$DY9X|
z%sBA=Y5-3Kc-4KpkxFT4DS)&b(56#T`8B{di}>UuO36y2n2b0P>58V}%gd>BW1Yw!
zt`*rMRa7{fPo+Bw=!%JMT77sSt$Vo#y)lIBsg|==KzZSKBX7jXx^OdF<!bILrHsK`
z${5T;wIMfP!p5Q8Z<;kz?lX=4$9cmQB5$~qTtm6k{&0=haB{I&bG(D(jmbLd9;;_a
z&!1=kq(#?g8!edVWKc7#$6LgLaap%k!#V)ezEGen>)B1gTDkJ|Dc~F|%T{Jb282JD
zrvbO{dC%qB`Dd~w?bW0A)zWnb>!3voj7;l)Wf5WjV8vK7HQZAwpzA|o@}3mg-BGZ)
zjS4rkQO1%|GP;~RMk~w|Mv~P`CWBFU8~-DV7RaOlX?(3VL7P@VdKP^=&IfSQZR*X{
zW$_QYzNG3!?aip!M?DRwc>@ydH6ZgMG5z8fzbN4PK);W7-g$>L>qj4bloI0;xQ7S&
z?H@dNke++)IePNRCu!GRchK#-cJfBz&O2_W-Me=SxIVUTzmZ~N<1rNCgD7X*IK~-j
z-hTUSy(c$+Bs^6A7f2ts-MWiQ#2<V7N!oe)F4m}#P4B#Ymr%0miM{*jrkg*;Psr|w
zppSq29{R~oe#Sm(fchKXc#}bmuLLSk3spuf0;LZC4f-^^hEq%hpRsrJY<frs(U+%_
zJpAl;lL4GQi)<QFM-ru_CyC6|6v|9Z5t-1XQ&RC7P*NH)>NHBt%-{l;h)gGCw&zmW
z+B(V`tfk!TbyPA^K?Os3qUoM8?%KBY_yW4&a3?qZS;p447Fuxtm5L3t^Z>GH=+-T?
zXtYh_-JDHX!{~@tEC7z|p(=si(m6vFB6qNeT<C*6RLsL_JwvdJ6;k=FrF7Xum%Pr=
zChFN=PxJTIi|&aAnm^G*-4kupIVMN<L<e<`w^H{w94E3Q0#M7*CKish(W0>?R8$I7
zRm#UE%!1^3klb$@7C&`NG$>PR)WH>&!D5;Wn<WwNNHU>1DnYY}<)iROH*@dm>kc+>
zd)NL`oz(YA7d+CmVoyC)-{GO$!Ax=u=X2o@Jksd{l_GthnhIApQc6$0&}KVGV+|3Z
zW(=j3xR`}oVVcZbVvOt=Su_Ih#`G3RFIOD~bj7<62u>vpd=y#kKg{})>UCA552Z5E
zJJ>d8W#X#UYngQjxIW%`>n$!J$7UilYgmqrdIR2LapxVoXy3$MF*-U5E1p0$eb>kD
zB!C(jH7XO~v+nO7;1;S@$?<+vMC>O|o;+#Cl<=@Tcj5JVt?760Q8zZUvOVv)=U)(j
zHL_@A*KmPA3c;r0_{2W($*1@5R|CvI?C9uXD4#w1H*Rr?j2dSd+=i;fnOq-=6aY}K
zT)A?RXL^PL7Ioi_p#3>!$f&21J^bu@!2s+9b>N2LRG<c=DJvy~GE!1~88tvH!#ah~
z|06a#O2kzrQ0b}~;oed$gL-SF$REh3{B3CrjT;VkiuETJ(yF69v~;|Q0eIQ7op4x)
zbD(ae1y47Nw1ET$b<Wlj$`~l7%z+AWZ>{A@#Oy5v<k?zG$f)zTRZt#!P!AM|wg;MM
z_2K1W)zJ=GeH@@}6!Z5sQrCDr1G#&mO#skc<L!X8kY$i2F@L-fK|Q0*exUXOS`|$`
zZ*>q*3xIm@L<1k$UE;m03iWjb;36=~4gmFxv1D&OLg1(d`IX}x;`-<3)7rz`(4zrq
zG4QEwTK!@jEql6Dl-`_3`P(vtd)OtQ_v2ej?r=S24A+Xp%@q{Wkx81Aa6;pMeGD>Y
zi7;HlVRDdJYvljP=%l7IYXNJamkc~+3y`)OB79Ycs+bNy7YlCFZSMV3tuJ|dcX%%g
zC8Jh>nq40NH5$<&n^xQ*tJka(U>yt<r%#{e4ti(Lp5>k&uf6t~sH&<WgHBIzF|qX2
z6Hn6qz5BQY>O&7bM2|lH2*+bjJWkJy?%_=P#EBE)s;gE~c(_hj%=SMg#3kPM+H0?w
zxG~e=gNKVFZ4qCx7^Dv|ouI9ug@*eE>DC>$(9WA~r5z);(AL2nbkp`*X?S2eZQpha
zM}A&0p^+1&O)Ortoc`tievAJ2r@zqmzW<i^=9~XQ|Mu<g&>N>eFS@$sBSR3FHHOI(
zNbA$llnIrIDtjJ44bP#HQLFn!PuGrgrdftFNF0;0=pdQ#l-YA|spA~T`En{-@dP#z
zG1-Q{P2jns2qp=wPg5x+CWg{e;wd>Zo?>!iDYvbF>eqKs{pJOfzN3LMMyknka|M-s
ztcb2Xuz)-3tvl30YhOaaM-?rasG@}vwX}FYicY%3lCg!H8GD9Y0>cSh1NH2ihHjd@
z)gy4krlMz{hVqB%$lYH~MOzD~>?Rkje7>93y}X##p6EemJn9<noFdxg7;W>9u@)g`
z*&ITBlx30@0r>>6V6VL4DMwTA@M_<aG;l>inS289W$U=?^^=Q52kOWh0{(I?#@Ubg
zk=zr7K@BjY@^i^pJv%q9JOB@S6Ky!w$_@VejxVImFE6F*4lbgm2Qfk3Md{lLDd#2>
z6V*^wZ#5P7HjC=s4$50zMvk&*zhV{TvbtA?+9$2nqi1Qsn@c8nAprfSUSGl{A~b4?
zjU0{$=2CWcE?7lTaj_H~A4f3>i4+wVPX@_CI+K~45izuJQ$PLRfBkp*`ZxZCrQRR^
z_$RO^i@kgIQ*Ct(T9*o4xREN#s>R0jy>!b>x6zJmH;b)9+v%o}o9WgYZ{yf?>z%ao
z#+}q!*Gdsm1ewFlXN~iWpJ}acE%NoFK5^oN(Us|1@3c6+XERyPYUhPhlr4gcVS1qt
z(URF<BZF2Vqs~HM^Yo+*H43ZQN#S7zGUz1%SR*Pbs_5Q(@24l9dYbm^8ABPmxbx24
zR8UaFkjD5LNwSJ)Oi$oU8jwy`gIZj9<&|nsPbGKEYL=n$v)MvA@Mj8eXL5N2lSKT0
zoeGCX8b43WisWw-h~zW|b#_uJ<)lCsNfHUEapcU1;ATyEODaU;=0%jbqn_M1HF8#*
zzs*A}_mqfDN0(CH$%VB3ScgEDwx#>4<>3Mo*huT4wntj2a7Tgg40*`4rI9CDdqFL@
z_wh&pgW5e*O&;{Z?klFeVYg_$x00?q)I%FiEurfUcM3FJl7ZZ*J_;YCarqpeeGv@O
z%4G%8K3GpQd81J*m}n$b@bz;bm*d=qBx~D{Qv9-VNI>!kvqlE?(gXEk>4AEdg%%xX
z5DWL$6M{Pq;x_h$L!-uocDXev`iNZjLc4%>9Vf%y6Z2`{)g`p<$b9N~qFSImY4%7q
z`m%`h;bO|#T1}pzdMfB|qQW)xl({gUtc8(66Qh{~>A<E+s$!NvcgIxyJ7x>Lxk7Tb
z8R<XW`jQN45ddldP{$@FFsz-?F=UH~B%{SDOjf)vPHJiG6d$|w4!Udiy|ioBU3A-R
zx6{g%*K&`3t7H*Y$pV|5uu2X{8GISwHtHp^8f_eQvxD@Z1`5-J38&dfl2&?O(n>!q
z&Mm%t(tzAkr%qYQ$|_cdYC?W)Gg*HhstNg{S!evS)gb-VYP7zm4>g>z7_1+}IAcY$
zBZeOs3qnT=57nYCfv{QZ6yb;@>{yx%X3Q2Nr#*t7xOWgFXVg(qF_a7qC_R%>Qe=Pu
zda&l9dS{wV#JRL3owBfHroxq(06i^~y>ZUjkw%$vMy-IFr4HUmOi82kq%=y6Pb5r#
z$w*10gya~C$%+;BoG41H%c6!=-IP62LwP&upd*XCt@%8q`pWSRLjR4m$L7<@L(O#M
zp(e5H*#?FeKwW-E1?3LqLCPRN+BH}u7r6}Qdj|v*c|l!C`KU<Tl23)(-Lzt~gH|10
zC;)1dOZSXcQpZFqbxgG5C~)i=Z}p4Lu@;2r9B(3oR|@e3%O$FSJaP`s>hK4&5(~%c
zl@O}Sz5tk&;u-`tKGjEz9+PDa*$pFy%Fhkx<8ekSY1u?2tvpyO)*fl54ab^k!;yL#
zeswwZ9$iRRj5mpfd-J&zJbi0ArEm98=C%^vFw7rn5M=|cRCIkkrL^XdDci=*4)pE_
zY)v{{1eww@8*p9hEOj=3{HI!9^3SM+I-`z^jp2Y!4e0~-$B9&{GjUdJwKyrl86&_u
z+#l9Dht0_wh(^8PjAXLBZ!(zA7<5L&`(~r`fyHe7z+^CgpbOWZG3(9mS`5;k^dZ{c
z8^ZLz(}!xm85bF|`72-fivNTcWq<$?h1b>96<3s2EXvRItj=>647xIMZgOY2Z_P@}
z+3Cu1-IbG;^Pnr!^N1(g^Kemq$^EVj*8{m3+0Vp9#(q9T6Z)%AO~_x2dei%nwurO3
zaQ#_}LHa<e)pJG-P(uPiMvXI$3e*faSo1Ew{PGz$4rh=(0zK1{dU#CNr$Y_hU~)(x
zs1<9W`gVAvxjZ~IRW6VBx;&JOTG>G4=bp@<7FoEQm_Uiiag>ykEF!XED5@ZV+?}PI
z_2vy#@n)ZAsDw&yDWU3J#kBId9$J5530;4@n^qo1aY!w@K)Ro56`mb=<Q^_TwV?o{
zQFX|J0=5<j?mLZ^rVQ$G%HLKlJi~cZy{m{;A6ZIkUtTP3IKF_T0r;k6P@juQp!Nb<
z1!_gN4!jIdvyL4Q-rE|K5UR_Z@dBifb{0-^T(Gy67EIK0MJ6gV0qUN;4FWR8Qk5(M
znFJf0h$W*<v}CMNpkFpdf?fY&Gd2qaW<mC!Y^A>Ajdb1KPU`tYHI?slQ|`75%G{Ad
z**6zb);1KelvBZA6P5Hfljq7xim6T|U6NUZ*g`4X8b&6&&abL4u*y*BhBwPh`g}k)
zn=JKWXv_c5>r2ys+8G_ip!N>AWvI&&uPm7S{x_#1`h$>p+7GN&`x$MR4%5hgrPmt2
z<I2f7P>`2*yE`}U4!0}s_IywN&OCR)?H;%1&YUdQ?yQXLyR$N~?#fKfyrs}xI8fv%
zxTZ9(u)DFUG3WH@)A}ig+bTm8=Q0_WG#cD@-nLb%q-BeiwI;^K4>~N4JDigJZb@gl
zH^v$DxFlJ>XNCZeuXsi?#l<B6)U4Ag(g)xMYu;s-UFMs@qS`2&3eYo62A{TXbU;Qe
zf<QW`OcDrWbr!B<(OyW)-xgAmDJ?bGFQZOOO=GX7l2xZAC5yDAL`q3b5NOmCogPaO
zS#iRd8%OT-B~*e2{sT3vCFgG|r>rem)b>cDSpD(}TKmdky7p)%Tg%XLv}Sh+xwpEx
zjcM*sH5arX<bKm74C$P$rD$WyCFAJpQLrOdbUj*48(vu<)}2~HR~%{u_yl@~bWAi)
z6#~ch@g{`m9B-iD5twN=AcXfw-Q$f21>kCs^JO`6o_t&|QSZ&XVH?DTC)_EG6nI2S
z*d-Hfv~;W)P^QJBb+mM}o*P_UHUVFB1BT*?H7~VupN{@ldZ_Q@0=nT~qqywp5~{qV
zfbvIjx$7WW&}NJjQp!LPWo)Ssn0HyQs)5qy7YeH@nnImg3NfQmyq?UGo{R?FRM~T2
zSvYS{O|emUK0uml)_Oi#@;}Y`5;hTKP>V^@2lVN<*mIkSIJp{3$f7??P09R9Muuy5
zd~D(^O$|-kTAMq1FJFH7(zVyF%_5@EK$cF&*7M=-%zzH^px&%}-l0Q>LU-=m8HN}c
z8HtIBi5oMUEoYS{2v7r1kUtbqBT!<weED*Qr+REw0Enm3q<y!~rY-4o0G<NUitI6!
zCangwm=4qlX=xlvR-KZRN~sCZsMGj<aS5>$ml`MHvyvzxHHKmqBv9$b8d1_$N5w<+
zB4-N*(iTzCZ6&mDtb^9QayhL#wM<-dsFO3qf}3)Ldutx|@yH&iA~ab-cFmw3E@gi&
z&*wvrkF6z?xg~?M#mf)06Cl0j)kVDF20I==s(?7)7#M0$`$4;HtdTm#8UwR#{@FQj
z%g63f-%)gXudAWmGv)_!RW$J5%ND}DvP(sYo-qtgXr%s26O#Y{AOJ~3K~$bS^|WYD
zEiE0Zrpx!$@x<~qFSgL;m%FL=L=W|ySj-c3R=v<g%b#iBJ{^TOCQ;57H{3A-uU-0<
zA_41N!AJ`g_BE4xWi3TiB$GbLDm3O03O9z4#bOo~GwgNHB2BZEI|AF4&IV)`3tHz3
z(tn!urOBI#LdmG(65=U3HikRrIU}M3<Xa@1HfzKOd3i-Uz&V9|7Y(p;1@UZepX%T1
zufOh$i;I6kuQ#5-69lO7<nclzCMNrV8cj=<EnDW-rEU(P_DKh3&B02*1LcmnxH=}u
zA4+x|0BOFQk&-NefLZ|5$=(wdV4azg!PdRR#6(I?m5X2!)04?iWTwnTxm2>Qj>-pH
z2(~?xmuGFuqoO;CXxaX5T65wuvFgZDYI&eixJPo(rWAu~Mb=;yxwjSw_b@bRl#f?Z
z&Tut?GitOub&q6G`y-Wf{jnZeeX@tHI@&?q6E)N^R?qr#`?wN80UZ?NfOFeeqrkCs
zyjir3HIq6zMsZssjxxNVb2Grt9hK@wwWFkak9yNm2LAjp*1c63xxa+cHC83&Pt<Tj
zsTKQc=<4TdX!W5+vFT_l^}}v=yqgA2E}`Dz%W37lZfd@-it=~3<taEj3Msw6gghg4
zl)tr}T>W(n=<<#2l-W~Ek}HblIdv#t5qiCr?2?7|YP>}(!fbN}l{>hgW$q)iW&^gF
z91j;0rvEhSOVhYMqGMw?qmDtV)2JA}55rn7ovE&<-85H@&L(r7^s~97+kx5hR1d1Y
z{`!&EoiQ<SkA;P4&)|hH8qLtC1*V>;K+QnA`s%9%dbe^Tqv?ShRPvZjlmF@b&dTlT
zUerNAEduR#>W#y|Y&u9r4L}PeqXwu`Q`32{KzdS|NK0goH40)VDJhAPQj$r^wNXS_
z92H$tO@-_0MgBlNPhQCyDWa_HE>U)830-+$30-q=1r^@t61hXU+#xTmzmR>{?yUuK
zMh!4?u}hu6;99;ulE<_AFz;~PsU_mt<6Wpk6rJPs)Uv0MI>tK#K`s2V>K5<i7QgE<
zkOAvvY94O}td$Uf;KuLxHYELz4CMB)4(jwp8(b#B=Pns#|2AjUJ!1_BZvU!|#n08y
zWiQmx$|KFR=6IV}f1+J%I^IFO$GT|q(QaCMutO|<yqc<adPKpFT*}*4AY9wZC~Ipu
zWe!(R{<c=i?X4&Grg|z|-zc(|mkC>O9EHXjDcqqKC<DjtKCG=~ok<vUaB|qlXt9$H
zrQnk#4<DqxW#NG>OJ~|No2v#p-R}om_kZ2`lE3T2Pos{CiKc|4L{<Wv&PXm+0?TX`
z=Lbs{E#EX9|EA;QT=_fWzYBQ~lt0GDCqHg9n$IAchWjHSA&I~8<B7`~iYW{wc&K}N
zdVCvraDJ$=>p&n+t2@usNGaH6;0)n|vl`4^ecdmEo^&}Si386w8HFvrkU_0%DnhGP
zA|qM$StFd8(IjO!gtIJx%GWkg*+4U8ZYrX}o2x0cKZkNh+*EZ(71i8X!>*8wUKb<{
z;oe?B8AF&RUWlF(TrGz}jGUnc9$JeG8$$$|9w?)0Uz|@HURz36z67sx4RuX4Qu}xt
zHScLtHW3Am=b)`b8+Gn&^K*sZ_O`KBFN|BMalD0^$6NiPbxe-7@iuB1ZK2jt{vAFd
zTJ|*av3*YqHOrR;*5b$C(?o4g*HOowI=Q4B+4G(nn*U6tShS~_mW)=>vhivjj(hd<
z&9wHFW?Flqg*KdOr%kWUrwu2%Y0c4Yy5{*#TDGT&if_uIylvU6>!SdO2Ph0;&~P=m
zwl+}7KnE3WXc2iUYbm-eoiuS_s4ygx!^njykT~FS!hc{?_X5%e$tDZ{wYSN9FsTEO
zQ2I;EA!D5FeLkv;^`B;aN%bv;OUS*hw7`s-_38LH?!SSGL5ugkR>^Vp@)awGK5CYp
zH-BgPMfJ~5pFSNCAD{Sy!C-n1XCZ7TD)u~t4DA$3PEH1>#exM3d{uz~pboZC7$|K_
z2Wl}3Q2UBw0t;QHu-+*!7Bhi5B_&BHpjJW+YA>vX7t{ivRw6DlnIbde$&g{ExTXv$
z-O#|Bi|)ZP;n|L|@FIbcSq0lG1WLd&`|{AnRG_y<`jB@9;*c^`yn(U@>&d;Xo?RgL
ziofvbMy_&P_v&JC*+CvYAiDRqQ0GJ!wT*TANfrT+_JX;MAu7YUm4U0i+%(>f5CC-3
zSPM0dHZy#c0H|?4<#Ch@8*8w$<Ukv>O*B!<n5=iR_B~cdU86MufbQN?Dds;@PK(DX
zc>>MV&o$7sFEsL0oQ*GcQU9rK+Kd*YuPmUAC($RRjXEAHr;^)qDRXNo4--ab!PLzj
zk=0j%A|L@L2RzYvy$zIibv;ElXOYnpL7{Pa?$x1}v}Cti1*!_oMv41%=*?DvPI%s6
zP$QJy5CK_qFi_7XqnvFfdOl8y|5fWtlR?e;b6`dd=>r>zPyhgHFifk}li6tfV9ly^
zH%-UCImsIr@^4NKkRbOxapH7DYHIo?bvncQI1}MX;)Q@c4=+Z1e4-E3@KDd6Ki`*8
zV?%KUP|s$wFlh6n=`!j-Sz`)K+E3n?CPa!1YJQ&H@IhO?uCnU+XVwhv#MBH*$V?+k
zN(AY%ER?;(LzR6E<k?(K`E0#Ii_$U<^p-|vJoKB+8Y-sj;bI{V3BU$qHG>*0H}iHh
zQ1-B!YIc{>buTTX4JQ}Vs$<<;q1QE9$J%lGSchmE?^Jx!vJ|1R<ptXI<g9v9FrZr|
z+I-PA-X=Jko{(YOI@-j+CxSgq)IQok9eWyZ6rH1u)HYs2&3h`TX-^rojaE>{XeD)y
zmQ&YQ1<fBTr$rMLblHJgy6&ZB&Xza7I-fS5?4pe?chJUT?PB1irL<;$H(j--nR*_r
zq4GOiB5Nd-GPY+@_RaZ}vAuw@x0Uf&vcjQ8D&5jTr5hSC$53Q1FQLf7L<&tXa26eA
z2`8N)j0^@HSu7U*Jag}8$x7i?8;90vA-%<`KL=>hbF|-m6q|DA1HymG^`)6JYN1TM
zRZv_1^FNFfw?c6(?(XhhAQX2f?i6<|UfkUw#a)U+afjgU?ymXgGr#9M^IYWO<RUXU
zXV31wcV8k$hIscT=157EsccCV^)6yp>A22Kq?uduZ`%XB{BeUysE8<V{eGg=&GG)S
z*v&)vpY_Bk_o9AMR?@Dwd=0NZq90*U1J;=rJ-u}>?`%hYSoq(D2A9!s&+=86ZDGm%
zf|btghDEqrRYu&7KRoD`ur>t4A^;S)*^jjMdK)8)^U!8F`SC3pcBi0pHG8v3mx%0r
zIQ1DlmFG?kbvAWHe6IL)ql+9G!^v8iZtGOuFg7ZvnBa1$3#ZPGUcO+Y-L@YeNobAN
zDdvqIkVgB&m=mwn_2Lf>6t`vDmmHYbn8440){NoxKbOv6tBH{V^?>G;@<_dPWtcB5
zR?BKraW0ccvtl_#_aJUvR)I&*_T^T0iAzWJUmAuze8#ei8IC$DBW?pPV5sn(t>MLi
zs)=o^$IObULF0iHZ5-<^riHA4^>auS$lI1aC1x)wc$;{8B~z(wRhZ(iR3fMsHC;7Q
zNmC_&83(fStmmHSYbs8*3#}`T1VymP^7YR2>NL(t;35e$=6ZafCB~4GSk!$7YKXvq
z=s0<@Cf1zf(T)PoE`3Q*4^e6rPxYp%$d)9f;cSd#NWza<Hhv3`vuAWe2bskGG%frh
zQd#5Z^#(x>yLP-ktTsa^Bx5&On{P5Ou$z$m2MK2AL|Bo_WaZQ$v{T+x?vveHAzZZg
z_r&iGiVAZ6R2&@MaqFaQyaECbZH<k0tp5gS-Y_!|IBW*)q3P&#xxb=WnV2c*>1B~Q
zS?-3SJNbM|<g=IshG^g_YnbE5D<LEa__oj!aNQlbEW03=(7c8VjA?GlLVL(K(@@iv
zUKy{Y-+3ZO&nI>AWk%IhVU;}DY-mYWGpA7a)MnR*DM&BGXKPUM^~*%w0@!Uq)d>Q9
z?;Hp>t&TS-Q*N_iTHaRo2|RT_jJWTG)Ra+V_74=7u+Nqj3!k$6px;-B3T<Jk(ZZ^}
zXAC=_-&+*cUq|G@-r4({=$JbA{0%F5KeqXG<o!45Z{DA<<lZ`C6`cFunsaY66uR}@
z!PR`~DvMnpg+-E!e4<$QnUmey0bQ;#f%?D&Qay@=?he#`oPQdxf>s}<De69H(W4H^
zB@j|A!x1x;iX-X1gS(n$UKVro+6E3$b!UnCnh|Bx0tn!2iB8~5QXDy(I9OWZ#RHqc
zBrr?V?-fQa!!SZF$UB{y++aOI;{+1_VDo9RN{W2_jPP*Q6Y%hL<?gx1vKc-6c0vgJ
zXE9AZUWVI>Er#&b>Zg39{@sp~jB^r=+5FJ}s}6AhXO>-eWYq81j`<Uz!Z`xNMjhfW
zxDEH$t?8}yaHLb_5V)S{o?V7_FBHa`^Z;kXq>o^jJGQg{CE21an&WAoTL2ru_@x5P
zm=8_ToxhdU(<@Kbt|K|QN#(Iv(I93u1|JF3$=;rNK_KBmM`|jrQ8TLNWW3JQD4B5R
zUBOeXU$ekIUka}`OJX?TUt}PTb{S1s#N8hDHXJwE^;_rTb`kH~U<>+aa+3|Tb`gn<
zx;L?H$z+u0XnSe)4KD|f-lz39_wk*0TL{r;e@cQOzg~il7T`kj2t-X$B`OKpFp#T=
zdx$`z6||nm9LK9H88FrOQGhpGW!h9|-jOOWWRs7Ca+x4NYlBq%8Ekb$vO0J=1=oX$
zFRC_{6)>FGE_3<`CIk`p_d?Wj5vp08RYzv(c@<8&Vnl+LmdGkywRd&oLicZ`HiNaR
z??mfY-w{keIPi3pqFu?5nNc53X4>U>DVz$I>if_b@W}$tOQxRAk}ZbqJ5xJ``CUnJ
z+@hHx{r(+pWML44st8DIAj?K-gWEiLEra?usi1YC1f+*mDByuTKF2j_T$bZF<&Wke
zj47TY@YDqEoUo;z7jx>482@UQM6cQFCE&K4hh7kL+}!<hr*SP>%kN?BS8;X+sJ9`t
zVO+g<LpFr6@iF@}Kuh~GOD#~>OO&!`XYX;%7_)%<F9xKd>NG6hbg}4zwG3K6rcB5S
zy6G6`{=P<r=MBr)k9;%E#qmuEfRNZgj=JrCD$9yq>leZfi2i1-EKWEYwK|v#^);<e
ztlN68;8y8O*EyXhPEx<0$DFqp+RYg8T2BNtLI%i%-PPpZSW!*9kx`InLni4CtR<#z
zC4YsVKJ`aq2oz&nT2O=_=EJY0GU-StDJh8@d0WyepB^FB>)=;H&r#)gGoT4*KM19W
zLUijz%H&@yM<NZMD4_Q5_NYeX6#7)R>OC4}9E&iUg{V1plIXtFX!vrZZP1oNn9_)p
z)<62_>KMbLcoySr72A4TPsghUD88hG<7)~6nAh}d*za}sV#SK8w+h;-6Ml?tWJ*WN
z5`ChIi>Yy)efe_k`o7HrsSqdz&l0rEqD%6^Q#`7RK>{a)HKo<py4%9v54BV9R-9db
z_q!O-`VQ3z5O=1X^6Oprm!=+E{wd03Zv%&|g{kMN4HMjKEAKRy4?&Pxb?CYt!~tpu
z+f?-z03v&#HRfqY)3LF!Ef3s^+{=Q{xcTqrIic$A(cuaXET2OKk*6_q_fYr7Qquc@
zT}&n8Bm)%Y(~{Qj&wHf6{KQ^whE0$Z|5)@Vg|7a@32dyYGB0<MP#v`5rc8O-3^`ja
zK&!ZlfB~O;BGovq9lk;~_vtv#Y!=itV*L?`**yO*4M)nXUK%C~MoSACMzKrF?)G>l
z=Vs>~{rYk6{HY?tafkt*VSuZ#Ow7&CH!>MDnhMU~Z<<+bt7pYCzkYUO5K~8o5b!!0
z0=JUdCdD8@M5aJ<>-dEND|SA4;m$$3Y5OGgB$ZM3RIkRS+P<s4q}u$sKG!_jXYs+k
z%BZ2Ms>LJU!qbz_a<$oh7S!XP)K_EV<yTakW;hdW6>ye(7Qkj36A)7`{l-0u{gbBe
zNXT?vZ!@}HrkmE9nHVVn$r6<up8S}Zf|EL0CT~R&eC@bdlJ{|_0x^yB4)1!s1dHeS
z?B1&D=}o=F%^qNPigYY<y#nX+9qjDxf|gb_RIYi9tZ;>s?$}e{Nl-@{MvFttK{f!!
zf~CjFHu3LLef)svyC+YDXr=tdU)UFo)XS8^`1@a#e#h?UH6Y?d^ZS(~i+oMvm2{CV
z%0KI37(K5jY5Wj^0g^`+-yJ0R=wYhhcW)0%tlZgP*z+yRWEq{8qScI-xzXay{8eN8
zccP^=&0WJ(SfO$sk&;g5;tM^LBHMn9{2NAaO+Kv?B+h7PSGLdUrW}P6-flIZc+0Oz
zYACiyd|YrE%TjzA$Gp>*Nd#GAa<e{uE=D;TL+r^Q_iNOs6rPo^`rY^-*RbRYjMlt#
zEWlAoRvTI;EpKN|Dt8#o-#I5p=1rEl=p`N{l5tF;APo#e;#r<P3okDiQ|oibqmJ_=
zqO)fyUD_uwE03a53QOR^G~t>mC<8<%G+I!G;EPyZ>>G0=nhg}=d?A>CYKiQN!8*1_
z=g=k=5*RCPft}r(7NC=`EJN%Jc?UhIIM(ZpZ1L6nNQFEFcWXaez_BEnO+bu*NUX_u
zL=<GX9>^s^Yc<Tp#wP*3?j)P_=z4{HnTgvdy$k>|Ukt^ucpr&Zp`qY~eeMreZn!nb
znt70wXMAs&J9{gFe3HmPSDQ3d&mMzLb2VrtgGRq5=RUsSIlKfZId^I61G+wSroAN|
zL$H0;x9iU+O}g(G#;U5BZ;a4A67^dXUwi{QdqRQeRp^5GuaBaP8-9<%eOFM#?2^|x
z9{!`S4tlz)eleC;p6Q8Ddb$wk`C=}OWnMHcb75vCAsL&hh)Bv{<z%I0f~rdW8XO}u
z#+?k~XUn!elpjrZz0T6k^(v+qrFs?qiz@A!@1#D%5aCF_NAp%%n(w~8LIZ<?iOjPS
z@JUQ0%OtAB4La6_jR{=*0;;pCfp(eB2%}!kZ57=LtuGbYH*%Z0RI@V3bhe6cUSU6d
zF!$~0^E;q<HGC_RanE(+(nMQ=t3BNb3|`;Nf2>Dqsa|eZ{J9*~XgnU?Z~Rzt*7fk^
zukvbJW@Y<kJYOe6498L<vJ&yxHkNxP(^P3RVPU745)Je!!Fk`k#PDKtlFuA2_~+7z
z_nyR1EGv#Bf1@bcdbe(%@u6e@#;>+!X;VDyyubL~{lvRIh!8S(7$s5!S`AC`zw;;0
zrzz^_=_m68#EvCHVK}Mh+P2kWhSzn+{90UEKnZ2t2||8KeGP3vx-3Rw^S4=2${Ntp
zmj9AOW+hA#bNiTSBnG3wuHFs*T#zw`Q!%$K5W;6;)vv`Wyk%XCj-hCWp8egxbX+Tt
zHn+^*cN0k+y<ifk8jk=dB4l47iWkmTt3XLva9olCzf?KSLBdJ+dI1BRH0e+G55W>F
z)BXA$V7kE+Akwk6TW7O&u}mj!zm=I-%f=jfjD}q}k94#FAo)gf{F{C4>hK`*fJJn`
z)Y$kdFALAdoMy$l<I})Nrodm5c|zR=cVYXLHQA7me$eV_+-F!=$-){(6a%mQ`FJ+%
zz|C5dFYj03VETv%i2Zx_bW8U;iMbG(isyB3rUeu?^nY^Qb3rSPzcd52yhjPbT$tb<
zVcqiIFw^ZT%+a~W=QH@V@JHDm#u{<78J!0Gu&}V`XlTMHC@DuAT9PI#C~bd9Swu%N
zB}#5FrcRoWD<$Vva<dD4!pol|y$i~OP2&uM_@ErWn>(j2Yl&S1!Hk}Js7;FT;H>G(
zRg<tVZ0LM5_rO*=ujU{vTzv;HGe4W582rr7((G!DmvuH#-hKIk!mcB;b(3j&iwPt9
z@q7*UBgc17>~)@7wte6)<vN#>FOoffbMi|pQ)vt<b0PPX$DGD)RpZ@=Kqfen!RE;m
zbN+&*aC8*~xTlGM6ELnM&FeGVNf}-rHn-pH5uK$U;zbdlNAEMpeu<d`ntP3EYZPp$
z(KV~7$bXA*Q)i!6PU);lcG1X)xEReJuKZMAB9p{EDYK3KB~(rTncbRx&FpK=$S^vZ
zFAokta@N>dvOdYsS-G4+-6*eMcYR<I9ySMyEJbi9VBjTD6!?AyLEb9IMvJ3~`H08x
zl&uLVTFbV(ufxBr9d^s*f&0?_Ep}hiydSi5(+0l0V~G4a)0tVDl_4+KetWIZs-doR
zxg9i&jUnQld$}jFmUJYm(rwA*aX6ulqcsX^o206QKR$vOUuR9m%b1?@_3cy~T1)s_
zbI1o&)HoKGi9Dm``0i`u^7&td;tlkMgdZ(i<{gqZ=e>Z+j_0+Eio(hKrFvk|o_A(s
z$?(#}VgtHg*U3K7+>Gwdbr1L3YvkkhidFTLmzBw?YihpqAn^`iOPcvfvx`URm7aR?
zCN=aUm~h*LSTCNSdJ%fQ)?bUISM(C&;SFWDsH-PC3FM$!Rp1y6uvv*?;bukJp$nR*
zXO5hF_4^egfi*$lBMrT8KNwaZq$A`3mEl&xS~Q8zBBQBf-S14##e<3Bx#LN0?$}E_
zAfZ6^bBz7>$nr9U2Vb<%YCS#pK!3EmUpln?_S4_%`E>&srAIB*Q^_XKN2K?OZ=<TK
z@PgDWnQdvcETQxwWenf<Ls~+qq5gZ&2Y^I&NYV}D8o)ijX&|l9t|0w9iN(;_6cOdX
zLNyf;?hJ3BKN!0~wJZroVX7!na_>dg$(qOUf<jl+9l`zB81zHof-ygNA~bnHPf90C
zF|?v45&6Ytq_b2axw@vTyeUTA->qrb+C%l*Pp)INyV}Ks!9vQI;u0^5DlwX>7W@LT
zu?8gSwx6ON?p!*d_2h`!rbW}n&9C>z0P}@69ZgBds9jjgX#$StFsaQ@cT<2FDE%2=
zI>;EJd7OI)$DLQKRih(o^n9{7aM*oCO?*6b`KJDM-}!jVdf6qL=k<;j#>!#N=IHBN
z^K@5cRQ6>^Wi}x#RwDH4x8UX1Gnc#Zr%#=(Pe4xyg9)h!Ee97N)LJ6IAXBR&BOJl^
zRIi)Eyx4pl7Z+<XB?LqG4oSfIj?aQJsvY8KgRuI;W(*Q;thwGN*520x{itUJ1y$L9
zVL|B!H{qgh2_kQRX-Ey-%vK6Gx82+t>447H<gjtL&PY$D0OiZnDSCOeVU#z}>1U{E
zb$sOrPcON5(5(_kXQ`S@Pl-{5n}lrnVCrRDT^l1JBDN|sI4xPTF*O;_Bs9B7vb5a=
zMa+~Fvz2q(51D>b_KY;ivp8?>q>95gvF6KjR<>xVu6+Kxhog3pN-=uO{CT*#0U=uY
zL=4&-6;E6yzp~eNl<*F)5FgFad=S-mu9MtBsYoiumdz?e8JgTuHOzV=J1M=fAaR3=
z=hPa0<CoxP3f+RBMC7bCn4iTFegnr8!mp?3*}w`31aR}&$M=U|O6OMwFN<Q!{8)}x
zMmnE-nO20;Va`Aa2>Z3NhWxRdfuXfJakQqQ2(-X7TS6pnx(J9ckPJh-3q~(-N(zI3
z?5Tv0sbG&MXrRT2ChC(ys@xHi1M*xPYq4Rp5t^yd?228X3Gejt-Rlf6z^998$&TXC
z1l+}Izkf3on1KwBLxRw@c0913Vf*d7Uz!}9G|>RyD_O@mA4?JAW7w;%_gKN_hQgU&
zwGL>cq{6=6gxbOUe-CqCKf#AwzC5ir-cGiA#y>@Vse!!hRmwrRA4sY{Rmg<BL8Z?#
zasFl#BcopbfV?>aWJsfAzT48IX0JUV7<2C!LjUq1J`)H7M@M`i-kV*pjb<Yp3zY^e
z7$L8aq9d$A4xVuIr)4|BjF%x6e5g;Ce*uWC&(BL!Q&X$;x_{Ss{3gw;W<58@Cm6hP
z8T^v1!4XbjO(&*BOfh=7eP|;O>*UTyjA|mE_y$FSe>1h$AS|L^iYR!zQ<c22U0Sbn
ze+DgMf<jETQAvmu0T4qoavN-RR#^WowfsJi9KIakhoc{C80b&tmy+CG66M^ieide>
z9KgPhiaoM%N~B14n#w`yoyDt9<8+6bl1Ma}08Q}1xAWIWkv+Vk8&Q|<bbI5o_3B!3
z9U4*2b25LTicUXVa<$oHmN4Y^e#r)Ty^PXz*Ch5g{0SB!8XfNJO1@bborsTG;E6w6
zAym-&E><@|ut%rzm7X<`OZ8Un3#Nhzy2Ao%<H6?w-d~9`*yy%7(|Y5-*oK{GIx+iA
z(cYdz4I{P;Nj7@U8H^E<_=CfcVaNt7mh8w5XI~bUt3*@ow&9voUc`LnfJfS-PSFsU
ziZ8^5K9tozL*#Yv@Mz5FnNW;*1H2`9ZPfk2>~}n7R3b~}BT-ypnP_21SEbVs`yVf4
zD6Z=pD~Z6k{(9%D!{65rgri&pQZoQV>8;rwfm&)v4M?-sUksrg2!#^ovoO(-@*e#T
z2;sTe3c)ai;TOK%qlNqDWHt{GZTRZ9^CfOJ2zKgP;`M>#vzr^*o7>F!<Zc5LyZ{WS
z`(?hy3x>Zqt|s6;>#YImSn^Y#?$@zTR}fnfAP_h_bt<GGL;PtWX(d%TK_20y;GJVX
zaMjNVJ=K6Qu1JJ@%N=e!su-G2a<+EaZa6WN@LxO+)b7{b#{u(p?qG8at3NMtoEi1m
zg<DYy3~TBWAI4$=rmb?rI@~=5)luIaoa08@>+SC;0t_<bx|!1IYZ&r7h#3A@sTI*J
zEs2F@5&kJ|iHv$Br0Z@8bM|4Bk}=8<i&oKIS%cNsBdFYaj>_#-NZ?hMeD0rDuWgFG
zfoGt1%-8jd^IdN!i4t1+xAuJiFnB=r61VsDCECxJ<){YhIct<Yz<>a!nz3l7DMkHn
zb0TsLE1nl)bSMM}qTo1Hwr7DStx+03gCl>N_*>!&fij^FqBT=Nae~B5rI8gia|Sc~
z!mSbw!Jv0%uA7zFv_&-4l7*!VEOks(t-}AX0AJ*3P;|yMP1xmrUG?ft)`pJQNj}xn
zYHUXtNv{%%VId|Q`?D_jmA&Rbn$^SRuAL(Id|2_EjEtDyx^(%mzjsvik%6IvAgDXM
zt|xOy5}7Uw_=q-Q?~xs%p%WY$c<kJXs`!MpSQKuqEqT!Tdf_u*-+ocNdbt8&SV2_8
ztjx>=2V@5#A<(O3(7$9P_<NOr7d2T2&5K`#wqmCu3v&5Nn;zhh>}JZM4M>b#U-icg
zFF*83R#q6tGxr#3Yk$joKeK*;NZg?zLB>jE7z=;cQy!0IcA=WmX^I|#{&sd6U}IxH
zQK4!`7U!?rxXuo$FNT;+__M@7X$?`?^Iut>Oo;Ju!!%j^I;qf{-a(i@r>ONtGij0f
z@g?ECbGr_U8f5wXI8$Ksw8~hJuo#6uUWXIdrl6WCF-qTA1IVY9GY=pc@SsVeF(tL0
z?UTE#OK4!w@l4fHyVgKcZzxv+)m-MUpxLW8)nzE~@~YBj?mlWEdx-W#0|(vu+_a2B
zFA+Pn-LTs_agrO_emnD|smTX)(p^-Q1fy}Q*LGz_EiBaAsdW|**hXe@PpEslG4C_e
zV-nc&V{2uIC9WzLjOfn(3;nMBOZ<r9cd;8G-CAjxQ$?(sMaaCAOhqIWf<p6zT^Vfh
z_SUpK*5j&JZ`97@)>J+(HeFFcB5MVFw#FoS%IyfoctgC<!A+AN&+?{z!z|=^TYkKM
z&BtW`ymHtKlWtT((B)Bg(7C;?&|ev^-^t!S&xSwk*Z5CBAt**Gj^dvI$m3f{1)eA@
zL2;rVRO?=c4ncO_kDW}MC~}nXDOEBkiQx^As@J<rejT@yf)7F}z3Izzeu(`KUsQyo
z5pw-<FS-szuD2xfjAICOk?)QV^8&=bR*({9<=@;WG^av(#@kYIjuQ-#r+7#QOqs7X
zHFyunVq(vp{{CH#A#6_L8f?ZYO{&0D4htLL-bA{e&W(B~qs=pHAbffPzpS*h_~hpk
zC9x(~%%?nl#LAG~x3zFZXJ^<Kr*Lun*~;XWj^E}OW|bLHgB?wBTf-$g9F?6}(ffM@
zbVYp|3Jia{l8McgXQiyP$L9GYmW2y{h9%Gp(%sSXB-Uq}{p24p#AYnCO{DMQPulV3
zklNX?Q_wlUB1k(_d(e<hZm<8PznGl(y261z<+k7FV!$8kOCs9u=UmNFx>iz>+*TX^
zeMK01Gg*nf$$F1Y>1(uL;_nP}WJRv;a=*pLqi0pEiera#tnIcbK&8^%mPey7L;>*8
zs!)Sb)xU4-z5&E7>^O!sRo@UKz-Uz?61wBfx2ZO_0ZeeSG)Ng-mMVOs8ozFUd^q_j
zGukJQG}<(NU2GXB`jfJAosC^?FM!9VKw(xnnW|P1YzWCgcciqp;nY!k0&6I(>rG<=
z@CjI#@Dy$If#-LvXcTlCA|TN2HMsNkEbMx-M<2$ula%KRPryxH)b-dK{z<#S3{;27
z-dD_>8}m~p?xi?x&2BMCrt?@bTjQer68ieBS2A1v@~@im&}GNz?vlQl{HM>GoC1@U
zk+n`F^9$S&Dgg%#cdMK4L2CY1oJOxNyrIrv{2w>+!P3&_MT3js#e3>OG_+Pc$;nhL
zQ1*_Fv@NR>er5B4Xuqm;Ptqw?AG(<-qi1J1rEPS>gx>Yg3-pzh#y+2{>hM0oJM1RO
zJ2T{IPm7Pe;>azXDVGp?@{naN`+k0B$qNZix^pKAl{y;H!BWAQw)3g@WEMBxD*?~7
zMsg@-aOM)!^H+;c8_rrByM~EYsUvLF)y7_c+_64`ZrlQQn}^b}qE&dUy67_(1xybn
zdQ1Qx|1Ws8X37I3B{M|0UtoJ>5^G}Jf;wCIUAAeV@C1o78O$HN-{}@wGNsa`3!S2+
z1V*yZ7&ZAhGl|7bQyVOdyqZU7psXrpXqey`$;V~*zsWEv;zIFASaY5%epzYf2i~0-
z^Yz08!{Akfj`LKoT0r&7K734J*`+PC<Ziw&#AK4AafW`Ei2W_VyLdha#9?hh2E9GE
zUA$<(<PTa<cp|Xg8*TWhh`sQ=x3Si;n|=g`GQG0sHh%JPcRd^a*(&lcNyR@=+;361
z{tX&uce)_$)7kX3>d#`78UOgic%~3Sl02d64q1uA&>RQ{mgCSePY|(zhrB54?dPQ*
z2BIAc%+}NL(vu+rW6fTJl(h~VI7syQc<T9Ea56Z{@dM@ZS6}nZO{5k!Kn)7mMuY?V
zxu`5L=}%KrinEIg!9N9elxc?f$e@h6M6`+m(n=}fz+8IludstBJ(~z=$X#$-N)nQ|
zB?XgA?yszLV*paJ&KNgkM(ZC<$!obW&yjl<%=;YHH6rJD^_m8#yb(}9lWoTHsv^*X
z>#WpNk=J*+Yz%CNz;DL)64MlV^HfJ|GG;Z{4hid60u7o+<GSA^SdV>8YLDKl5q|X~
zsK6&Cz)I6-PeIg7kiaBeh6Jd3S(o?@3BT}mHb%vtMFKgXn2)cyuZb(4Eoq>17t&#~
z9uS5JyP)#t<7LdrcVIS#z{fF-|0P(k&&h-o4v@cSa&%NRME4UkcR+4+yFbqD)M-hn
zBly(=qUz|MW<d7eIqc`z6VgfUW<Rd599evDp5T=biT^cX1s-GoAnkGX!RJUvL9WU3
zrRXfdYUo;A!t9JRRix{&^HTmo|FIwP>iNkL)E<&}K6okjCn)Vkpbf-r`mvs`f|<@m
zuZTZ6tLkWk7&xf{w7=E(y|`UZs`!UR5kq8}KGFhtLK;xT{PvE1vcm%XlrpdZjP>C#
z8$A;uHQ~BQn}c~Cw=)QCHLt-Q1_>IBL8s;4GC1w6_VE$O;+a)~>lGUI0DfOV1t0kl
zx5KD!X7NrHp^Y<G$1Zm2PH6f>8Wim{a#w7DCOv<(^IPGFqHaomBoKo7=Jb>_V9(9Q
zTj~TQZ0Bwf(EO08qScxU<Z+uTy@-&!h_)G_?(-fG-`$H@J^)6C7e5cn->JfyW-2K|
z<Qd7By^YeTimq~rlZzhfooCsS674ID(IztV4$56EjB1&jt980BFMCHKqV<>p>tp)u
z8c;6HFE#_&me2dlS}Mdz&V<#vTgXOUMf)%HbvM0DPG6~HYDB6MMWmpBemYHfptrU@
z%XJi+>%rrx=&7!2erU4$OUP;IW#e(PP^I&M;Ce?<*0;K)qNXbholHalA<rjB94%zf
zz{5`;3e>XMM09|*0ZU9u8pMrZc+!BB!0s&bo^$Ctl%1LF-)(671QkF<Od54pcl%&~
zYSSuu^>ylu;MN>eWl!>!hnw%eJ*}91(l7c1$&un>FHbjGU4!lUw92`esxJVJUC076
z_XK9T{LY%RfB(FcSKe~)5^j=B{W0@EZt8A?XcUP8m-}sl7aE}1bLLTscGH`oY?Qkr
z$u$pgbYK$KVFa0Anf#=Qa#T+90ho&Q<fEE8DyliyM}1pCv4M``dYc~xqIeV02WV7H
z8@o)BD!^BK!i$_H0>Gc%DWE!EBZOq~F7DYaSh;$NS3>#RsKOUgurGbepDF_4|K@Ak
z{+IuSrU6}+WBYG0-bN8?bRI*aW;B4q$-T>SHR7ch#rz8Zo(oJXL1+9B29=K^2Rj{D
zZ|1?49Rm0DJVnF;B`f;nV+vCrlHn%p-~XI>;kSg|{M3${Nkb%Xg95&D*oYAl+(Q^;
zaldunu2lk{G2n_ZhW~jzhaR=kEmW=cO!6Piy*`qD_Sk64+A0d$-CYoLuOlIRI6Pl<
zEVh!xwgk<@0#*DErY$Q`PsZ=gd?4$;$*njI4jZ$X$Bjp*5Z#gL`5S}}v21D%j)vu6
zm}}yC1O+;BKL~|7{bTfx3Y-Oq0`LOhIhc+|dTIROhT`P^ZMHmREJ{%-h?i7_el_f)
zs*zTGuoGbv4|<OGNlCq(#RBG-Sk$cHIq=0Cl!*u%TAEIOdGh^1><|?@(bfkkM0cUE
zO<?9UOLGsSO+3LiUme@grr_v-3DW)bkJ7kWSvb}v%mn^GPgZ2S313FBjgA*T|C&U;
zqYvH>EXwxN^IhCl<xv*#ZZKW$w@Vy%K8T$V=i?3z2N-FYzjXOezb$P5NR8UMVa!5O
zLbxq8o;WP2p=^JhbRH~{iDtomV|jTENZ5fKAh#CFpt&8X%EivdfW7E$-FQx)No_u*
zhjTc~^@zSNvmRX~m<F=mBAD+%T{TRJuo`-Pd=|c5N*XTZ2b=|0zQh`M{EQiGwilH8
z&6)X4cNf9>T3#hb#BZhad4Sd5<eQRmH>HsJYnP!T_Vl+}XiqRKM&#>7Ks@zlE85YY
zKQ8?@)Zdn>1pWRpJ0KKqzMm5Cc*9OV6_E!K3qNp7$h<%Si3kbb6nf_+p@IWf(xe%?
z$;il9LDJL;bOa4A6RPcuS35rav|d|i_x=M&D^CV!b0}|tN^O4%TT!`Y1X#}KRspir
z6Vm$YX+Eaxucho^(XT%FWZaeu13~$vJKRde6CO9a<D9l5X0@MnoprxqnsI4&E|+H*
z;0zn@k5KWLa0vY42dE%FP*z9=T@}Z3+IJV}B>HVTKQISe>G&taWtT86wmo+-B;Whh
zHp?m03QCP+noLLndExi3V7WsCukIgl@kbV_mizY#yTF`68zuKuc+Fk9FIPAz1yinO
zT$NsZ`!^BRVpVoD^&)71?vLfUop$iG-^*^^hlHr-sqEcJnTXO6T<~kC?S02jMC;w-
zvfKin%dR+5&n@!5?+*qr1l-1GWhDCKM+jKw5m=CTf6TUcEeb~`ssF*LnwF8f>^M#E
z@hkDld`#16u)|{$da|(YOQe#t7|~)LL?dF5_F={}PE`IGP8!wt%*OwuY08Nc%M1j?
zJ;?+<H2O#xxPv+lA<6=lV8Aur-{1QKH0w=klqdXclMP`9YybTTs(eaSJuj;t8X2Je
za4fv6NJwNy=)-TJcar_|-~_N-<@}a_{y?66Qn9Q~Mun`zp{igTOShpe+2$9TEOJ&*
zc^=B-*2<<?Q4{t)?yPx^VB;R<$x>4|{Y`${MZ%p8<?dT^_-g3-XYs@tJvmeM#F?lc
zn6O%k3P(+Lu8C&9??zC9bltWFvlB<kgZJUZmd%=d_A#@eFwrmF_&c%!#N(nIE(Gbd
zr;A4sEZZ!@c}-J4kG=u}ac@E=7}RC?)oYqGNN{PFnUpuLDI~2HF2S;&dLdPPA2C&R
zHzFfqx(t@XhFwDjEfQ9qzUTLZlpPgC(MJ1a;P8l>3r|i$#so_oEJE&=IR72?>mEN0
zWFTJPV<%*44_#e2>eCw>y2hZzkq#E*=ea(p@!e;HcNlN{F%ktIGI>R&TSaR4J;;X0
z)qlsx_nM98Gh8FCemF!*in9nN!_7w)FHdLdqxIo0(Z80D^G&!lvdyOh@U|#%7KBf`
zkz9?@gAY|*Rkg1q?btvOG%5n6^XI@cP!0=L8!`j55xqQb#n@E&bJ0JAza|b<5oXfk
z);)r8!mE=LittA+D~5$94I}L`#BAI>s*n-D^nG%FjbK%X!k#LQ10fp9CP*hB_d|D^
zu(Ai9G7P~9snr%J)rv4iSJWQgH^)@WKC!!qA)I7Su32w=ZWi<jX6fg3L@rfykdaFC
zG7C1KLU=I9j}=4|wJ{-?k|f#Xkm|(I_zJU_vUM7G-S!!J$c0v)x??)!jOQ1HJ>p&L
z;5o9BJ#Krgj&FW0@u)57bUK1lvrhIX`_d}})5EgzDmt<IUkTqnRe`pFz;!rm!kTr9
z9)dHwkLe$Ts7mu*-|)PQF7&_;mrSsE-uK+iFAUxf=4nPF8tbebR}>^mk4y-}?(qU5
z`~ot&uNe7+#0K(k`m}>i{o!G3??hy)bw&Rc5AGlmsF9IzG3&MqL?4xCNYqKnD#s)A
z$ypiFI@ZT~qpoVo-Yn)N7Pm7wSt`}pLJA6U`xqScHAlmIHjbyI6IspEJ*ibc%uZuK
zo4iuCnvS2ZsD99D(DOt@MQzjX;giM#?dVF)ox-ZaERBsqZ#^3<Uk8oOuJp#X;&VRv
z-qbo>nb-6OMss}Q;SXs@KgZs78l|4Z#5yLC;b@Xo-A=V>-Zfb;nT&;j$Y<=H(jCia
z#>hM$O=Jsb%T*IGN-u~ZjgenW;PfTs$!fMMS=|dv@}&$uJwefT4(%^49^(PSq<DzO
zM@wUSz6okG0`~h!_HIJCcwfRj!K_u_M}tiUT1&NRGCn>iC-`C<0PHj!xomJ`4_GaP
zRH?%b1lUyIUH2riCu++G3wNK6Jtr%=x8;o#@*oEr@f?l!k@M4wFo+vJ&{J@eD;3ii
zJGsFd$!>8_^btbFz5ScNw@XDWs4Qzl+)k2}g<~1b#!8u+5@+5T$@O1-MvQ%pIPgQ|
z%kVUlGW^QZnS$YdN;L<4d<kqEF~-~wm7DaBr{A_^%v`}|f>A-HaZb)+G%ENxXe>rM
z0;|8R6-G(P+C7~n?JX{>LA_+RdDrGIXW=80JGV<fT)#dBX?e6O#O+<B;`bt`+L;rF
z`1osk&AF3i9I#92PzIP3%L;pS7qU6SZ|E&$6N~{Esj3bE8GsN0w1p1)BT<9kM8|}-
zzww7`5{wH3cS3caHXX3VD#Wep1f(J79arJ>YSDrH{71F&HxN$1N%~IKsI<>Jc;gaW
zat{U@8VMl$$F7~MuEPjN6F(dIS%cAF5a=Qkl0uPP2P0cX8P-dJYh#QX97mq%6!iYp
zv{ha^h9@*nKOe4?VqD-ZqmDysLg3i(@8@?TN$zd1HRp=^f5leFx|+f`hGAf5XNMZT
z^CQ%YaH89~zpvX8MC6Z6i1pD7X+rD7E#K;RzCAWfdzpx$pv-^h<5dU9;+29kAYZD5
zOg_2Tw_cFgr$4kLn!P8@Sba2TR)k-?vryq2ZJr<@BLkB(up(BIE>ABZ6M<0_0^paa
z9i^`L^a%vB1<_jz5Hipj3s`mI$=uHT-2vOI4)LxAvB`>_K{&O3AsKKDAo;t3<eEFS
zVL065j*+6~?ijf?>ze<~%$~XI&cq6YFRLK|r)NX=QO{H_NP=p8X$2WYNIVCYi&gzv
z`<_C6-nw-tYLNGv-rG_iv<SX@|1i=8gS+ob0;lxFWG3nn2q&RIOJx$$_1~XL738F~
zfggS$hA&Fm>Dz~dN=vM+x?ftKifZGpE?25z1LnhyyUG>`yDno|T(`ad#og=n3wl>=
zm#sLhtMp0sVTz(>;XQ;LMI7NpMJcp*-IcJ)H;_12bbh>?-iL&Q!2g?65}bhOK&A!-
zK@<IWeK=o;A@W#4(83UK>TGG@y*Od4cF+Me9F<cmrdH{;I*sT`+1tNQxVPV~isZ~?
zsY04y?lCfX`Xzm;G(kriK;9IQa8|?J!1O|?z9<wZiPNS+()cTsBH7cl_P4$>F0}|r
z**0!3^`*Gf;-(`JS$<0CH3sbb2UIPfxY9Bu&M%tRj1XxUqUg|fZnNWvFABCQB_YJ6
zR%1zx<~is3+p(e$n4{6rE!d~~BW<C(u}gaYCjBHUuTVo)cIYLDP={*|LrfQ%8ymJ_
z;JGE+Zps$o524p&wtZ6)ja#K%Z`@m$i^Hf1f*3;YACK<+3@tfbsN!^3|2tp&uT&{(
zoG-ZMiNMAE5CXGQp~{=Xza{wa+Xnp^J~~QgFPa&rKAHYwLZ_mjfC<GNIPor$s0JY{
zycK$_<NtsM7)4xg&xf0`#L=^SEwa$Vci=VEu99AuwR10HTOKctV@nj7p|DBiRh==0
z^{C#p>9-$9uH#mLZW=yk-8Gy&N)P{?iLg3akAUM?T~@1bTI>}d)QY3wX9!S%$o=+o
z)gFQ${oh%u0<8VU_Ly{qQ)KPuOchDLp1U7jn;*?Vaq(cc!NVr9uHebVHbmpGfS2sj
z1?KPLGP}jexRzjOm9rr`#|Ym+E3N=2ImQP(vswK8lyV#I<kOp{daDR96w=oIt)MbE
zOn*51z*khRK{tTrxF5yl*=yBae~07*gxt=Um|1gK{Pv;iK!PkQJ1Lg{ArRz;$;6CG
zI=qOg2XQ!00=GYgPb(lSeeU9)r@r~<_|*Fi3rhYhA3FD;BH-@F(*WytNJ9cc;dB|D
zB>DDj5=bx`$jt&fo1n_B-x@sBtV5~&!bZqMX4w2zzG?xx9e1{=9zA&<2Mx@bjG(0&
zdFlEQ1P%Q1B?->B3NqXOv(2y0({i-~7wFyWXjjW?$79sOvVdSa`{LvaH7d?&la+M%
zwf+ubg*_2}CV(6>qw1?9z+HI}?<3;)=ij)b>sZlUf$xJnrHjSooftt|vu0$Y_=9G2
zM*+j=rnYo$in&Bm<+b^gf{I1c?M}eXGq}?TtaxgqyUEf2A}%%&Vxf^=dX)aDeworQ
z45?w{!9-;$QSWecX4!1Amj}}_$3Z1USS4+v`(eda6<zk<oJGSvY8nC21kBvn+%zIm
z;DZgwDk3>0XRMip+9wwVv?Ih-+mkot+MIjAe$XLeIl&_ulZnDUZ3;Q%nz+ftQ})r{
zX$o5xp-N;~6pq6|7}f<T;xR~!P;M`&z6lpO{KK4|5k}!cy!EI{yvu;ts2XY?e;Gy%
zR24F<Vpu~o&zyz+Ze$rCXs6K#gTKNFC*^{<V&jczm*i`}uBS%7|Cf?3+q>qw-G7YU
zr@+voHfn?rCWcq4>^cj*y;BH{i=q2~!q?YP95Z4AIO);xG%i}>5%}Fs)XntuXXm^-
zuTc#@9f6MI-~hXbKBV>5jz&j4xkN6{P@gsqiv&!ky!=X}bVh(F^=5D&U#X(6g1&R`
zvr=IR4P2?nHC3gvXfdePUbC%2M5^c|Q?hMB__zxly%Jq2{sA}|b`H2!(>0OE*A>Oz
zwQvl3;Lk-t|6f#DU@FLv5D}?7KZho#X^BM%tK{AUZ#UP)3wd(oP7q#i2g5~s_=A{)
z9X}=^cGd)LuC8ly+uMI1&yI?ID!&-V=%U$_B+4!WvipfR*B5hdy^1VfX{K!aSb@@P
zfIJjI83iQ2U%7o>?kL)*lVmk<?5~4X1hK{7n_9@fv<q?|D7FsCz5ogWIX^kX-MFFk
zsS>LYmhpJ*zHQ}y$mN1JU+=pcKT7VI8$7?2EXvy1bpS#LSGcmt0=ZzaA_JQYEk)Wr
zuWt<It{s(c21DPn#zK0dm84AWXhOT653-0M8jG<?DpO0*6H=bonDHV|HfHmD43uq9
zw$w$ryF@%$ye`#bnbFN6Eu(w07G%KZpYLB|IIOY~8qt{vW@GkrR3+fDY(gR1d?MBY
z^FM#%hT0~*oEJNO2T6Po&_tx!{VCb8wH?kr{u-lnYM)zUGk%$4<xH9b{viKf&_@qx
zSc2f-q=(DfwxsDv5NhYEF-GjbPS<_r7{irG86Gcp$7~eHIZ;I}p$(hwmak)K)=UwL
zvBZ((73C*#DoRFKsoBl+oWcz?#kEdqUe?cY5)!k#)FUsvj+@2>b~L4BmdIxFqf|IO
zy4R{k#k>Mbmw%?Z)PyIc4UFJy@<h<Iv+Qq}q!y;wRR38Nv&quQvqaMwXh^nYRnYkW
z35A95M;QPO|F*OEL{QKF2G+}T<X=>fFDCv#j^R-S!uea10cW&yj}d{SzE=tVzl>y|
zZFF7~8?E>me+5mu=m~BXfy>7CcE~S9gbTit3hT>U_ldLD3nxcCuZ3khPpf|Qef8NH
zQCN8RsZqdtgbNRGj*Eq#2u7g)!dM!U5ur)6Ck+?Xo2*619W4YI?%>&aQ9}q3bC8hi
z-$X$}6OG1lHV2_iYC~}`e8DsXxXg?(adsYWOrv;xVcqk96i+#s3CQkptz^msZx(EN
zDbQ01tOnP&*NkT^Zmw>aESIE(mS~Abk)UPbqhumt)<Ge=YkmG?YsdbtT3($AC}*TC
zu$0&xiP)SjC0)F1?4h%j3w{)IyfEEht2t+Z348QA%<`I>T;u5Wxo9hU(x``LPM)C*
z_l_m|W?y|GT~&4$dYl6dWb7-)fO5;SZ8s%X?I9>VpEr<R9D4<9%bO?f)Byx`IA!JL
zbkzm4et)i-3C1HSyAKEkBYj-p7ZWi3>d!eiI8a-xUdIR4rAKH#=pK~C6V7b+N>ISP
z>GWA>U^L3roi!CRiWWE5!kpSLTQ79-MBnF0!%4@j`QA=Q^3H?!zVw2MukgyF>r97m
z4Sz11L(V|{UeB$HgH1%d4*KniteuT-H;SyR-8)f?qk}O-i!Y;$HFn$<<LN9Z>kI)H
zEyH)}ik;<r7%NQf5<D)R<bC$UJ*ewkc0g$5+P6S-M69L*8J5PkUmc;vcxB|7A-^eY
z8^auMKP<{I;sn2D=YHiE?u{4OIK@QIlUQJirX$cD)EOM3dB7@Jd`u9VaGy=c805}e
zi_uj+`?kO6zWp>u!g{XU<*=N*Q=h2hMg|W;<c#7YRUHdJES7v7@_NtP3JC5Ngb#oP
z+%l1gt(Pdm33iATrn-Y_l|#HpD@A6%+fS>x1kz+_?86NvC%Y=6l`Rn?%;^>{>daPU
zc|RQeTr9yeSRrcVcNlM7STb~n+?3q_!LIXPb*8KOt~1i+rbDszZr1~NEy3ZuLfAzR
zmJYuQQ-3&yqoe)Ij|9b^XZ59}=iix{NgiCsc=XEOZGAFtQiPSBzc&eV*A}mQtW!|G
zD{A}<*mZwF*Pg>cerfm@v0XOv#)})toFz&<y$OC$xgI=4`J<BOPkbg-swiRXkbZ!J
zlftGAo6lYabxgvBN-p;$2c4R8lxFTJ=CB6Z@R!s%I-4A)wkd89J~1f~{|)wuvodcv
z{$`#6?R{b5A7S7`u>vIkMHtW=k(K*DEI>FO7Oh7q`l5Q&&8=W!3F>kuP7o?f=4k&{
zC9+hB-#c=kA;<r_p|mfY{WLwg9gtv^miB<+Rs=y=5u9M>#~8an?e_(1a(&!X92YTz
zVgCCIMKMGhUsQyznR46)`IB=p!UNs<avlC?Fr_-49UmL<S2owEXZhKBD@0dW)6?rQ
zGk<Sco~zRHV_C$5T!S^37Qjzy7nX(}r$&O}RwCb`y7mecmB)}jEiBK@5($;7dFHS<
z3#!M9{VGFsr1_&sOChe>lO|7^mUpI^Vuy<$JJWs~re}Q^dnrdu^>VQ)j0(zcvgL99
zYDaHCIf)R=(d$o$OZNR9I)2cq1iEP&+RY`lcw(MDkrJ&~Qp}HzuaibK{7lHt@Oy{*
zO{ypGGCip9^yx$0-JTV)5)PjZ6rdPuB?an@-06|$muen1mn2It>iF5vU78egRUw>M
zT@ul2kX`=YyPA7s_UYv9O#(VUOg*NR4B%&Wgp0GC5plU_quMX_J~9L@RS|v0Ncd_4
z6qPgbtBYaBTsrdb8BR@Aj*vQ$e4xn639J!+(gZ3G>XaF5yR1B~G$to|ObNf9L1Qw+
zd)?yV;O*gd+ccEFk`MOhwt3|FgFLpr5^~*{p}%dmY(gnx2kv%yKbDXR``o%hTTiP9
zzjLiLK1<Fx8H>&@EJi+ppD}dXym90@URH!8a19C4@Nr-UgzjdbER@cBb$V3Ey%F$C
z0pL$Wjdf~egRT*uo)HS7am%Nq%Z;eZRLn;Nwon0KnIkcOo(w3c1yh1)_tnafI=8Lm
zN)|Q0SDZ5Zd7n4<v(Am9j(mzPH9qG|)tskI|2gTe*>_onyxE+FHucy`+LfG@$k`BN
z%LUD|jR^dinf1Xqv*$SX|DuoTX-F;~Qv}ys#`jzDCN;Z^WhO24iNiVrHN<2=F+VI<
zHw+;x6ZcOuPuD$qy>8^Z?c(%;y-~E^E78$Vrw`D3!1?FwG`U%mE<c3@T&~Vc4uj8K
zp@`orXV}BpeE7>f86wvED_ZGVwnTmLGA2V)HL!NR;r4LxQ-66JrlbnVg|oM4h`q7=
zPg~`d``NLYS(mA9F$|#_gpB!6()ZoGPaNGHe2?an>8s_9zlnC5S1YVm9~__HJT5k*
z9XoG%s&pGNHERqg4Sja+ox<>tuv7yxv7l@c%w+8@W?B>8LWnsfF+lOvu#;cE?0Bud
zDJw8Hs~s<s0B=+L@PUdnnt+i#2UJjmw1L2%cDfvpq+GttjxG~J>bKwlS>Bn469<r+
z9V-K={%FGE=Og;$9-di$0b~GK?+w}ci)b%c?kWxjG^F%w5QfT{$hHc($d;K#1QGFc
z#r)PRw3t_TIlB!|UGMUKd3e3V2L=c}aKPIXV@NqW74!LCOa<)QvGizco#laVgvvzq
zuMV*Og1f?jie(PJk;->I$|YAP@%qmA_iv{}Thf}DvWl0oMgJQ32URi+2SgyOdp!yd
z?+>(LB~V@mA&`}(8D+?_c06Gzb$-b3=+QgQ#pZe+Sl9U-qQd|J8cf@lt`=l;+x<xb
zGry{y2I?LK5uTtUfu7=`;&FhhG=-ZA>dsc<zzwqxQV)EfG$POd738lKk5rCm+an+A
z?mu(R>-T3jr4x9*M|#C2MF9nE4Kc;;lwvm4L(6yIZ;KWKbu@qZt2V@*LNU!9t=l>$
z|MPWt`%2c#FmgA+Q))Dz@f7?Cd~oO(A>yH*y6MITKtTenw?7&SbE}iR>@{ce^_-)b
z5(E;`BP=?4MmHg5iLOvUfgpZr#U=A&RuAhQKOMA&{|yU9kMHG+PI~>m$ace1>Ncf0
zEFJjx5+_QTs#R0C8Pgd&KZf3JYvk`R(?6EVd|Pbi=TTAAT6^c7HK6L)#CNnE{xR%@
zMdrV!N}j|b;q8A_Ap5EK<j^R6%-F9t6z_H@&KMlv^-*(|$NHfN@H=~P=aq+~7~#wN
zMXM`$NlIrL3aA!%P{%y9TPuv}A0&%cE7T07q#d_-nOg)vgR%gVYP&YVnHyZ_A`VsB
zl*%9IP#EFcrIn)floZg*2@6cZl>#Oj>n9KeD(H((tyC4PP4ioipMAi5#%EfpffO0{
zv@~^Yr*y6yF{(ZbX7Efk_{&>XT0pWH#*hId)c8P&##;cL<)nKM<gTS(p9W@jmuwpH
zpo=NlF52gFpDw@v<zem<%@vR9Xi3W+&R01BDqZf#<l$$Etlh{HpAy5OeJ(olEH?PF
zYC8`vHs^Mv=UsR2TWWuXaT{3EvDn>X_c;~YE!PidXs$Svmbado{BT~anj-*``5s|H
zpoyDvl|C2y2oqhWq{{9n`MHlPM6L@!m#0u@kRyw}82J4LMc^ws3~=Bt+9{k2o*d{F
zuY>+u;0xP4!bg#Wne4P<k{wWcuIS)sP5u@E-z8DKCcKyMAIk4+K5nttz_jliI1KnJ
znSbA^dEL@MA-ab12`k^K_M|0{K-ywVSyrD;E(-4Sk{JKYLBerA!(J*nn=9yyO#u<u
zU%fkMcS_^t`+wo)c}PaBw5&=WkUcImr19SFiq&+N8P-K8wq7L58U+u6R4N#Nq->|n
zy{>MHiLl?@$j}d!b3<sHtD8)mySs*|2*XbApXi{?H+QB^_5f&cH&he6Eg{>7b=Sr9
z$9i?N{9N!L#b28~DJVz`zcz5VfXBr;A+{v4?K~uxzogKTlFC;vjK6lBLcn??4HnTp
zWS*agrwRq`=s&OK`5*8@yTKzzhDrzCXc;-~4@h-v4Yo+mLCMY6Oa(~hg=SN>j4<sH
z0u%*psz1NGGKf#LnGwz|Mbuqzwl}N3y@v<tie*~VS~T#Yk5Vy-;OQu?srxI_o?Nvn
zoN$%U%8vBIke?NmoP-2rRte`nOvAeI#>%eWkBTI77RP^wq5nna3uV)J0z1cTnlt!k
zH&6PV?DWlaFN;gqqj8jsQQ}81><GICn1$eQ0}50tbvjd&cC=8Hcn-WT#{l}6-^oL9
z_dHg$Y?frERCuvpLwr?B$sXS10C18;Q1<=#;vtZf=k@^y@IwsbX2b2fx)ZcOhH{%f
zpF6Hzeyo%7J1_oYw}Oz*!eI4`2Y+IJ>8Q4v+|<rl73!8ZQ68n|m?0D3_aW_lv@JR<
z+#L|;kjMT7tI2Z@BcRwa?-k{=td7L{#)(v?);kh!<?p#I?lUy#^8MWrW@y22?W-Fo
z8=#@!3S|Suc@r=GP98)kvp*>PkI(x=8!gd_l7{1jCo-Ui;IqFLop<gk5sdY}$3U&Z
z9h3-ApaNn(=y@l%aD5*KbRm$w<94t#_f>9gUmzb|OmT;gEa|UWR%GX&Rh;+XMaq!x
z9rS(MsszAu2G}N7BGGTb$~^|))*7&BP5?2K(AkrU!3Q7G?=J*$u_G@YB<LXG4QLTa
z%kXdjCyfRSZG3?Oj4fS2ohk;n5LAeKRW)V5-c=DT=yYq^si<kW0jC-Hg@$2}v0zJ^
z{6Ct$F*vfW?YiS+V%xTDOl;fc#MZ>-#P-CRIFn3l+qUig`hLE8f269bt5bb?pR+Hm
zwbycIRVS{S^35%^t%jJ&@^8&xb;W}3f8Ksh^m_coZ9T`itm5baR$9J>WNvlPjRJk<
z;lMZ9Tt@GH)7XAGw66WgYIejBJSb5i1PYz$ULR5AH$T8oBHqk;d;fhjD%**0H-WN+
z%65H%JNxz5r6AUOVO98Igk_%9w*|gO7_D%mihi{k$+PAPT>Ms<5B3EBRG$c9;!<O$
z7lirqI}PQ$XjsVD_rbQm3m$&hblEFWW990R$@Kin_$L+A?)w)^7AYM~Z{k1QMph|H
zS{;4eon}ApzDhi9l;M@WS+TbA3zqPR^PS;{_z#T#moBuAiJ?j+0Rm|YJ_BP;2ix)?
zqbhZQS|w*8xp!_Nh*7$_{w!Qz^^YQm9S3vUb7!3A1;tqOnoBd(`Tk>e?!d3>KrdEQ
zyfCAWJ?zx9G|A%WPs;9gV^ljT5)F{Be}*%4eHyFBQtos8*?!09vYI7})Cxm9L_053
z1jSj);br;w;6S!xwdp<oQvQZ3^CqhumoNevmk3@N1q(ASmtRS}_9X)&L}JgEC4SEi
zH-F3g`t@IO<Dv*ui+@F7Zg=&lBlE*mB>+TuauS*IY9TM;UnV(O1NFu6i(XL#F<i;i
z#qe^G*cYXrwaOW4@yW-|5EW2CYgjibx_NTVLN)B?<@|~lq+`_XWohXAs_W++W-3X7
z=&Pp|Z0ZCE8+cw?s=TT{6wba|?E9($=_6Ep8sZr8+;-jg#IE-9V(Zt$^PL64DK;+-
zh1VVftM3!Q$8NDM0vhjz!Hz0yQP4LZRelGiN2L;*{MmbQ*>e~m>k}&S5tA~|S!E|U
zhgg9GQyY30S)%Y$!ZzfP1aZBJV7mHE$tcd4TLT7xCi2c}HsxRygJIZlg;4O=O(Y2H
zR@SsZH8a}AzQ+@tr*X^J(fDOs1WPK%=7++=B5?(>4r6>1)=9}kODYhz4M9BjwVgI=
z6Z|?x{=jQu^B`z+K+6KZcw@K_UQ86gb_H2X3UQDRREIO_OvJObX@Y9G645z#eV7Gv
z@P)WvSXp!y9FM$y`P+jc3K2nTRg{RZY|85~pXwf#T4%8jI`wC5E$|SWa<j{T9QrUg
z<%nKiRVBL47UVxYjlz$({GoGq3?)98s+ch9#C=zM`bCbR3$FUhz=kQ1iLzJ`e3Vr4
z$7q*0xkj2)$(I4uHQ_B`TXzYBEgSeBb^j5DgEpygiSO76?Wv+Zhn1X=QFwf3Arv^s
z*bKTfhCYWD6++rYLcnG0J3L}6G|~F1G%6p@ZCBz=&+Cwfxeaf(&(v%hdUEW%?e~!2
z3oDRQ=%UEjJ17e3VWm%jG#T6@zq#KlXn4Uwu*=OiS<W|~vTF<E-<J=UsxvAI?=$dp
zMot;ftw5j>@gl-J#cXc-)7MABx{rjnaz%UB^-%4By2<&Kvmo7pq>8ZkSYTXnll8zz
z&WIq~eZ;!gh`RvfLSa0*3u)`SznH@>QHSX(rjFR_LHG!1V|YT&WPtH33Kk&=+}tI#
zX5<rkXVl&3ucF6;Jc4h3#uq~*j$M7DvHoH8UAorG(W(0B>^>C9VHktYNp*clb$%sy
zeyOZo1eSeVQQaj#EEG0-DYhnx#NCX~s6bRdA~B;?H)Oy@;XNC=-BMOR^_uQwx!VoG
z5IdR<3j;U_4F6lb*=}D?7ajt)#YJ=-SZGnZ;O`O)RAMx>9sV7l&v$7Z_X{Xldn~-O
zv%BO=Zs}<Hr(*n?N<8vzvf3QyvtCi$=K4g+3OHua^n!RL1~n6)NRa%PAs5gO74E$i
z!#s&OGr9w1l6BV#eCO}g6=@7VgAhSnjF5*Z)$*4fPN$Mxu*@Z2Qm0R{qH=YR|1!bW
zs7tk0DJuvXCSyzG*M<K5x%!Jhs^ep9D#xVj@eii%-I^i5#spw%E8KuDw*oj@T7Ez?
zsN;+J2HjeQVFbVHvIb?^Ow!bjsmM&)G*Y%wO1%6S*mbWYQY2LLfgah4{wojx`!2uw
z%fMNk7*DxLBJNYOMpv!Q(7#WF5rR$T5#}#-XHnx0ocmCCoD)RFD#2?%V>Z~rUXM}0
zzr5(@4NqoY%CeG@NPMS`um((=w-<CJ)-qW_P7(YgZ&xF~UuK~qMNb_Nh`7NQ<yh0X
z=Stqd&*#OWpUJ1cY14e#5{2(>2r}a9M`25BDui$9*ULBm`Pc<<oV?*X?un7PzU(Ur
ziROQuvupbHzCpx9C02-{03#B3DDA}&;UO`!Wf$Ip<Z)^qFo~t4HdiDSOF}5-qtF61
zVJlEg)m?wWx$Nncjwm@ypUM8xdNwO?bXR}@-P3r^xQvAexdl`a0}lnGGXWEpc0Q}*
zK`YX9Q_7zC@&CRC5wsEO{`XX=eJN-c*kOHzAJoI8kUHO~RDr@*P*J`CUT{Zqv;2dk
zK(V;UB;>~4iMOt)^#*(to+dHCR=dN571dcND5AF~+p%5e<ukx`wg_rnUYxszx3hi?
zVveI8voax*{i-P4$S1B$V-jUXMQ`o`Q3tnOiNUaIWt!=LF=pJcUT;x1^!okMDM0Fe
zTVFciV>iL{Ew^cau~o@z5r)2#^EV!Rbb{bliO3m4P%oyIVnLwe8z8uNWd`5UTiY0N
z(&&aNPT;WlW&uA8lB9o6yy<NR0aV^e#l{LSM)hQ@EI`L|9Y%9I$YlhMU@&8(XYt3$
zfxA<!tI&rL(ebwD&`~{DdfsYkd5W<C1|Co(LFGt9P{&U}Y&|7OkGrphtJY7NnqPFO
zK_LRsVxo)xTf1T%zYq2Qh5xSmgr*FyfmbOtVJhRabl6_v+c!_jvNu>OQm4(19G~Ya
z_{Rtq2;0nMObZBQh!U-Z>Yt_Apskj-)?NJ;6yP%>6S7Lr%Fd3SG0G}f9~Kg$?k`dV
z{kfYY9Q7SOeU?*8!Lkauyk9Lp+u$am-SyZ9C6)Ga0o6)>N41;3;LUowmVNl4xBtrb
zhV*AYJblM?polU2CTH(|eqNUI0-6@)Rt-x0^7kxRB8Omtk029m$PF6Kf}`*-2}F^p
zNqRsSrCo>wVeJG(krU+_T#*7|inpffbA=Gs=>A5Oy~FNZzn+ShL1tHl^|;EY8fr;n
z3?Caxzeg4}Qr(rzW$oFx%7d=b(9a_1xs;9@O>p<ufq>LNM`~Hx=A=bC@}7Aap-y<T
zKlMR9SRzN(zkt@uJyE~JLfK{1Ua8w)asGV3F;L;vxW(Ik4*M>fHGFPD|2J&4Ck2%f
z?+>TLEeq24G=k{CN_+)JzW>#|4^RBp4e-1aw*N)60*yBN4eePn#$S)~AnRT%CE<I5
zpX*UDM1I;IyR*C`@r95vd{{vsW^1k?pJz2m`Wa<;|Gh<eJZ3s6Ho4S{@9ru#pE;zf
z77xZV*a1WcUomJNRkU63k7K8Vl%)<G0wz}?1RA+eO^H7Q*w2Nx3>Ku3p0d{BMD5si
zD%oJ~&G~N*WOH;pPk(QS$voko^iYW`k6Uskepc})Qj;K#DlSD>1;K&cCV_vNa)ey4
z)C=lkoAlbD7Z|~@WNBrJb5sTkdx0sd?cY<47DEy@S{`&6@HADkM={YV!jLMypK5fE
zvNuYU^tx{($>Q$hUYS=RS1sq;4|G{F|JTD(1eL0MAVP@DE#bjsbPwtpy~vykuXTRM
z{fN(e@*J*kg;0)ZY~;$hkbqgJE?xrTWS)T-pL!i^x1U0Ay6h1EYJtI|Q|AXnPkkPG
zo2y-jsSrY1rQhAT;IZDRdtg9%<hh)kE(G?H@O{QM;i%mL4+_aiY2YI^!@>rL<)U?k
z8h`AbA^2~JpSL;hhkFU+_2@99bt{&q7!Wyd;U_>>?#0XCy`@Z}mk@3Gs!fjx6=@~>
zUFf+csk~T{BPoVQ7%Rn%oyO*2Xo^9qXeYC1o0sHps}8r9g|TG|9C!+%=Pj{m`xRm8
z|AG>e)t}t4_V#-d*Pvqg8d`bqWosco%=3)nH#Mfx)kttU$}>bfQ)I0c>tE)_E_=XZ
zw-*a0G7Y(B70I!*yvF6h%}dz$uYXtjm1wC?^S5HEM7RG9oSYQDqB7=jDRwJb=5F)6
z8Pb5q1KV&?*alt}5|ClToTlF)QrKKvM$uuzHAsHMHt1d+ID6AFgY^709}32pHh)Wf
z=RTVOQGJ+fX!WB*QlNM)qwDoB8}<72_Jw{&r`Th?i>99m88@w*&#5tP^J5&_9p`!)
z(l@2*|4yM+a-6T!sG?n6U9Hn*NW=8#^pBfA)pu&;U1HNAJipL<WULx&n00jSa%ko8
zGSb+%US)_!o>y}a<{`}cWLor9*4TgneJW^vm-ocO7n!UdUIY*NaO4g=&<D_bBnher
z@q_quL#WnHMm>@xD3c}crD`P*tHp0YbPS?js)AUuqtfWIzRZ~Unu?plkHtjG2q*?r
z4`oZ}ovNL7zN+ss-4&ZJvS&Wujb@*tNf$ngw$z1+it90}QqxR|u^i!bHt6=0(N%wt
zlB5j(B5Zk)HfFtzOa~tK3FDneCRHHs6Dw#W7If@afZiL}E}h)4@E2DLlAr~RcrE&2
z0xhx7MevsYr6#Ds(<z!XtswI_oPpWFkAo$gZCrc$KJiz#bf=|a0W~h4JP9=4*O%Ph
zJ4vz!pYj$>x2^xIEUz;>{o#u7FP$_s+9IQL_&r(KWz)K1G%`8SUF8}vRa{wB)wD;|
zHdt3#Ii{<jVIfuYeFo&AS@pBBvNA_QOS8RPK69^6$Z1%Mx30@Y_Un{fDgW^C<!E*8
z*Rmhcwm{uF_xA6O^vcR}xvIqgWe8ivVU2>|Ca{WrW3=x@iXit0u_(91(CIL6mawOO
z)jyJj_6I~RmR_`i^P;q?SgLF9-*0cY7IxErE$n^}Ed<yjSGJh~-1AwK)%BMW=$Ovr
z2&LSMtH%UnM-_`PoallKSGwqUyRO7VE+0@S&LyR-CUw7x4S>UZfhka}z~6Vo4qvsP
zWW3&T$p>q0All0dw-C(GQhXGQ;caxgxmGh4FnHy)e*N(GthtKWNB#KT@w@-lzT210
zNP%d193lS_Yru!s@xpI4!4=s`JiS9eOFZaJRSk__Os%d%Q*ft6W?*jm2Z}opRuh@*
z!|Ya5IXfxHLYcRq6S0=^87zfy)7URD{k!%vF3E5Q@)8~Rr(#IiXOO`itcbZIG@Aq+
z-4!3=4T4CNQ5FUnkhTNA!*xfl$vNlcPDNo#Asxslr$yuM0IwZKYCnwOpx&`n3Y5U0
z=<Y|?Sz}Vum}Dm#RinA%sss2}{l3W^MaxlH_mUN*V@O$}a>uXjN2Y=D2XOYtiN%Tk
zVl|G#gx_&2P~hg-+H3z2s>0ws9#w>JV#=f*TF5y=tu2wBj`!m1*<pMwK3~wc<vdA>
z$XSRL^df3isV$MFi*+UQVQ>;`?M}<UfDjhCiP)WQ^O4QFWEvZwEXC8+E3ed(fg|;p
zBn>LLGTwlr0_=r${USBNf82uL<d#N$pSZz8MKSsdnIL=7Octv~>!H#T!IYY>&`?^J
zV)TTm`f18Km#e{B@#%DV>^^jkUa3mE^M>~SPTnj;!D2ZWYj$&2F!pd6_}>uM`aZ!l
zA_oO1d4M2zGzMxbJ#G3(|6<oMlk5zD$n0ilAf9*<?wppDB|B)icB#6#jf~57u_wX8
zxdtSU>nTI#Gy~LS8MEB0MD({S)xC{y54^JI$j7$KZK`)`xO$X?zDR+j7%7m0|3KRI
zaED-<T9AR|3&;4?7e7FbntG~4i-RnA$nAxgbvBrw-OR&8Keg>O8`m$jKQNinW9m^Z
zepDi?)ei-azs)j%K;5`wC$cD@(l227&h;E5E`YN!*7IZq7Yi30jguuxl#ky$@Aw`j
z41!c~_om3lRtf>1RR|SD$h5~=KE)pw5@U2?A`7A*+!02EP$FYqoK+}m{EU1lGH1lC
zs+~_$|4X$fEeP~05f(^V&#2SMMTo4R+ZW|kFTqrEv@@Sl_HGg>H%03`pW8nCy61OI
zUHApr$|8;HJ$P{HISYi!#sa%;m6V6`F#?Ne_1JZNJ}%C-KhbZ}MG)^h6>~dX>Un>^
z-9WQzS3(Pka)J|t%$(L&y({7dj4h7tS(7E-n;a*jwie4wHw?UIWn~#VI_{b=rI&*h
zqm;b_i$G@|XP#8_R~@i|+CW@E^h~Bf{2DXCVwDfUh!!#AIns3n<`4!3v5!3YyY{9~
zrAe}cWKlyYDqaj^S`X&mNX*_jV7r>1eHO!&P1$~mJwcf$@_qy!m<5v}lT>L(Xpbti
zz}ty!KtbFQ@$?p7RNFjI?J=<A_1tvZ_38J2?Wt1<s8BH}7&0ZBVwL<CzxI#H{e4=%
zbzwmJ1zTx<rur<tOaM~EKwbT=ZS%^ymnL);1Z{)5>kFp(uf)74m&ZlGQdDg3q~ND)
z8HB_kGozqDGR2RGMbg6R1Cu|nwa(!qHPEAlV#^npD`b77upZ}%i{o4uGoQtdtguA^
zaku3O9<RXVSL)Lr_f7P`hLLTHIcT<g`it^icZ1bp?Cb-Z4ja_?$6$Mnmm!SfFBPlU
zjw@+1o8nvUt+==QDlO)TnIIqHbt1eV-JgG;7j}~vMIWWAlXzB>xYk^=CWH^da1fY@
zh`?>rlX&`wwyV5Z$Rv5(=5jR0;ZTqmQP`~cyTQ{4>+xnm<3U`f(DW5lS|E@Q==HQD
z{Cr0o^I_2OwmfKqE#10U2NX%G09#=jil7iw<|nKTSFwuE!h;7Ut2%KUrcd-w)P^le
z$;gZkV}5s-0s9l=o##f*ExRBi=_A+7nsUi8Ib;MvWG*?XgeXMDCk}k}+7^kp&oeL+
zVlWaSE*z;>HyyXad*4w;t4B!1j>WA8#ME~{*$xtfFC<WYG4&VF-a@Yz?WHj&*zwt>
z6-@@|qQ^evyDzPBQ~dlDr{OH2pMNsh;Kndp%MIY95C)6FJMw08$$L<i_+EdkWPWi_
z#?id$|2C_|;qvVlMquulcwK(@!vtD0oU&_~%i=jCT<5d`Nj7%SCAe~ocmW~Y5@}Nx
zi?p4a+xY+37sF_Q>7%+}KVaAwK}iEp0kwxG`Uv(b!m#ovCyH(<cte@@O8EW4C^VQ)
z#a@2MoVgH&JHi@?5ELeG&&46mBHi=>4)Xl<m06*Vi`AmpbCC+|QWT9D)&gbo8pP0R
zNOdW2tW}~&b?Nh7yc<L^Vm-|L%v|Drk)R3{?u+_`82-b6s*;*<31-;gdZ`;mZXPyI
zeYS>;U|XE{2tyZ)(au|(p+FJR%q-Wg(UC6;$EhqkSi(Sk;f(dW%JcYlW`#%6edUN&
z-u6GUYL5TM1$eE1t+nocltSkhX@-t3+m7bS;?4@h@k8eAW(joIO$^~Q!9PNuQYZQr
z7Y*yH$UFt3t(r!NP*Af?)xh(ZlJ@`a59SwB2nQqiE?5QFfd4xp3c!});A)|r9zKC>
zg0>}R;|WDsyy!10*4H5TrldDH*OM+m%p(H8-Pw6um@XQxA)`WOL5%oX{OtE*Or%N>
z-;x_mrV3Z)kP}DXV%@jJx@5Y4y2J%CXLWz9edg#SfcA{|v57h+6m1Y~4T$IW?#bRG
zKL`3Vr$L)Z=>`OSYVTb0=_eoQ&`{Vg4#9xLc|?^qYyG9tiWET5qT2#D_xJl5^O`Vc
zH|yA3P8##P<ulfdW87fS#P$S&y<xNHdInq@{B<oJlJi_TzM5WE1j;y~8-tQ&ylsK>
z8$=8A0O?mmK63JM%D>v<f_jCP>2VCMch`ROW|h1sDcNMcf1qV49@@4jx=Xaxtk5^%
z_Mb~k5e1*U9~)c0LollQN<{l(X-nYFIvbg(pd%6M>%?H;Ra7K!=Z|@SEm*ihfcWF=
z##_vLG`cwyY?aqrRg3W;F!MWD?^I@RirvhRVlLi1sp5?=^vm!!+N{vCi#A5kGa{t+
z6|sQd)mEF?_=c0}Y?xnETTri!01_OAM&^xD#N!L~dAj<JtCN|Ui$A9z4)wF`4TbGb
zn1mMucaHmzjv5-&0+o&*1$eK5$=`rapTMf*IpNhBS%{zJ{RVim_r_9)xg7HMAbXC7
zC1P#A2Z?0|$~n|5Jv^R&K%4{O{_N|(q7UkqcX{toq1{J|`YaR?!st?T1gq>mZ|Sl6
z8y@c$7U<L95EzvRMMB;|l3u>*uaODMI$MQHFot!Q>4CBxv%Z&gbwc-M*SkOkg}By|
ziUU*)XD%A92!OJg`q<>8)u~RUK&&cf84kkSD2!6VA}=0$C5S5!d!LZ3atIpefxf;7
zaVsmjzdZO)0waIP7{q%UR)<Z=D4xrmGV8%X;X>dJfR2vVvH;1_@&^kQVujAg!U9pB
ziPm$T>k_Y-*{)I7_d%-6Bg(1-E`I9i>0ExT(a|w~z<<NH^;457WB@1HhFE1<a`RRh
z-k5Kw_#v&NX<QBnW1R<Kte{Y(@)h@E^h@U#5Hiqc;){gR##>R>hXjp?KtHh)MUx0{
zQrNF(`A5pqBQ1zy(zvEQ5uzekh7BWpv+{z-|LH`f;f7gdBQ~aIRG^*}_3>ybH+!kw
zZ25Pz!6z6=oU{|pFBf+}4K=MnlRDvu@uO5SBBq_s0zvLMB+x7<Fm?skWWFlj6|@VU
zGm~Xz=)p8#O00s|ALf;-_JkK|Bl!_+vQj+rIWiWB4jtB&Nyw#r3M9SY0h~({6v}$@
z4o3OHZy%1MCuQirDzYyi=QFT7K)N21-kX1cJcP9&kyqg=wA9o}l|qmJykt)4pPVHQ
zC!s$ae#TMZ%|@AST6tW;eGLPEG|ud3aiz{1pzs}-PYblZtfPe75i-?M|BJ-#$<vB}
zFQf|kOP;)y%wbFJ(D1Md3Lhh<r`BUJCLf1iAkJK6;1Rn7D`+Xv`P=@o7o*1sm53kL
zBlYuNae~kq=?;9g_=NdMMd1`E$v{saEZ}L!z}8Pq9{*aBj2#=5&ql-j1cia{m*E&m
ztK`FXD~&Jo4}VmQx=*mF#LCiao|{r%i|KmWt;E9q6?EsFf)t5y%^KW=$0ILgUt{=!
zG^(M32lex1GiIFZ6pUV~;OvM`C9E8?K|RjS=gf$FIM7mf6QyhYuyxDs(-~oXoXI{e
z1iv+Es=~6zO-?Cys*u3%V#TO(&D{w^xK)D8Nm<Y#);bjaw~Z}&yOtmFX$Lk=A_GxU
zss<0h3lcOxVF{jKn(HIyr%u2|{R2d+SOrbrim^_Ar}dEQI0$^iL{v@UbrjR?zD3gf
zamxQ<|JdpcfNYmC9jUG+08?HH;$_e{e_r)fN$E1tW4t6b(F~C^>+vmd<o05fO(4G*
z_eHya9d&Ed&ZSN=8x{;?w0tpH-p`1ouDxe-;Q9(jW+(9E50}X02o&rc#>L6f2fn?r
zb#jmOru=x90%P;X*~oaTbCPRXFdn*B$yqR63aq~CRFKxPiZDpHHq!On5q{d0(9)la
zp1c9fB$hOUaR~Yi&=%Q!_sq1QBQqtsC=XWI3FBlxskrojDJ|EtYhri3wqdL1I$9>U
zI+&d@3Rpd~s)%;g@~I5NMrWn_)y#kx!NW-ow*a`-EVV#bsql(*%orOPsCiQaHy+|e
zENK6S2AP*p@PNLJU86=Ncbi<y6&)x*!um6Kl|3cNYu{Xe)ju8=XnnoC;2|#tWv1(q
z5=`}T?@wUY^HLzb<+Bt&lgu}v2De_7sq8di)H$Q;g+a~q;kb{uzAP%ydw+nw7w*&P
zdOoGKwwJXnGF6bL&ACf=<$j_eA4Y7H26a||uA`^ATP;o=%@-&97guXt$7;hlwV_c~
zp6%whC_Z|65M=<Zfnzr1&E``m`^IL86bEs9y_x(Zac2px8yyd2S|nnDf}YBtI0~|N
zPM%HXfatU75g0f9s&ltoS8FFyMExm(%AMjt0LP2~$rrs-x4sOso&-R5m$grfEKU<1
z15_~EZQKpx%PU;5Lz$-BWu+Mf3b1LulFltA1&jmAd#<F@jh4Kd?|h4H(l0S!EnRqn
z;YeVA+<9qw)Sjr${!+LOPaycG$XNgD=yJv+GIcnaOP#P64KYWjGOZGszzQIxsFe<b
zJAzzMX}1ru(bD7OT2WOK6+AT}18Z=u1q}imn^w}v=)ud7kRnnXaKQTbg5pWw7VN>2
zfAx#R&4g5Fe^$^5OY*uW6LP>UN~KU#((K?QY)^;xMD@!+29l%T1oLi9^k%>=NlX4n
z{D`akNdw5l076<KMf?(ujxL#fbSnC0<MvKXlZ!uYnp#4>W`vY@*Oe(t9?Zwdm_Oc&
z5BXz=7eHrU{AVKqT$KZDp^xkBV7EW?fo}oCJ?N9%q0DrozgQ`HuajA3P;ouFRkn^<
z%gO254t!d*%9FUghW+Ps&%$NMUBBHs>yh0Eu@#<Jd3aU{CoLtt&;cc7JKrLxC4>QF
zn<J9+=OD_97)pM#CkSzyi9{~ZQO8mMjO3>V<{<Zse(ZyljPi#H-{H)kwUs1HJCKPE
zr>;Eu?SpwYH{w%BdQUWegtyF0e?#(h<X9BPh^~-h4~k_olhL+7J?<!ZH{#GpAHPw2
z8M65BIYmO+t&^JGs@@9n=a{%A5rn9wG&Wl=H!{+Uu!ghiFJRChECj+j<J~1g>(qE~
zO*X9)3LhO~D|kI`dNRfh&X_l_??!M9SN!;VT*f{=K4NZNC(PhW9JECqF62@RJP4<;
zuZ0;Dnliz-SglG3BBUs>S0}@hapnoLXZh{PetyErr^sd-B7vO*Y9FRjd23T~5&|($
z*i*iZ+WQb78kc0(;*y+{EzOp7x%l9#MRWSisGJLDIby}gOMcz8Ny32{r|O7vz_HrC
z<1b>}mb^g5XZ{UL_2FRp;o^_8ZBRvCXoNiXq~mW4Da_6?&|0msQUN%Fv3J)-dD5Sn
zM_u|89j(_m23|SCWYF0_3FAU&3m<mT+o#A767k~$DTwo;1Z+;w=don2ap{AI26PAw
zr{FL^(vm51JhHJ#DPn!Spt3d$+tABoeQ2*B(_Omn#g?j%o2o^s`kc#Q?ZAGyZ1WN;
z=F+!9Xa=MX52;RE&E3b!!Nezi-pJL(69k!>*x0}l6}{}q5E8H;pTDjxqHsn8QmibK
zlRxMeGX2;O))n}I`xzzFVIc9DeWF0#OF;xX<mE|z6Ap$`@DmwiHEE*il1w423rEBE
zBZ>r$1J!@o_#egdA1^Lcn-hS5Bpm}C9QvDw%(!YWW6-FyHf)R-xSn*p#i0XKXx1Iq
zWhjLoHwmner0sU0S_Yr{)tKl5zvpiflps`1v}6(%8E|7$XCzgJguHI3ze=G9-$eqv
zz`*6-k#RzIJ_rhkDa=IVQh3R8OERZN!$f#05Qv>+GkzEvQcs)tf>8g9iK5fe?>%6j
zztz&GiYiL9dkeoa5uB~_Eg-XG95hJ8`4cF$u7p~Oce@{qsMURZ+)rPQ?iso6IThnl
zx(H59=CS(zkd$0nk36Ik=GctHBhqLHL*#@dVRWeG{GBCAMA$7pJe9+WgP35RdSc$D
zsTRdS#i&6RV`q6>bOwc<QzT`u!J4!+G4=ff>hXB*miuQm*h*h=vZ5~9ThJMvbYUD>
zZ+U%%#7R)NDAW=^jyV_+-VX@?#9EVCITHc`o`|u5n6ZNx473=ym_>r27z8wFFc{<`
z&RdA1uzV!Hy(G@d`@<#kfhGhFH16i#+nyN*N*q?OL=-7-3Q?Kl)R%{n;9sfV!kT48
zkc7K`fs4Syn`9M-Cl-_>LDI6lPLq^T3+~uZ9B3MvJ?RIPN#60<_dlP+f4^ByxxzKE
zLl~6<R+B;}TDlL_qv{8ED^{VmGmGY(JFG<RF0=*;+phm5JUlpT^yPsCFu+)}d%<pc
zut1;*vq1j_WA`eX+Kw8gw&yCfJetUKz>7(bI%!4^Fl>A~HJ40L;LOf3;B#*u-M_mE
zPbVWV-e3~8usl#z^Z>JfbfsZ#jdXGSHhMf=ve890HZjRg33v7Ka+|bIo|;QQ{7v%R
z<C4FzRRvVcc+;1n%V$%_kj%<4c$Jk{qs0g?gGtHKIIOi`M~;-DA`^Kb=cX2ITlw?%
z%0SS}$uTi>yHy#3Ja*&Y9BVgy)x+UL%|*K39xTr`TN6$;TanLq-yY8CL9AK%&o|^W
z&`cf?hlheHGdMa=o`OWMJ`&`*H#bu#ez?@8M4j*Fk`a!Gk0sh45h1)&LEJg&ELeXM
z%s>}3NalCa0E-4{Ob7l3m%|l&r$i@F2o1%(k>m};A$%gb9Um|0l+3ueUn&V8yILep
z@i{Dn?lUEUr9({oNYI|sW)QGBK{*Pudq*bd-6m6~<by{_E2G@Sfkc3%1K3S89`uo|
z8~b)2{OASrsiY?*u{Kp!(sehyELZPr5R{QOfbhL7n9fQM_djy(@IBljNP`LiMpV5z
zfa<2EJKSd0%3BNy>SbwgJzmQ177+Dd9f0rB28oFzvjAy|A0w#R)Nw4Mz`GnnU6!1L
zHbwBHD0K`{LKE`@a8vmX8zb#uEK*(@LR1QD2{%H09R6w#g_jOeaj8gBanj&emMeBd
zA)5?}!u93Pgq(1^^LcF|GlOAp8wh212xEAA1&TV@8O}WJ79%tg2fC!Jps>hBr-0li
zBC6{?3<!}|VXQ#}ilU2b!*odLi0M;GQ}lv(oJdmyQ&bWM@D&v>Lm__MZY16Zg&)B5
z=|0vV&W9O?wLh5cuZ6hn94tXLb?UCtzhL6!Y;-Ftf5^+uRaPd?p9&<Vr9GXV%oeY6
zVgj=;1GCMXS+g>Lqty8;K947^*_&rCTb2zeXE%xCr^P|SF<^Y`<XYwyM=BtzZ@IO%
zFc@}1lLJ`?t`M%Wt;AT?!SIKe(-w-)X8e-Vn}>li!Q1%pV_b^k{s+HVw?JsZg1o*r
zk#6(NQakRa0&r1G5;$8x1q6pi&;l}>$=P=2bWlb~dhH~IBd`CmTTFz)=3___uJtfE
zdr%zP_jsP#?5ttP9f?w{{nX8ykNPS0=mmT=*~Ju8<^9_PPXQtzjtCLvPBECbYpQT9
zWZiGBiM7Cr+I;DMaQ-NjbbjP7L?*AK{c3>N!T`vdvs|4L3I_q`-+0<TT|t(DQ`hCq
z&CS=1jg41{X+#SDdL#lSlSK-61NMjF>>Om8{$6_coNY4o{HQbpXJxTEg8K~~>_+H-
zDussSRPv=e&v{zTh00VI{%i9`^{VzVj@l6Z=!<}NPxC(xe(ac@+n&6@=I;#R7227r
z2J2E-xh%NAY{HlqV!OieSeD6w;i9B~?F(T`F-Z*!=A1#YPtz<zh0>&%YkaKjSm0!Q
z6wh>ma`0&wAWkCH|H}yjP(U~TdvfAym?Afek%1$lVv8aZ4#PwvXO)v`I)Nl*Q2O(e
z_0{e<+mJken@YC5v>@y&D1bUxhndsNNOtOOJvnc(1M1-B(Zyeq$#EU?mpzwW&G5eW
zVf%3&y`ZYsN<~=z5#*)z5@~sk%NT6T;1igDKgt1QhiyK$xV16jsqO%nZCZUPcM_xn
z+y<I<9H0tDelwD;JBdu*?Sa1UjW)&J7-^|!Tr~$Wtd2X#6*3S)nEck8y*oRvp2k#+
zY%K88d5ar2QhqYiR3H1^(BELp;penKsz15pC-u!02q{RVH5K8)A1F@x@}C@YYIIur
ziqfaY{)vduAVLrmnEFnhM+(LY_ifwm0w@_wi}H!T5aJkWQ}8jh+DJ{FGKxPzqC{eU
ziarahH;(5a!o}4A&n(^9*n50Kooe1PZRpx=b=q!<qN(A%WnTL;NyovxnnOWJ2}Q+J
zp64?J@<<0-G||Eoeg&z=A#4C_e%EnT2p0VoZrjh6UWkw>ou$cA$KMxs#F~k|W0itx
zq<KCMCIjdA2(Hcu)o?`LTf9d3j(`{8pLqK+T<rB|^F&Im_C*1cm;o`GWDPWjaY3Kq
zMp8!&(F6|(rv=h%i#NB#)kDgv8_(Wze=`ZUlSuV}s}iELmZPU!<p#|7%;|ZL1cM`a
zvDq;C2>|9iI?Z|(ZGi<^b%s5LJptWw8!yWYJx98uu@;m+FSoy*WQJx6`)gf0yMdDG
zg6e4?Y=R|m5^|Ief8LKUbG2bCe9;rfM&9XeHXF>jPXrH!=CP~D<4RJxAPRikB*=tJ
zP>LTb%rx)>PCC?bPV+@uZJa0}Ftx+c?NjO$xq$+7M7)-Qa<{*t{e0W2=2koP+;lP$
zi5~QnbMQamSWtd?2Q{fXkAX?@Pq*BCO)#L2j8P?~*1l@9u$P<#{fS5`#!RzD>Woee
zhS4i2alBsdyl(T{_Fr}`xnbUY2f+sD2AT4fQ0T)%{tvSgMMcS{9-WQ&|FSN)thB8V
z>$w1&FuJn|T|=~`sLBeGU)Fr5kq#KAN&`uGXqik>emt`;!yUr7Uo30ONi#Hl^3;O(
zt@2bsC}7ZWAj-8U)n1p30p%a)8TGH(D<`Bc73fz>2jEbe@V7+bq3s_A#jjE-fyz18
z%htBo9_Go(>?PJ9lr@DrgH#~6ATgN}qFtCqTUz3YHi5Vu1)0WUxE4fJ!ru-A`aeqV
z8x_6aKYLQRFLmsvfiAog<Y*jdQ29<G`6q~ZWb_B?++i;&6+d^*Bh)I^w{Ov26dc)1
zry8WA^8Kdrlf@n)y#909U|_umZcK{9i1%s45r17JRTwj5n*HJoG2Ko+UH6h>?NH`q
z#GUXul*)_ab-!quLSdsuwW+-2TLA<qJna>=xf3r^YJn&JhF%c5Q?Y97lY9R9AF!89
z*2oZ2GBlj8@gNZ0wKoP#s0-b7KgOKA-DNK%oK~ZB{gAIc&uF&Wc;YrRORUb8z>S&?
zntV61)YO)`yn9_Gm7_x6sYz>qN)mLy@(nR{{iw1lchvfq@>bs0bM%+G5Fh_MT*&w7
z;=`n0a^u3SO-KXtSak5nxM0XS;uH=xFM5W$Vc67?%a{2~<h4EwwkbS*)&@D7?o2q+
zdR~hCGjrk_Y21mKyBn_jx8)I7<2PhZyueLUy!*jGTwhWbXKDtS6x@Fe((@Wkn|v3`
zO^x^Nj?E3@b?E~WWlMO8C+wD?V4_Ga4VD~eE00XuXadC(kz`MgN7;A0Lm3#7UvDn5
z{CYOuDk1E7C*#{uaOyrEMXH$7AsyI_xhwHwV|;zCRoEXR408+co6SGsZ^()md{eJQ
zDv@8hOA9bcyHv)Bl{C;}T@pq+qE5wVuuwu)c`tlTJc*)B5*l?JzU@b+X>@HlY6#)3
z1nwNx^?Y@lmk;$6XUX?^F>T#{y)7>{t+k%={M&zW(6o<-<{1!aY$;p!g1<S!S@eb?
zpr90g2E&z^m&*imBP$?may^ytu!d{9gNXWfUO&j>k0JW%Jet6mM}d&|3#~yQEf*sF
z{b%UIJiwxxg0a*l$QQOZn+gu9>3$?VNg+>!Dn*z*BEjO|0KFx+TAwP=QZb|13|y}%
ztXx~f(q6o~yBgAgcRd&bw}zR(wp@90>}{|Ydf8Ox+L@;C%PO@b<+Qv}-=_y0&QkI`
zTwA0fpK-)Jf9Ae89r-cXC+Sn+iPW3OpXN!-y`pERQT`hh3wf;MP6A&rBj*|1JB~JB
zMw@5Ap3o#+V^PDZY2|CH*!SA`CQnHB1^Yfz;g;WNA`*4l9BS;HG$j0ktmgZhqFqPL
zlA{Jr$*v>PPB<+w79rS@a)g8ioVmq)^Dv;x=agQ|C59_3ntd=@Ss163>ytMmfV-<M
zL4>NbQ2IBihtzUN)mIN>D$U#J&EGGfSHI6;G=*d~St}~EKv+Pd3vOb_syDz8Y~~5N
zsU8zx@sWOjD3*{x+3a9#6f;+r5}LvZ#b5okN+1`LV|Dix{)8ONE)7AI=Pex+&85aG
z(XhU44nS)dvt@~af5tb{lK`{s#vn2wEKIL<e{@({CbP6^%nx>R$3U{hr~_sueznc$
z(F|r2;?cS(jhsR?I5i)D7gofL07^T8D22;Pbu@+EPRyurLl_AWKVshP?jZ2~kuSB6
z59w>JwwtB%1~?hp`BawvJAZ1BK<phlW7yL*8v`F*^Q6(Y;IXHCP$}@b4dpCAfFYIr
z`9g$?rCLc~K4gZQL%Ze5@hBz1A&4tai&4voBYIbS^Twiq2-Yx+kKw39;wQg;oFM7h
zO=~laffjqfD$suzpPws195lwTP`P)Pd?u;~2_j;w=Zh*j1tpkmUrwW}?BStI$;?H}
zb4W@ZV93md*sz}7JDinwCm;CF?km9bJ<@_fyfd{L@fZks8{)K>L@xu)bF4poPv4bd
z>;LF$!d2)Zcpwc>zW=$1X%O48{UBqz9eLMrFF5xNZ*<miCU6g~5e7Ws_aPPQ?{>(9
zB2~3|9o#}^mP@(_`^g)YL%k!zd@bMX6@ai<X$1u!4?Fw&lbRxLX+>EX)u(n}57l{D
zanx;8Z79_}S%Tn`wx*2AsCnzW+NGwTulk@jKo(da98%6;uUgC*%6e4WPgq2=%N;i=
zgDeM!X|~M)PNWJTC2A3ZZeevRmnq>_B&0wm0Ms`u=9L;i*Z{6!64|I1Pvc%#Zng`<
zuQ|~G;iAxbuZ6olgS$tJQ-$*p0NQ|8vt(vzq}Bxc%IwkIC%AHM62RQbFt0t>N%Z)*
z9{&<mvw!v`YJ4ZjxyDd)nm2n&lrl|I;?9@2yI+OiLqntZ<?!R!V?sv*y><4@t+hKr
znb)UMjQ3=6o;+nK@|{yM9sN(xaD_~unqbB}kmEe?jg3zo+v#wJx>zYZFAkDG`gBmQ
z7D8|o%-|>c*|4qJD*^N$uTSQ&CAV$NeS8-34f2#ZvSreelLt4uZczQ8#FFu<d%gsM
za6vp3=juJ9Vy5_^YFct7vS%ipMhX9~*W*r0X!h$Sy<gLyJRLAy#_<=h%3+W)P9ady
ze~AjBh(csWCJ0Xr6Ja*rvW_4zxh{;JHz!OnjQG9qc<ti?DEvvj#7Sk_=TC$Az?&&6
z_ClO100BzcvP&ZTA4#~83Ht$XA}@6*$vBC7Vg8&^o`lW_LG+ZiiO@5C`Vcm1eeNW*
zw6ex&yLRN~G<<=dtcW?d8vsR@pkL-#*n0SFI5hPMZ|SOk99d$&aooP;Lt5&jH|D%O
z&r;j6JW=y@&W@3RrLW82kC2^>Ga%Fo5!6<buVU{5XrA#`uP?s6m=(Yxe(_j!39Y#n
zA-jF`zx5b44zcdXN(LruR>Ds73Nkr`fZ!RAs;eHOhw~VwuW=(o8=KUkgzq16FJMuB
z<*R+O@D#prIBf|ySy)^P5w5vc$T}o_wKj8%GqtXF5|h+Gob^+j@%)aS5LwHBU^@Do
z2_{tpC)*iC7-svHk6=j@^8;ic#i8~t(wB_!q`-G+GS{r`xzis+S7KKF4UY#_G&y{}
z;2-rc1ui3U(nC0+Fy?cl<EF23q>i80sC1R3DsjnPUs}y?t8Fm1yODY8lSnn2nVDVr
z6=Jpz462I|MI!Gk9FMV6NW6eE+`R|(slAoy$j-v=oG~LJ#C84;*R%?aC{2+6YGy3o
zMAULn%|}LeX`*2VLir>%M;OmwA2qki#Jvh)6&kjYL!eDHNaX7fzCxc9lZYQhAKjDS
z`u{~q=DFYv_egG_tVWpka1D_sENR|#af#fR(u4mD1E<IpYp{NaoIhEZpDI#Q6iktf
z706ZO_s0NnjuFl_O8Fr?Fi1(|odNn824)!Q55tc@(pay}zu{Q4zqe_)+%;50XED2d
zpRe8))Ra~es6i`lx_>(qc{jPcNS-j=<}9gMM<iI*VNe_9SZ-G{Ul>rha`8^!QMz@i
zjNF#XwCh&Ucj+dxtUNViOd%h^f!6T}D|Y;gN<b*6=!~?kUxBGptql`9`<r5>OSiUu
zcTO6E5ox7XZC_eioi=S6Lrs~*cxGrz>3@ekM;l8+T?;^GO6DokztUdK8Wt>_m1j~!
zh05~<;uAyrlT(lO@B+BYBPgNrVV;hJJkZ2~=-YOHjvJ6!z$4QJHyuPq-4<|)dV@AM
zUPk?nSS$vev4^8QN_qG+227r>wQP9nt&gyW6Emeo4tPRVkXSKB&HOHD4>v?Sn7!*+
z*f;U@;m+Qt&Es2m{SdYt1HY{qaJAN}?twkZahuUO%;stzN=99M1y1^9wD?`Zbf&6Z
zPtH<I&WDYB;Fxh-n8iX8aT9EWo>#$7{*Af(|KkEAUY<Lrte>M2A)mpbrDm@a+u?&y
zt{p+qigGo{Jkh%Dzd>92^`YAqvwOC|j9XHFkLM^!b(_6tTW9Ai#=SeOXVG+9?0IuN
zx9T9v7L|Ke?Y}YqfC0w^Kc~s^#9vOBFDu%vXNQ_ln6>1I$1PmQJUYaT?D=?vdcgJh
zjN`V^dHg08D2C6d+n8Z<J4cDy{Nt3(u_-JjZ3h1yJMuojJ3xA5=AnUxz3y0=cHxj(
z26lO83HG{lg@9mR>@RZlZz?1Hux;^kVbtcf4rq${?*@fmGqo}44A_kZPHnfEh7aQ2
zsB_vw`BJ{dF+O6xBe)H#&!cn-<@`V0j{BZ>-UoS0#$5O|-J^@HR5YFg36YNRsuthY
zg1{gG*g-NpO0K)pvjaVnQMZ$?E~9r+iK!qXBp#N_G`$YR43=H+o@HMnNtTzNl$@W}
zY0VGU4p`?z5eC2i=wABPXucE0J=uotyRWR-N0;!$*<N}`<x*5B{ByVd(2e-MT3oXJ
zOk>ls7PQ_&T!46t4|puHSVWisVEGx#r88o`w8ar;eB9gw2OsscCr$}oYuzO7O`U_J
zBzy?Ae0;N1t>peJuU#N1NA~oOme8CT4j!$THLcjq>uNv0b>sd~T=Ye`dIp@y4e1Z<
zwEmcFycxy>Kb0<k?r!*j3c&%ux9I(oFyWnp{aSw$Va2E66tavCVAkGUC@a@J6Hr8c
zI?qMY$~AResElr!a@06eRb%)gq=a(aMEop9cDC3l4AD#xw0DPD_1ovQ5>|Og%88<D
z9(1603|9{z^l~z<s;ct*eqqz{8C|qQAFW$n5$}Tn-bEj+TE24e$D^u-iIdWyZvAxC
zPNDU({}V?*QP=?kf^!SXec%xT{DOs1rz<DwpY5%xZkKtccAIsScJx2bRTn<s2fP=n
zo?eM<FMml%$x<QFhN4m~<)rSpTicmnW%-ni+HKF&>5oOe3%av!{?%a5;Km@uHdqlv
z!xQuqZW`{^s3jvTMjZx@Js^(0cfCP<Wbj*23^QDf0}WkuAyU~N={k3Q!S`yeKSbuO
zyrS+T*%~!X5!Q8+rrZ7J!j)B9`?rKae5n3DXOG;CB+eDv4A>-u#`i*NC;-GCd7!;s
ztJX{zgjbf2Cqle%Rw7jMo$su0%S7wE=Cp;c|2g8)@H4P;le9-_YkBIrVKtSw!JQ|^
zohYG|i<9$HFJ`c1(6m8_7{OAJ|2W5$x$Q8`CifaNoiQe(i#NjqX00pEya?y1cH_R5
zFD)$a7<nK5`WPnit=0mat7fKSr0pgXrUssY5HFeb_I5QFmpjLisi{s%ZtfmBdU`7#
zMa8X&i;E4N6<ZDnkg^kr4OI(o`>Q7w2FB#gD>!?!3w+t3<&oy0)zQ?{<cOh@QWIzI
z?NK<sqbWdNzgr(r-H?zFZ`0nc9+!Yh3{Fwu+=D+omoa=On31p7R%&q06*w`?&{f4#
z=Vj^W_{E?c5U^_>chv{HsNT@g!R7VDI>4L+F^mJ-G-O__h&+QR&$jjX;td1MNJDl>
zN%W`C{!;M%5b3Bh1e0;eG>&q<RrR^JrS>Kru~kD(`_=MUX|Nve3V#=UP4Be$^k4hk
z8S_o{ik6A)Z(Upc;pfWHA;yMYhLHe0bNNm@C_T0wA7f3^(J~ki+*n-oKj1|Xu=I;$
zs!+S=b$1;p3u@Hu+&3C>n6iLJiVA|sFpwv{_U{Nm<TEnT`B!L|j2eIhu&nbt@1wt6
zG1AbrF*7q?8!87lUKzZuwl~GV%UM}k98641(tR||@2;M@ybX9Ce`OhZKO&}8lwvS~
z985Ksb)fh7#B+lHMKRdSrKNIJgHYJ|15MQ+w&^hFbip`i6mYfgF*=cFkf`ORWQep?
zcoY0ly#XV87eh2LJr49&F`Vtr{CCm$?JoL?k%7Ud*8TjB7*IVp$fzO-M)bxflFgvg
z7%CF}FYo;OH%O-mBat3HAh=<yCdQ)(=oWP9;Od+Z&%3(bmmMA)Y$m0oa2qVwSsfjM
zUZ<yU3-Yr+w`^Q|tb_c{ub*B&sy@DUgfjjb`fjS%0%vyoBb%S+TQQeW*IZ`zO2I?4
z-5<YY@jZqozS@(hnL{;kVIN>_Y9(rMOkO`~SwJ?HVIN^{uQs+VUVt3t_~GGWtjJ;|
zR8&R@@g{p)+S(2;UkpK4;xsu<--f$g|HP;?HagnF$ItI6=HYRL>Fo`b?s>NGs5M`v
zfX@^7_0jiwf6O0X`oX*R;<<u2dS*5;MQJPURq|p6`90AI1r4)T2<>4I+lZ#XVZG(I
z&swuhr`na%c7V0fS0M0nM(8Rm*Rv=7(=TlGwe?l~ny9T|+s6(wkONO!ZgJQosNxd-
zYXyt>5E-3#wX~-_c5c2V1B=V;T=#Y5W)~Eayjr?@6gEq`k+;O>(irvhe>e~NPWqeI
zx-L|x1Q-3(tXpwV%v&?!H6dfvZcAN+k0_ZJ-zo3L?itR8$G+(W<x8lCh52dQfAgO(
zbe)er&JQQ>W99mMgHT%)RfKvTZ8u1T!0f*3uxAOs(AnZ)A0M~tPx?-cO+-Pq#;XD$
zWkbMSbe6{MGl*MBRMHpnt=HsAuI|T|D2PR8G8$nfnJ@}+>S`v2pM2|BZ8Vd6>27ga
zJ4kg8^~~}ZZ>}Zs+;P&3+25&Xk`ymGI_)s@Sq^D|USMb_ssYSZL+jK>CgfvhK}8v}
z>>K&NJ@6h+2O6FXb%ws)^M{_Dr6>tGk9+iUHd#%3#1ZiF6)R-7TpOPuMZFESGs}(U
z2BUnmA&H4F#x}9REx1@h7qsYJ)`#1k%oNT$(D1*3)FAZ;8>jK#TLdB)yKebBE(HD^
z-uXqiC}jGGS4@fl2%+sijgiGZcXI!59d>{zZ+q=eUYr{%v=TDVGX{D{Cy)lex*qZ0
z5dO@+#b;k1cGqilJoLTEyW@v;SZf}QzV0jwpA$t{ipTu0@%S1QV9_~>>KeEm>(MHA
z#3Wj5l9g!%HMXWl6FSv*LGgI1oKLgPI(I=2_F|325Cu$K)(F|CAc}i%0rSgRx95gl
zqWo+5wm|o<^+TgNJ^^sI!IvtV$1KE*xqEd%2|2{(44cv9?;nA;dxOnBkG5MvPb=sq
z25p=Mt81;-y-A}Biy5qD7d5hD<(=wIH3|)`dBYlZn)k*UO}3OZ`rUK_^FbWUGTiU5
z%jjjm|IW-e`HJMPkx{y@?+ATP=kR+v>K0ul*y&-mwy&hsIzGO$frJ=0-&%DB3yDb{
z=BlfygRCC!@W5D1IY){pn@tC0p=~ESFW;-HbMPNjmWmb=0)Tz+%okT~9X&rK3{>a7
zSs<L2r8AfX4P1na@;?y$T;}93?KNx!DY>xg`|gHeH@)iUW`Twbw><(L7us@cpTH!k
zys@d#QGWtDm<f#9o?WWXSeA{1$7`_U$7cIgwg<uqz`)(%xXn;3Zfbr$b0eF!Quo`I
z?=|ClyB|<0ByhsWtQ=Ya>o&pU3ukaWy`_7|!gFa&wT8pEm&E7t5BI<@@GYms?+y3U
z^&abOI3nBTJ}tp!Tq=KNI6qv*T7uaBj@AF+ww&blOIWBNg6Ipv{bUAi4o36$_W4?a
z-L?6a@7Y4OqUZ0w)7^O_n3yd^5yWrgp#SJO`3&@v&gOEke7osK4wGCdM;877P=F+}
z&DI(Z#n-yL*+1X6fk&5FoOT1C0Xa%ade>F&-^Mu)_LS4aVyT3wmXg)&pMN(mA7@s!
z<BFAlkC`iXw^HC1+aI%7|4AtI1zyO#{TR2D5hH&y9+!HU>I^J~XX?rb=G%e4dT#fd
z7Giye(<-_Y21Tu|Antb^xynXlR9vUJEYUz<53==q1TlQ`d_=Y|Tk;C%YL+qAP#hko
zk%bPpK5zON_duJi7?=I(puiYZhkAB)%Q>~}hI2(d_3*kLX}h@IU&|^e)P>}|9i&9e
z>pAs|PXmqTEpIS@A3Nf~{;P%+%yE!T!W(^|p6d_0SkBx2J;yve+9UEx3c$0X{})Fm
zxY+Y9DvQ;RjqlgFbH(tKl+-WmcE`cCZQF~-9)D7BT^wqYF#iue+(eSLY}rB|eDHzz
z;DZma<^Oo!7himlI(6#A=5ZdE_v5opKWkX5cZk=g;{E<t@aLytkmP;GBL7)aXL(xY
zmptyWJNGN;cDn!m2WZ>2?Noo@Al2<ZK(!6~#SgW0R9m-?_B9-!y7~rDSKmNpR9m-C
z?5(Y*Z?^BG%P+qI$$mx9pYh+0Z9AToOgYB>=64emMg0!II&#G6;?qz5O|^CVsea!<
zs;jFLb#-+lslL8ePolPV5AEIiBh}UI6`^DGw15A8nm2DA6%`ecOZ6V`d4uz-s;YQu
znaJ<VGe>u9k&^y3tO}51ba~ARs&ClGRJX65_SV%h)i>-D_^*+EKTN34?|<0Cl4E)6
zHawWQ?9Mg!-+zBjqV4#LGk@9NlB#U>I0K@zRU7)}KQ_~zz5D2(phInA;4kZFU&8@`
zc0@bjy88MC+P7~%4}Kjxc80nE76)64i;IUx(@mQ7A-CIG4QmBhSj?Jr7wz8toxrof
z1H9_@?GL?|)_!Og5WgGhQM(rJ2KxBpPw6+mxr{AuQd83Q^y|~_l0@5!h|)_+N`4!b
zrmw$|zW8!$sQ>EfrMCW1KRVQ(>S^!Zz2W`+`x?aFANSC||MfXtbisve{bIK%I|_0O
zF8Mip|3{5~vM(2H<cOu4iS^v$jsNJ;qccj2S}pXd9${@^;c4*x{RhQ&d-l?|Kki|$
z-c!Gi_Ux@Q1!o;dGwnYh7_jHed5k?SRmJ&D+g5FVnN0b|kDoA6Rb4;8jBvsg*U*mb
z-_qXN1_mSJhgDa%Hv+8p?W+S&i-QOE(}4pGv}eyAd~o86FTS7-9Xhb-UuH0OxdiG&
z>VMeaVcqOjb(gBRsY^vy+V$;j`eDzH{Gm&dV7;eyFGyf3kJZ-KiSTv%8pMx#YUz_t
z|0T{i?Mz6FBEu8daL*n06eZIBI9ArO?J0JPbDPWIql&IQX!ouks9`_Rk9+E6JB0aZ
zBv4PFy|wiW=Josb3xH>BZ9Nlym6bhN{gINAy1Q-L4x^-=G+w(^RaJQ{7Ta1Gw0_>a
z*F|03zR)1haDaAy`+bNP-mSJ)4zxl7HIojgAq?!<Q%es%_%K@zDK<xa&&uAnB+{?7
zdP^%QDVgAKIQOAEFTVH^^GCh!t*aGUyYSZ7p8(Q$$9?<wU8#1@UfT1+k0cHpr0KU$
zqs(9yR3G03{lRO@2K(df`=_JKKjyD7FVLL7V~PKlUw#=V%+7n=t+)WxV)^nK+P-}!
z?fmY0`f}Shv~~Lq@%4_Kv~$<DwC$T6^!2vww0*}efh`Ef@gL`Q?f#Coe*FzgY>z+w
zB(IP=9j>kAC8g&kQ~oP1zv3E2QGdWkcHMPT1tk3MzW<T=?b@-EcJJIJcJ16wJGO6Q
z+O>1L*uCo;+O=~V?cDLT`0m>sI7Z)nyGwk#dnbMW-ENkMI(O{E_TqV&c?*-#r=4`t
z@Cr*x`YzZx_vqD=KKblZv18Xx+P3{0+P-rKNPPFh_w?n~uV}}voqP_2<KOJqF0WzQ
zwsRNP6Q=m1&ODoe+G%yJe_+-Fh4Jb}{@RqbAD*77eC2Tls88<!^wpQ&h~3|QkGjWf
zMr_})i}{D%Wjld(?%YnhcJ1Ky`tqx<xjr%T*|~E!h=Fm?pp)2sHzg%?S9y8)nThtr
zs;Vl7*XvsW>9wGsNWApYE3{+BF7zXTEqFkp#XIiYxif<Bo;!E%5~vdZI<7_k!{G7g
zqjT84-C<YvcI(_N0;psC0Mz;U`Bz%4_Ij+9%$@r(5As{T-XZIS+X8Kaci6RSm%w)W
z_U+>9ufL`pJ9aRA`|Y>1ZR^)!_s(7P<M%(%Lk~Pix!E~nO}Fgs+@bT8M?ylS{{j4I
zG{bnx_Qt&Y@xmV~_~k8I|IuMl>KzsZ`e}Om?RN=|E^9Vyq?K#e(W-UpX~V|1#p*Td
zXw6#Qr*-Q$(yG;K`TyE=8+acJj&Hy79_vN#z4v~~%gGmZtMb`J=l%M$WZw06m;LTC
zr_=o{7XPrQ^!LBNPpj9g6VQ9ETeFtdu3kfHR<8`x>QyzgYGpO8tXW3u*5cR-TDNvJ
ztzEN<YF1R!|NZ?v`gqGn)S+E_IF{7Atm?Dz>Q{ek)TyJ|rlq8Ag|kOiPB#7DKi;SH
z8#nNR;<^p%d4J8iwe<G8@6g)y>uB}bHB2~$EfyR>xPIx18nN-McWC{Fw`gGhK@8MB
zr+3wy`{zWcK4QJ!<-fhMzb(!2iNod=mEC*Omd&4Xd!QY{w0<4ansuvb_1aamYE=!b
zT)Bd3R<7oH!~!4MYxU~2v~uNY`p<v9pnm-Zu(O5T?)bX6xHMtaM^#moH8nNu1+UkC
z5PIc5|M{<>He0=xYHC)|+O_MspP<ZZ*RB<7)~um*>(<f6jT>phTN}9!@&4#n@4WLK
zTUq@3-~XkD9(sf=V^UMnzVFww-`H61V5qyava&XpwP=x63&$5c=iT?-r}Z1&K^q9P
z1KNe_Xzf~BwF>pHn)f$s*g)0Q)wFWuO5Uzsxr$b<sG+~T`<{SA?R9%dRUA8}Ts!5G
zpTqZm)c7}LM2PpoiQIR*@rSuzd2#D0PMhOLEGFK1YnAxNKRyu4YF3JsYuAaIHEY>y
zYSrqsFhditFO?s;v>V3$%2jKy6*%|tC!dM2W5<$Wvmf-hJ?kI5@4g<%l>dh7ZaB^7
z3;qisV22DjnXNov;s!fhtj5E{ORmgUS7W<`s+TXO6*Wu6(q#*2;i5MLtUo}jR;>~M
z1uO>n{eH5gTE8#I%)2Ggy2i0rUwt*;cX{8orCJZDE+;+z;tRC#?YG!!02Uvx@K~|3
z1|$H;)hm{>jX8AL%WGEfKCZzzm^uQm{`A-r1PcPU({sS@^evt>YnCU`cY5{J1!bzk
z`=(3vHk6gMVapB8q>T0F;17P-m+u7NVenaA!=MQhIBv%kE5+*7YsI_o{!O%QT@Gn_
zpTpr=Gi%nYj*0dsT+^{*$EkL^<3~v3=tBT$*l1T*uV7o`b?Y|J!i9@zRn1CTQ4QPV
zYJxRIb#*mcR={MCt%jB@$Mxd>{_h{W0F2n}>8X})MvofZJ6^xh@0XUAo~f#?-6<)l
z;@7{vkQbs?)U4sbQfn(F)Rku1$#sTz0l_k5#flZ8rly8gtXRPd(xXR@7OLV9R*U7|
zQzlP7I~M=O{OErWe;V~mM1nYyFLE^aLl4=bbHymP;`$nDf%fe?vVIvhrqwG~F<3(i
zgqfEFWSHr(G`40P12sStA3X@y-E{M<yl|%~jsp%wdCe#-#w**+H{V?1a(UOf-QI(6
zoVohyi6O5@&Ae;*^5twY1;AdkXaPtpUh*bMTDhv47B61N01hyJ?z!ivb?eq-wOZk(
z{Y_DR(WqGb57V=KLN=f3x!ay*+iS5|Y2>M=h&SGx&yt{Ko+luoN#NE1Ai{hRw!&=V
zy`n}u@#NDqe8eg2dYzh*_Ra9YLod?n1mm^;!i5WMty`5(QEbj{^YaVE`0*3CJ$TSu
zStAFCu!$h}qaHwLJ83G1d)BO3M{mBlkgBStvHQ5w>HZ!LQyVvKbjPYA<8REEF|AWl
zQa`ub9im5%UiAF)FS4YLK^E&C;IV4e8d|=rT2wC$wIkjKAP9+88|Z2I@)`k9zvh}r
zyl|%~&W5xW=}X3r9c$|J5$!j3?%dM!bn60_%fou=yYKlu+u_SWOgE5)i3i#0Y9Y-!
z0oV%`ED$i$yYtRFsjRGwUHMf-sjjN33R}fA*N^@O@h9PjC(5|FN2+6q|7)+kR^YNb
z|Kzeee?+Hl-@YT=I&C`r@$o0<#aCXXWi=r?SWKHW7h47ec;{)c8Q{c0Pd@bwT`}P*
z4(y~T3ON+Vk8R7#r@@#%nRkPoaGN&mZ*@4F-@^qMjt{>WeI7mf$3KZ@pZzndXQVwY
zz__MnITP%tAz{Dv+N<>9i_g<D&pbtU+;NA%2bPtUgOHHlJJRfrO_(qtH<^0HVAj60
z&FOyC`?=z99z?(&IQ2aJ%yZ(Yr=Ml%6!ytb|L6xa3|z2ThNK9);-{Z^j_!ZxVd~Pg
z8>L%pSd?l|74?lr9(g33g(J~=s=BGFhu7^}o1Sh(EMhwC^fOUE^upX1Y2NFvv28NI
z2UC3v9*_(%xZ%C<zVlvtgWC&caOa<Y0WSikrCAQ9rl!9)ZQ9KKiL{gPyw4YSC^a>`
z9`6I^5I9af@x)WCvj$+ZguQeb)hu7Z?<1vZ5P<xJ7v|D4&pbyHCr;+%8c+*a)2v%d
zi%Ks|w*RBg4IFsV<!Ncwt#Bc4UDl4SzUEqb;+bdZg_mF9Py=x2lD7Zs=B{~bN=K;|
zUVMq3eDZ0UHth~7FK^3s-IlcUA6ga{&wBRRXTynNlWn_W?fXA!{F7PfZ0gT!b@X`S
zkN;zSdBGsB>iGw<M5LsoQf^_9sOZs?&N%xV`qhOO(Un(SLlY-mOSj%Ooo=~x8o|@+
zcb8wm_Q0dg{)LPP$Dt@WFuvD|PQ78mgb8gLQ+}u$0)gN>x7&LFi&TgbSKg)_+j*aL
z*4cE)C700n@#AUY#H;E0>!&bHoOrbuGv*??;DYmM<jCQobLWnfk&!`8rxRs5kdcwK
zwz5N)KFNfGl)wA$zu#NYuFDLk%ku+LAHkIz5%5rMl>d@Te@j<gJyG0v(=Bvc)ik=b
z>UMG6l<Vp8@e}C$UtcH?MXsV-CGy>IggHcmYmt(=wW6Y8L`oxma7Y={f6#9gMg5i~
zVV8&U@(ab#VJFj>qt2o+mtG>So_GySz2SP0xbC{^#H2}+2r)Fy`Ng?(>S<?CpT7Os
zix5GW(B`V@`nFrQ%IRy@u8o>wFINAXGUcWo!C=-qkg8$k2j{7F?K%)t7-ygT3rPNS
z!_@2Pwp(tcs;Vlw>86|Ly6di^2@@u;dg9bmPp2+jDmXA0LjQW*zP*Jxg^%^=+NUTH
z{`zCsKK}UQMIMj;6-D{~@~#6qiYv>u)TydE=T@s*Ikj3KA%OyENLCiX0+T%+8{3E>
zC$BwgTi6mpIRHW;iYSm!LRiLQuRWU>@7ibWnVmgnXJ&V>3C7+%8@z)}GXL+npDsp&
zg=n>K5Uz9nsa92~-|P4OzyH<y@4u(Ify{|WsuUCNq3IJR(OHFa>C&G($@=h`wd)DC
zm_uJ{*KJ@jnmwnGZAyaCf@l`GTnYdES9YtludS^u#25O5@ho{j$4I3AwFiCmo%l*<
zsI$*VqJOCJkV?yI+XO*<3j<%O<Y<6g!3t<fq%v0X?slmqR>P2$w?e*LB&%0qU@CbA
zKw>INi9~WU#2NDPKw)sc{C>0v6DBN^%aurs&eB!F3YALbEY?>L1Z0&XMx&9K&1PaW
zV&|cn^1PA?0!O7%DV51&)cYI;*-ewlva_b9hWCa3Kzz>1$)D>84!wx-UP!|#R|o{f
z38XTPfq+=PNvyMniZn=#i9FbHg+Qe;jw*!P3H2c>i^=w0X67uHzxppOF6MMP-9JjD
zQX;5TlvfEfP$s1^g`A}a?O)7Q%x;Iwg>nVQWGPp0Y^y&kVBF_8)o<6VSrhAT|HI@F
z9v=CkTCGK*A(meq-whh@U9$;StD|P4iP&s5YPZ{|$%JxrYWCKI=b&GfK~AkhDBNdb
z$BbR*OCK7DPyAnWbZn);V7eYCRWkjc*n^By5jn5EQ;|ok!h_FZ0Rc&XoGLjr#s4AQ
zE^?#?1S+n%V`JAmjN@PO9n$xkkgw1C;?o%^^cxx)lvacF2zGMm^+u90X);MkOQ+7T
za2gyM#_ICjT^#gwfz;bTfPBA5P05lC0Sx5w>nUSWmP;fOzZV)ZGBOs*WQs2_z>`zP
zksm+tBuz;fN28)*sMTtvX0w@D%(u@bYPVb2*=DoQ@bGY&o104t3JNI4afoC<!l}l0
z?vuNBFnQ(8$jWmBhkgX$oiK3<En2afj!PX+L&Ku(6hw8p!tWH=MFn(kEkY6#>tR{<
z<}Y5tCN);k-DG_?Cnv}0EB%4)hlGT@t<h+xD>Q^oe`E%Ad*W$WL^!Ki2%U*_EAjdd
z_XZLjiA8WDqhe@5!7Kuq0wfg*?l-Get+EV-e*ZIexkg9Fu9iyWSFn|Q{rZihpkNjq
zGbV+=a!06~)odXq1LCdC6ku(!SO~z{=?tORLAY??Vp!I&rqMo0PDq~PEB(6<0JYg{
ztq}zEHRuHSw+rUXC5b7i)ar1t+Lv}`C_!Oj)WWm`Iaw7TM{p>C&Vn2vELZokr;AuI
z0VSutnw*&UlZSEqf9Ldv>Yo|zY%)^m!_qY9j3-no%`I40$c+HM>WQ|K1isAb`UYBF
zT|>6KQbNnNRgj9xYMklzhF#=f%Tapbcn3Z6`df7A;wM;MU{1l`NKQ;%Ih^00k&&@T
zDpOp6J7rpC7Sfjz_{<L;Jw|pm?*>2g)v|5mm91rTYgsuhuc%_7SO*RqWU;fSPMxOD
zKlcLSxv^>DhShA_{YF3E;!x$EJ@t{?AcylK6hMH>2R_aAlbz(y;iGhCV-u~au4Ozx
zHfZ>}0sOQaVm^HMh4<~*PnB|xEhIV}t`9RaGhM^czs+uc3y~;rV;ni!N;^;W(qnDy
zw0YltT2)sM`OueNEuk-Nd4;vot=njIO&yCm!SiU@Ie8S5hg`w^^XAQ)9Ydkt{{T=&
zghj386#Ny0R$_-DQqHz@cF}{at#o^HGm{H=*iyQcmTW7h+p4N*O~ZD!9&+&LG4|}L
zb?ez-1f>W7022;LL_t)WnO<-F#O-zuX;<srYaKRAaIH>byl&82>B^t3V@a2w3+QCW
z&Ruj{c_rfq?Uh$cZ}*`cjT8&MNJrb%eTv{YOn4kG{4sUR7#JT9-T415=-<=i{ziyB
zB=k{h4M43{YY}Nd;cM;g>1E)8*4loO007W&#p?j6Q$2mO_tfjOy{(IOb@tL_Pd<yp
zM^r9V+(;ai_-8;p)ZdYoHhzgzruYItJ!Qrtq`j+~ws&<C3}!3{9cybRM~<JMM^Ch|
z!Pn8*ja_K8v$LDFw|9_^jxGk&2!j(i)%74t(4PK4Jydzl%E>PXc7}We*UsW4k7Lji
z(8Ykp84Zh2kj=@CE^@M?i+x7w*N)C^a;)_P18NiuKwe{~!}Y7dENWlmW(%^v1E5Cg
zRTL!X=sCsO$?hH|Cp5^dqvsUq>OIXC$iOdTh4Z1qN8vwbK+Oy44>xVvWFHFsyF)!A
z!y`8!$2St;my~Q}v@yB1b$64a?d^;%<OH3eL5HpFC(*y4Q-W)&*Q{giGo#V`sVCMm
z*WdpCC!jW6)9Wk*Kn?oP3ycux26_>7)ZNodkoB+sGiaEEQR!Tv<gZOgO<(6L{lPvD
z<@h1sk53Qy!pKm~{E<c<K5D(r*bW~xLgJ8r7pw3X*yzMPul3R1*U#MP#NruwqLB;v
z$l>D*tdTofsZaroZl<QBuJZTy<63HJ#^V5L_*>ypX+7RXTaFy10A~z-fB=99gB$~l
z4Knc7(M4NY4zUOV>}<p)3|RO!Yf$q*K<%siv!_m-=?He6hqbq0A#y->vq%o`g~<yM
z0{}lXaiI5{I?aFpAdNSZ{d*6vZP6$g;B<t10E>D!`nLtye<1=jEPK#qAk=%BS+kv|
zdWk3}$P5z+?jJwV&fWy}?mNIrVZoQIQfdFGxVYFl6#4@JHLn!DfS-BGmRISaW3A-C
z;Ul!QqXS^gKpH%r=;&l`N8+S=xb--T$bdXou3E$DSei_h&*I}p&GVK1-3Nd=$mXhn
zMXl4C>58H?cP3P1FhswGZXgeF0znQI=nVZH@`2tOcQrFt6345qC3;3Z=PUiYW#{kx
zhZcYQojD%VF%s#E7BzqxtM%*GZ=}0-?}atNTps|)mLo?Q=!l&f*4W;C2WfpnBdx93
zPT>N1;>XJfvfe4>+>LQ5<5mpkH+X^i3V<4Q^bQ_6LJ;1zqp6whZ8^w502Uats*fFK
zuklSyyICAKc1G^pxr=VxxS1e|zzft(ZEbB|TTJxzD9Fssx7i&Z!`ef><ksVD1h2_>
zH3r}@i`HwQp<%Ei7d8fZeZvk~Ti3vV+FRNRJ2x3nONMb+?6!BXkcb+E0J(<kI~lz_
z2U?gb;pmCBI~FS%Ug>ckyudBf)VznqbR+AXLc#sR^UptT@|PEc#6?BKtjCsbxISKf
zc?*g*FrC5ev1{KxCL@3!bO!$RA398T?>|5r8h6o(np)<PS-ENri?lEr&7XNZp1J<^
zfB2|_?7`IlYOMw(-Bz*hM;IfDNr*r!zF}Z;MPJ7~=+)~YB6vQ?;lvxq)r7eCjlR<V
zt`0hq=nrQG@Rb2y{68awJ_=+Sbf%+fL30Z^IuOeWe=mG^HMRAuq2t2uSy@}h{;sU5
zq1(!<X-R20!G?lkt?hK#Q_E343*lbZM~_ZgHk{u-c5K>GnM}b_XCe#^g9!ds_%}<-
zD;OUDf%=_|L<B;wubRDfH#F=Zn>Ibi7OHq&b=~0zZX6C!Pt3^3x7vcvVIdGXw_!=c
z5529tl0X)soa!5PFaWQuYasA>!k1rFT}zn1dS46M77d_w*d6cXOu4`7V=(<&t=7L1
z1c9Wbk7x1$9~G6=Yz+Z4MV|0k^qWJc$T^M}YD{Vfi$hqZT(0<KadEM6DD>|J>gdSm
z)dHvb96()MyoG@rbb_@6=nOnSPj&U%|HKRKmuw{nYsB-bR<9*kC(-GQmpyTwLSN|*
zbT7#6szz#C^hwm-1W<#%C=192ywufiC-@r;@&jKbrDbeVYu>$=+UySa@UM+cOkVde
zj{lKBf50#OHfN>p1O5I$Z8h7-h7FtOjvb8{L=0@uaRE43z$>e)5&?nj_ySnteCTj1
zT~V}}qB4tAD*rM)J$;$4^!uO1&*R38TY~RF)Q1SvSbW-AQOOpf&@lMXFsQH?ghe3?
zd;m50-?(uzbvT?T>2$+tb?h9dVzaOEpElt~IcAIP4+wih1PXu}asWNZ2Xew>Cdx(x
zAuPV)8UUhY|3LsXD~@Wn+RsjzlH(kX{w)^E&k=$s0<{Q!q8z|eWmOHMkIy1M6%|#q
zuC9SJHSMN3Ie9E}j^l)PMWFVl|6wsPCNgFvujE-mE$nuL#a_B~8!0X+rC9U@7z32S
zUrA{hd9`FK(;fO2_y#bpUAvwEwML`6?2d8YGwS1h2Y!Ro5mI5$nXln3uW0#gi@Lg|
zj<CL5QN`o}nc<9UXz24IP&YO2A$VJY>q9D2Tun+Cec$jrfB2OAfbr*RjQDzeDBt7D
z%rO$^GoaR+j)*`FfNN}QB3QXEzYWr?bHjQR2NfCsy1W8FP)8569JvG394CA+b?S^K
zhx7ZBlgBL<lhIF{IGMojEJk@?;G@C1er0PJ!JxvR2XEpkJ_bD|9JoFNL4CtwvHlrQ
z4^{qKUV16ZV6yxk7Bx0S;I-L1z}dh?6Qf~7p!5PGyABXPc;FC=_<)bvYO?+Pv}x0V
zeWgDTzZQ$-4V6ko#*d%KeDbi8D=|p`bTEN<^@oPfu%vOuGj(+hEJIy(cCHB2X9shA
z+^_#(BT-aT%nATCs&kjTQp&O@f*$k(S$F}Oiu%H?Klrk7M)3kn90=<JP^$&arT#$e
zPyct=ofUem;ksUHqD5Yd8dkIzozve45hn~xAYPy*m}uZGvf6@(T)}-YDlTs2Q0R}8
z@&B#TABwqsui0ZT^ZtG_&Pb+@Dji0xu?3Z_?baYvB4_?y3^F#ry?`TvwAVT#TgxiZ
zXjOGRv#6ha=BGrfF(NMa^Nfs%j}Pbf1E>Q6q}Kq{li;I1c$kHoi46da2C&AUM}zg|
zwX6vSB^DFm`aorEtJS_k1Zscezq_$<hRJOG9b%Ea7Bws~HmF5#7AG=sV!JJ)as~=`
z#Xi(>m;p6*-kA-Sx2H^*VjqtFEfz~JHjGS|Fo|M&eI?u;6;%LcQFnJHTQmSP?xWS$
zZzp^9>|?Rc*pQ-Ba(}mB!v^zE^&}oFjyfWGInSy74@D!&O1EJPHlq*ScwHP6A)aUe
z!m_e*0)X~TAk4zY<Z9HL@aA#xUO??@{|~YSZ`G=G*AO!L?9(flYXv~<4WWeYMC+Pa
z*f@Lj$Si;6@87#$Tui(&+U+hH3jL8X{w3cs{reu@q|as~(`P_!Fg6=>##>1Ezj@<x
z<V0&5tN2n=Q%A5kS6{!KS&#r6ScjtPqqc4b-MgoSc6OYidAYNwMs0vk_<tu({L!4@
z@SL8WK0iPb_$92*<fIhZ)zQrsdGM+#T4$maE4mq~@QROD=*A`%s<(Xk3YK?*;{@a;
zt{cep;p<UfUq8`mbNm{+B<DT0fJMW=?=1RT@A&b(zD``nH4Jt%Sm0hCHBrjBn`VQ#
zuk?jdo4@=(mKKYp-C!^fY`sQK4FDYy?gNlTV1||L)g#?rzk}A-Hjq8ddnsD`iIX%h
zC!Z~Fs(AI=YuB#T4~72SQ5H^T=rWx~|3C1-zx-k`(*gQTf2$so2qp^A>c{ok>N>ik
zVJAJ=)<M^-TFVkL8TF>~(a~}DOp)tLUosobFY0xMFEuJXU9?~+i=T!&1N{gM`s=s0
z!1|JRv6Vf8g+{D7U{|h8uDp^E8~fx?==;O7ug4FH{{8;ZSHF$F418bc;~Wtd@v@3n
zUq=;-d4-P=Sbs>S)7N)~AXE=wZ{F}Tf>m;aHJyI#4T|d5h@nPp!-()0iaLIQf%5Y?
zIXUUR(jVw>yWKMaB!Qoy9Fr?Jgju5qpF+GVR_Mi0FMMY0WGBnohIE>!G6Gi#+vTP=
zB8mVN)?X5f$oeX`{`Z@jn&Nq0{SL>gzValDW|Ni}hKDo41MwN5dWin;#^JKqTwKEj
zndQ$Eq5KwHA6F5D^1%lm=!c_!hr>~+)9J2-goLpu3+Si|VSzop1j(y95YLUM2JiLm
z&K}y^bDH*@ex3gHJAXrKs%mMdD~yIXLy@WOxL8EiSNi?$p~c3=&l5P+W#}w7JCD%^
zAK;;<r<ZL+5*t7qXMl6($u5G4_}GzF^2qc|BxSl~)SG`b$~|hbuk;7Hp7lu9QnjG@
z6xDggr%z%QHTn&7fz2<_i?^UI!5Ojfh)g-v`x^TjdYv?R3Q{EisIQJoOn!7I^he70
z|E}l{`^$V`>OuH;zEAXvii$>SIQ1o+pd|q7^wbQRpIbm@70kv~V>)L}A<50nr&(D!
z?C)8#=FnL)3(11{OPD1c9p$ES8BaK+`l?ZH>X<k0DdTW{e_vmp(_wS8A=FR9sp)9<
zC^B!}e2O-A?ql@PN9Qu0=FBN%pK%SzeV%^m8M@%Hg>-E4I5Fol36KQ-YhprTzOOtC
z^c*5atXA6*6o5tCvC9=o)6y~s7URGZcz|3WBP5Q3d}hv^&92X%zmOnzw8I|EENWSx
z{0n!id+oh43;L@6goK1gWir`+BGa7H;i3h3Gg;-B$L7vw?a|qVboR_SxJC-+%%zJK
zET)SWE}_pXdzO6$NMlWclXL%_nv%L~xc#rTqBdD0X#ZBH(SL;uc!{HuC`yhkS+taZ
zx5C1C(3!{+1y5+;^U;DiG%hlh1|e^XN_WesF`OQ(g1s-gTvN0rRvIY(y_VP9(()P#
z9Za1%o%I#)0bM~y`0VZDbisl}G(UePyN+}Ph+r`q%{Qb{+1a$TwCIO*{C}(ThcgiU
znK1_Q>5N4BaS<`k%OuiI1Wt8>Q}DN7{lTXSs}%Vgkgy3Lg{1yS`zY{Qs?`{YL2tRm
zbDHZ$gY|QnlzV4%{OIYv*4!K9w*+Qp=1kLSbnnR}vg;VUSoA`~1n9#h0{=CDkMX0?
zvwMLODGPs7@#?R1TEkUTu?}&DywpFPsK4^Bt*s3+8qB9vD$R8juf7R>;BS^n<pdj9
zyno+LNTlFdYD`(6oaNHcsI)gx|4%7X{)flyDS7Lyw@ky;|AGYz97?6K+o(7FQN^oo
zG1&+j76OO{-uhi5sC*8-u-FIr>9q#v`HDu+yzWolkpbKvyv1aDL95pN7jj8s%>%A9
zxK>OCGXdza1WmVjW0R;}rK12*RM0VM3^&zE)io`rerw5sC3i9%`rH5U29=wYyGRir
z|973By^2(>Y{QX8N6}x<Z<wsS{R(|t)FaNwm<QKMKtSM!F){93dROMfhi&{zz9sq(
z?hE{&@i5S@tgN(#JHwxG1-bU>1nqk!qvf1IXFSg<g$o+B?t)IEzlcR1UMXBcJw&bA
za7iub&TBQs-#Bcp6G1lDUoM)rD7Cn_c+d{*>v8t%S^l|=&pnnjDyde(sov!j{5e6+
zgP-#%g>XUOR2MXy`l4FUT-5NI3pzn}QOl{%8}+7-bQ;}RomRIiEG%L<HuOjy&@p-P
z<T0VHutv2)_+@}3@ME=7^{GOtxU5nLpFl1$iR=Qe6fSa7<%K|r^n#Yxd?XE!o>MDT
zzc%Vk2R5wTwCc>6Gd>kl80_%68>GcQE1o!c(&S2u$@UAq)^JWOXwUO9?h`cdq*kgf
z;VdY4_P18hUec>{A6xa7-#Q(xu4z+dl)d=;i)jzaLMtsT4O+Qk<z}1N*2YPd|HjL>
ziwcSCvY_BEa|-?wZ@Yj79jX*emmjGWs^0|}tv?Sk+iLQ&^E3RVfA>8~sWRLdz9h(O
zYqptf?`wJOd4)`Qk;z8TTv97l=+76>e-v`%d6Uj`PT*7@YdF;(I0b(;IwHFEXMgdt
zd6kuws)v32fA8quZN3lo#l8^rx08P#>B9=?>+7@3&Yztc9}_=4(UX|viSuM7CMITi
zJf7^Nq_Me4qmpuy5|Z-9j2fGhn2?g0l9)1a{P=01|I&8vA_2qs{k^@tLTp6r*tn>;
zOm{>~Zfs<1wg)ZN!`i5r_#E))j&QSkcrGnDEd}9bgH?<6SN?Cdy{Ri&R+JJK7L^t5
zaLtSgi<%V?9FZRy9GVyDjLeP<i_FG3CNv@!pJO6ormtVUe!K|K4_g07F<Mwq=!uVy
zpB@*NkeLwe&T~h*^Wq|+^Y66qr~(u~h>MQP_e90c9Gj3drLeFt;@r7&+&9tx>g(%6
zJh7f>QJ@>=DTob^nu*WR5z%?k(b0L4k+IoKS7C8kUR_R08<Q5lue@CIp!+}WBcdff
zIzBCm=`6e;Bse4=I*SaA%z>`LTwz(@#TDerigbo$vvWvf%KLA=uNyA?ku?4#-!T3E
Y2R!<hL#N{A8vp<R07*qoM6N<$f;hx7iU0rr


From 43d6159a9bd747e6465837cc5cb934aba4770c9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sercan=20Ar=C4=9Fa?= <mail@sercanarga.com>
Date: Mon, 29 Jun 2026 23:55:19 +0300
Subject: [PATCH 25/31] fixed ci tests

---
 .github/workflows/ci.yml | 24 ++----------------------
 1 file changed, 2 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db4a79d..239399c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,28 +22,8 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Run tests with coverage
-        run: go test -race -coverprofile=coverage.out ./...
-
-      - name: Get coverage percentage
-        id: coverage
-        run: |
-          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
-          echo "percentage=$COVERAGE" >> $GITHUB_OUTPUT
-          echo "Coverage: $COVERAGE%"
-
-      - name: Update coverage badge
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        uses: schneegans/dynamic-badges-action@v1.8.0
-        with:
-          auth: ${{ secrets.GIST_SECRET }}
-          gistID: ${{ vars.COVERAGE_GIST_ID }}
-          filename: coverage.json
-          label: coverage
-          message: ${{ steps.coverage.outputs.percentage }}%
-          valColorRange: ${{ steps.coverage.outputs.percentage }}
-          maxColorRange: 100
-          minColorRange: 0
+      - name: Run tests
+        run: go test -race ./...
 
   hdl-lint:
     name: HDL Lint (Verilator)

From b67d3cf40b8dafaa27710a6d15b972ea0616ceae Mon Sep 17 00:00:00 2001
From: VoidChecksum <89574102+VoidChecksum@users.noreply.github.com>
Date: Tue, 30 Jun 2026 12:14:54 +0200
Subject: [PATCH 26/31] Add logging, Code-10 diagnostics, emulation-gap fixes,
 sim harness, and ILA debug core

Logging & diagnostics
- Global --log-level/--log-file/--json-logs flags with a tee'd file sink so the
  whole pre/mid/post-generation run is capturable; check/validate output tees too.
- code10_report.txt + console warnings from build-time facts: BAR0 truncation,
  per-class FSM completeness, intr_req->cfg_interrupt routing verification, MSI-X
  BIR relocation, all-FF/empty BAR, missing MSI/MSI-X, DSN, link clamp.

Emulation-gap fixes
- --mmio-trace wires the donor timing histogram into the TLP latency emulator
  (was always the synthesized uniform CDF).
- NVMe Identify: model number disambiguated by DeviceID, NSZE donor-derived,
  no invalid all-zero OUI.
- Zero the full body of pruned capabilities, not just the 2 header bytes.
- Preserve donor AER mask/severity instead of canned constants; keep status clear.
- Emit pcileech_cfgspace_w1cmask.coe (per-bit write-1-to-clear mask).

Behavioral RTL (sim/, iverilog)
- cfg_w1c_shadow, msix_pba, nvme_store modules + testbenches + run harness and a
  make sim target. Integration into the full datapath still needs Vivado + hardware.

ILA debug core
- --ila/--ila-depth insert a Vivado ILA probing BAR/TLP/interrupt signals, with
  advanced trigger + 2 match units/probe (arm on e.g. wr_addr == CQ0 doorbell or
  intr_req) and capture/storage qualification for the small on-card buffer.
- Generated ila_debug.txt documents the JTAG-only pre-trigger / warm-reboot
  capture workflow. One canonical probe list drives both the TCL and the SV.
---
 .gitignore                                    |   4 +-
 Makefile                                      |   6 +-
 cmd/pcileechgen/build.go                      |  53 ++++++-
 cmd/pcileechgen/build_test.go                 |  39 +++++
 cmd/pcileechgen/check.go                      |   3 +-
 cmd/pcileechgen/main.go                       |  56 +++++++
 cmd/pcileechgen/validate.go                   |  17 ++-
 internal/firmware/codegen/w1cmask.go          |  58 ++++++++
 internal/firmware/codegen/w1cmask_test.go     |  63 ++++++++
 internal/firmware/ila.go                      |  93 ++++++++++++
 internal/firmware/ila_test.go                 |  71 +++++++++
 internal/firmware/nvme/identify.go            |  42 +++++-
 internal/firmware/nvme/identify_test.go       |  44 ++++++
 internal/firmware/output/code10.go            | 138 ++++++++++++++++++
 internal/firmware/output/code10_test.go       | 102 +++++++++++++
 internal/firmware/output/ila_wiring_test.go   |  37 +++++
 .../firmware/output/latency_wiring_test.go    |  50 +++++++
 internal/firmware/output/validator_test.go    |   6 +-
 internal/firmware/output/writer.go            |  26 +++-
 internal/firmware/scrub/passes.go             |  29 +---
 internal/firmware/scrub/passes_test.go        |  66 +++++++++
 internal/firmware/scrub/pruning.go            |  16 +-
 internal/firmware/scrub/pruning_test.go       |  45 ++++++
 internal/firmware/svgen/generator.go          |   1 +
 internal/firmware/svgen/ila_render_test.go    |  36 +++++
 .../svgen/templates/bar_controller.sv.tmpl    |   2 +-
 internal/firmware/tclgen/ila_test.go          |  40 +++++
 internal/firmware/tclgen/msi_test.go          |   4 +-
 internal/firmware/tclgen/tclgen.go            |   7 +-
 internal/firmware/tclgen/tclgen_test.go       |   2 +-
 .../tclgen/templates/project.tcl.tmpl         |   1 +
 internal/vivado/builder.go                    |   6 +
 sim/README.md                                 |  32 ++++
 sim/cfg_w1c_shadow.sv                         |  14 ++
 sim/cfg_w1c_shadow_tb.sv                      |  45 ++++++
 sim/msix_pba.sv                               |  45 ++++++
 sim/msix_pba_tb.sv                            |  81 ++++++++++
 sim/nvme_store.sv                             |  38 +++++
 sim/nvme_store_tb.sv                          |  89 +++++++++++
 sim/run.sh                                    |  33 +++++
 40 files changed, 1479 insertions(+), 61 deletions(-)
 create mode 100644 cmd/pcileechgen/build_test.go
 create mode 100644 internal/firmware/codegen/w1cmask.go
 create mode 100644 internal/firmware/codegen/w1cmask_test.go
 create mode 100644 internal/firmware/ila.go
 create mode 100644 internal/firmware/ila_test.go
 create mode 100644 internal/firmware/output/code10.go
 create mode 100644 internal/firmware/output/code10_test.go
 create mode 100644 internal/firmware/output/ila_wiring_test.go
 create mode 100644 internal/firmware/output/latency_wiring_test.go
 create mode 100644 internal/firmware/svgen/ila_render_test.go
 create mode 100644 internal/firmware/tclgen/ila_test.go
 create mode 100644 sim/README.md
 create mode 100644 sim/cfg_w1c_shadow.sv
 create mode 100644 sim/cfg_w1c_shadow_tb.sv
 create mode 100644 sim/msix_pba.sv
 create mode 100644 sim/msix_pba_tb.sv
 create mode 100644 sim/nvme_store.sv
 create mode 100644 sim/nvme_store_tb.sv
 create mode 100755 sim/run.sh

diff --git a/.gitignore b/.gitignore
index 53f161c..133c87f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,4 +38,6 @@ Thumbs.db
 *.log
 *.str
 *.xpr
-.Xil/
\ No newline at end of file
+.Xil/
+# iverilog sim build artifacts
+sim/build/
diff --git a/Makefile b/Makefile
index 9918a28..af766db 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build test lint clean install fixtures hdl-lint
+.PHONY: build test lint clean install fixtures hdl-lint sim
 
 BINARY_NAME=pcileechgen
 BUILD_DIR=bin
@@ -35,6 +35,10 @@ clean:
 fixtures: build
 	$(BUILD_DIR)/$(BINARY_NAME) fixtures --out testdata/donors
 
+sim:
+	@command -v iverilog >/dev/null 2>&1 || { echo "iverilog not installed (apt-get install iverilog)"; exit 1; }
+	./sim/run.sh
+
 # lint generated sv with verilator
 hdl-lint: build
 	@command -v verilator >/dev/null 2>&1 || { echo "verilator not installed; see Makefile"; exit 1; }
diff --git a/cmd/pcileechgen/build.go b/cmd/pcileechgen/build.go
index 1e202ef..f0194b1 100644
--- a/cmd/pcileechgen/build.go
+++ b/cmd/pcileechgen/build.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/sercanarga/pcileechgen/internal/board"
 	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
 	"github.com/sercanarga/pcileechgen/internal/firmware"
 	"github.com/sercanarga/pcileechgen/internal/pci"
 	"github.com/sercanarga/pcileechgen/internal/vivado"
@@ -25,6 +26,9 @@ type buildFlags struct {
 	fromJSON   string
 	stockBar   bool
 	force      bool
+	mmioTrace  string
+	ila        bool
+	ilaDepth   int
 }
 
 var buildOpts buildFlags
@@ -78,7 +82,7 @@ func runBuild(cmd *cobra.Command, args []string) error {
 		slog.Warn("donor largest BAR exceeds board BRAM (forced)", "donor_bar", donorDemand, "board_bram", boardBRAM)
 	}
 
-	builder := vivado.NewBuilder(b, vivado.BuildOptions{
+	bopts := vivado.BuildOptions{
 		VivadoPath: buildOpts.vivadoPath,
 		OutputDir:  buildOpts.output,
 		LibDir:     buildOpts.libDir,
@@ -87,9 +91,49 @@ func runBuild(cmd *cobra.Command, args []string) error {
 		SkipVivado: buildOpts.skipVivado,
 		StockBar:   buildOpts.stockBar,
 		Force:      buildOpts.force,
-	})
+	}
+
+	if buildOpts.mmioTrace != "" {
+		h, err := donorTimingHistogram(buildOpts.mmioTrace, ctx)
+		if err != nil {
+			return fmt.Errorf("load donor timing trace: %w", err)
+		}
+		bopts.TimingHistogram = h
+		slog.Info("donor latency profile loaded", "trace", buildOpts.mmioTrace, "samples", h.SampleCount)
+	}
+
+	if buildOpts.ila {
+		depth := buildOpts.ilaDepth
+		if depth <= 0 {
+			depth = firmware.DefaultILADepth
+		}
+		bopts.ILADepth = depth
+		slog.Info("ILA debug core enabled", "depth", depth, "probes", len(firmware.ILAProbes()))
+	}
 
-	return builder.Build(ctx)
+	return vivado.NewBuilder(b, bopts).Build(ctx)
+}
+
+func donorTimingHistogram(traceFile string, ctx *donor.DeviceContext) (*behavior.TimingHistogram, error) {
+	idx := firmware.LargestBarIndex(ctx.BARContents)
+	var size int
+	var base uint64
+	for _, bar := range ctx.BARs {
+		if bar.Index == idx {
+			size = int(bar.Size)
+			base = bar.Address
+		}
+	}
+	trace, err := loadMMIOTrace(mmioTraceOptions{
+		bdf:       ctx.Device.BDF.String(),
+		barIndex:  idx,
+		barSize:   size,
+		traceFile: traceFile,
+	}, base)
+	if err != nil {
+		return nil, err
+	}
+	return behavior.ExtractTimingHistogram(trace), nil
 }
 
 // loadDonorContext loads device context from JSON or live device.
@@ -149,6 +193,7 @@ func init() {
 	buildCmd.Flags().StringVar(&buildOpts.bdf, "bdf", "", "donor device BDF address (e.g. 0000:03:00.0)")
 	buildCmd.Flags().StringVar(&buildOpts.board, "board", "", "target FPGA board name (required, e.g. PCIeSquirrel)")
 	buildCmd.Flags().StringVar(&buildOpts.fromJSON, "from-json", "", "load donor device data from JSON file (offline build)")
+	buildCmd.Flags().StringVar(&buildOpts.mmioTrace, "mmio-trace", "", "donor MMIO trace file; drives TLP latency emulation off the donor's real timing")
 	buildCmd.Flags().StringVar(&buildOpts.vivadoPath, "vivado-path", "", "path to Vivado installation")
 	buildCmd.Flags().StringVar(&buildOpts.output, "output", "pcileech_datastore", "output directory")
 	buildCmd.Flags().BoolVar(&buildOpts.skipVivado, "skip-vivado", false, "skip Vivado synthesis (only generate artifacts)")
@@ -157,6 +202,8 @@ func init() {
 	buildCmd.Flags().StringVar(&buildOpts.libDir, "lib-dir", "lib/pcileech-fpga", "path to pcileech-fpga library")
 	buildCmd.Flags().BoolVar(&buildOpts.stockBar, "stock-bar", false, "use stock bar controller (diagnostic: skip custom SV modules)")
 	buildCmd.Flags().BoolVar(&buildOpts.force, "force", false, "ignore donor BAR > board BRAM check")
+	buildCmd.Flags().BoolVar(&buildOpts.ila, "ila", false, "insert a Vivado ILA debug core probing BAR/TLP/interrupt signals")
+	buildCmd.Flags().IntVar(&buildOpts.ilaDepth, "ila-depth", firmware.DefaultILADepth, "ILA capture depth in samples (with --ila)")
 
 	_ = buildCmd.MarkFlagRequired("board")
 
diff --git a/cmd/pcileechgen/build_test.go b/cmd/pcileechgen/build_test.go
new file mode 100644
index 0000000..5159059
--- /dev/null
+++ b/cmd/pcileechgen/build_test.go
@@ -0,0 +1,39 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestDonorTimingHistogram_FromTrace(t *testing.T) {
+	var b strings.Builder
+	ts := 1000.0
+	for i := 0; i < 64; i++ {
+		ts += 0.000002 * float64(1+(i%5))
+		fmt.Fprintf(&b, "R 4 %.6f 2 0xf780010c 0x%x 0x0 0\n", ts, i)
+	}
+	tracePath := filepath.Join(t.TempDir(), "mmiotrace.txt")
+	if err := os.WriteFile(tracePath, []byte(b.String()), 0o644); err != nil {
+		t.Fatalf("write trace: %v", err)
+	}
+
+	ctx := &donor.DeviceContext{
+		Device:      pci.PCIDevice{VendorID: 0x144D, DeviceID: 0xA808, ClassCode: 0x010802},
+		BARs:        []pci.BAR{{Index: 2, Size: 4096, Address: 0xf7800000}},
+		BARContents: map[int][]byte{2: make([]byte, 4096)},
+	}
+
+	h, err := donorTimingHistogram(tracePath, ctx)
+	if err != nil {
+		t.Fatalf("donorTimingHistogram: %v", err)
+	}
+	if h == nil || h.SampleCount == 0 {
+		t.Fatalf("expected a populated histogram, got %+v", h)
+	}
+}
diff --git a/cmd/pcileechgen/check.go b/cmd/pcileechgen/check.go
index 69f53fd..7652073 100644
--- a/cmd/pcileechgen/check.go
+++ b/cmd/pcileechgen/check.go
@@ -3,7 +3,6 @@ package main
 import (
 	"fmt"
 	"io"
-	"os"
 	"strings"
 	"time"
 
@@ -33,7 +32,7 @@ Example:
 			return fmt.Errorf("invalid BDF: %w", err)
 		}
 
-		c := &checker{bdf: bdf, sysfs: donor.NewSysfsReader(), w: os.Stdout}
+		c := &checker{bdf: bdf, sysfs: donor.NewSysfsReader(), w: humanWriter()}
 		return c.run()
 	},
 }
diff --git a/cmd/pcileechgen/main.go b/cmd/pcileechgen/main.go
index e72948d..b9eb5ac 100644
--- a/cmd/pcileechgen/main.go
+++ b/cmd/pcileechgen/main.go
@@ -2,11 +2,29 @@ package main
 
 import (
 	"fmt"
+	"io"
+	"log/slog"
 	"os"
 
+	"github.com/sercanarga/pcileechgen/internal/color"
 	"github.com/spf13/cobra"
 )
 
+var (
+	logLevel string
+	logFile  string
+	logJSON  bool
+
+	logFileHandle *os.File
+)
+
+func humanWriter() io.Writer {
+	if logFileHandle == nil {
+		return os.Stdout
+	}
+	return io.MultiWriter(os.Stdout, logFileHandle)
+}
+
 var rootCmd = &cobra.Command{
 	Use:   "pcileechgen",
 	Short: "PCILeech FPGA firmware generator",
@@ -19,6 +37,44 @@ This tool requires:
   - Linux with IOMMU/VFIO support (for device reading)
   - A real donor PCI/PCIe card
   - Xilinx Vivado (optional, for bitstream synthesis)`,
+	PersistentPreRunE: setupLogging,
+}
+
+func init() {
+	pf := rootCmd.PersistentFlags()
+	pf.StringVar(&logLevel, "log-level", "info", "log verbosity: debug|info|warn|error")
+	pf.StringVar(&logFile, "log-file", "", "also write a full log to this file (attach it when reporting Code 10)")
+	pf.BoolVar(&logJSON, "json-logs", false, "emit structured JSON logs instead of text")
+}
+
+func setupLogging(_ *cobra.Command, _ []string) error {
+	levels := map[string]slog.Level{
+		"debug": slog.LevelDebug, "info": slog.LevelInfo,
+		"warn": slog.LevelWarn, "error": slog.LevelError,
+	}
+	lvl, ok := levels[logLevel]
+	if !ok {
+		return fmt.Errorf("invalid --log-level %q (want debug|info|warn|error)", logLevel)
+	}
+
+	var w io.Writer = os.Stderr
+	if logFile != "" {
+		f, err := os.OpenFile(logFile, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
+		if err != nil {
+			return fmt.Errorf("cannot open --log-file: %w", err)
+		}
+		logFileHandle = f
+		w = io.MultiWriter(os.Stderr, f)
+		color.Disable()
+	}
+
+	opts := &slog.HandlerOptions{Level: lvl}
+	var h slog.Handler = slog.NewTextHandler(w, opts)
+	if logJSON {
+		h = slog.NewJSONHandler(w, opts)
+	}
+	slog.SetDefault(slog.New(h))
+	return nil
 }
 
 func main() {
diff --git a/cmd/pcileechgen/validate.go b/cmd/pcileechgen/validate.go
index eb7a812..b7b5d56 100644
--- a/cmd/pcileechgen/validate.go
+++ b/cmd/pcileechgen/validate.go
@@ -48,7 +48,8 @@ Example:
 		if err != nil {
 			return fmt.Errorf("failed to load device context: %w", err)
 		}
-		fmt.Printf("Loaded donor context: %s\n\n",
+		out := humanWriter()
+		fmt.Fprintf(out, "Loaded donor context: %s\n\n",
 			color.Bold(fmt.Sprintf("%04x:%04x (rev %02x)", ctx.Device.VendorID, ctx.Device.DeviceID, ctx.Device.RevisionID)))
 
 		var b *board.Board
@@ -57,10 +58,10 @@ Example:
 			if err != nil {
 				return err
 			}
-			fmt.Printf("Board: %s (%s x%d)\n\n", b.Name, b.FPGAPart, b.PCIeLanes)
+			fmt.Fprintf(out, "Board: %s (%s x%d)\n\n", b.Name, b.FPGAPart, b.PCIeLanes)
 		} else {
-			fmt.Println(color.Warn("No --board specified: link speed/width clamping not applied in validation"))
-			fmt.Println()
+			fmt.Fprintln(out, color.Warn("No --board specified: link speed/width clamping not applied in validation"))
+			fmt.Fprintln(out)
 		}
 
 		msixTableSize := 0
@@ -93,16 +94,16 @@ Example:
 
 		// Print results
 		for _, p := range v.result.Passed {
-			fmt.Println(color.OK(p))
+			fmt.Fprintln(out, color.OK(p))
 		}
 		for _, w := range v.result.Warnings {
-			fmt.Println(color.Warn(w))
+			fmt.Fprintln(out, color.Warn(w))
 		}
 		for _, f := range v.result.Failed {
-			fmt.Println(color.Fail(f))
+			fmt.Fprintln(out, color.Fail(f))
 		}
 
-		fmt.Printf("\n%s\n", color.Header(v.result.Summary()))
+		fmt.Fprintf(out, "\n%s\n", color.Header(v.result.Summary()))
 		if v.result.HasFailures() {
 			return fmt.Errorf("%d validation(s) failed", len(v.result.Failed))
 		}
diff --git a/internal/firmware/codegen/w1cmask.go b/internal/firmware/codegen/w1cmask.go
new file mode 100644
index 0000000..e3cfdd3
--- /dev/null
+++ b/internal/firmware/codegen/w1cmask.go
@@ -0,0 +1,58 @@
+package codegen
+
+import "github.com/sercanarga/pcileechgen/internal/pci"
+
+const (
+	statusW1C        = 0xF900
+	pmcsrW1C         = 0x8000
+	pcieDevStatusW1C = 0x000F
+	aerRootStatusW1C = 0x0000007F
+)
+
+func setW1C(words []uint32, byteOff int, bits uint32, width int) {
+	idx := byteOff / 4
+	if idx < 0 || idx >= len(words) {
+		return
+	}
+	if width == 32 {
+		words[idx] |= bits
+		return
+	}
+	if byteOff%4 == 2 {
+		words[idx] |= bits << 16
+	} else {
+		words[idx] |= bits & 0xFFFF
+	}
+}
+
+func W1CMaskWords(cs *pci.ConfigSpace) []uint32 {
+	words := make([]uint32, shadowCfgSpaceWords)
+
+	setW1C(words, 0x06, statusW1C, 16)
+
+	for _, c := range pci.ParseCapabilities(cs) {
+		switch c.ID {
+		case pci.CapIDPowerManagement:
+			setW1C(words, c.Offset+0x04, pmcsrW1C, 16)
+		case pci.CapIDPCIExpress:
+			setW1C(words, c.Offset+0x0A, pcieDevStatusW1C, 16)
+		}
+	}
+
+	for _, e := range pci.ParseExtCapabilities(cs) {
+		if e.ID == pci.ExtCapIDAER {
+			setW1C(words, e.Offset+0x04, 0xFFFFFFFF, 32)
+			setW1C(words, e.Offset+0x10, 0xFFFFFFFF, 32)
+			setW1C(words, e.Offset+0x30, aerRootStatusW1C, 32)
+		}
+	}
+
+	return words
+}
+
+func GenerateW1CMaskCOE(cs *pci.ConfigSpace) string {
+	return formatCOE(
+		"; PCILeech config-space write-1-to-clear mask (1=bit clears on host write-1)\n",
+		W1CMaskWords(cs),
+	)
+}
diff --git a/internal/firmware/codegen/w1cmask_test.go b/internal/firmware/codegen/w1cmask_test.go
new file mode 100644
index 0000000..1fa8603
--- /dev/null
+++ b/internal/firmware/codegen/w1cmask_test.go
@@ -0,0 +1,63 @@
+package codegen
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func TestW1CMask_StatusRegisterAlwaysMarked(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	words := W1CMaskWords(cs)
+
+	if len(words) != shadowCfgSpaceWords {
+		t.Fatalf("expected %d words, got %d", shadowCfgSpaceWords, len(words))
+	}
+	if words[1] != 0xF9000000 {
+		t.Errorf("status W1C mask: want 0xF9000000 at word 1, got 0x%08X", words[1])
+	}
+	if words[0] != 0 {
+		t.Errorf("word 0 (id regs) must have no W1C bits, got 0x%08X", words[0])
+	}
+}
+
+func TestSetW1C_Placement(t *testing.T) {
+	cases := []struct {
+		name  string
+		off   int
+		bits  uint32
+		width int
+		idx   int
+		want  uint32
+	}{
+		{"16bit high half (status 0x06)", 0x06, 0xF900, 16, 1, 0xF9000000},
+		{"16bit low half (pmcsr cap+0x04)", 0x44, 0x8000, 16, 0x11, 0x00008000},
+		{"32bit aligned (AER status)", 0x104, 0xFFFFFFFF, 32, 0x41, 0xFFFFFFFF},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			words := make([]uint32, shadowCfgSpaceWords)
+			setW1C(words, c.off, c.bits, c.width)
+			if words[c.idx] != c.want {
+				t.Errorf("word[%#x] = 0x%08X, want 0x%08X", c.idx, words[c.idx], c.want)
+			}
+		})
+	}
+}
+
+func TestSetW1C_OutOfRangeNoPanic(t *testing.T) {
+	words := make([]uint32, shadowCfgSpaceWords)
+	setW1C(words, 0x4000, 0xFFFFFFFF, 32)
+}
+
+func TestGenerateW1CMaskCOE_Format(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	coe := GenerateW1CMaskCOE(cs)
+	if !strings.Contains(coe, "memory_initialization_radix=16;") {
+		t.Error("COE missing radix header")
+	}
+	if n := strings.Count(coe, "\n"); n < shadowCfgSpaceWords {
+		t.Errorf("COE has too few lines: %d", n)
+	}
+}
diff --git a/internal/firmware/ila.go b/internal/firmware/ila.go
new file mode 100644
index 0000000..d44ac98
--- /dev/null
+++ b/internal/firmware/ila.go
@@ -0,0 +1,93 @@
+package firmware
+
+import (
+	"fmt"
+	"strings"
+)
+
+type ILAProbe struct {
+	Signal string
+	Width  int
+}
+
+const DefaultILADepth = 1024
+
+func ILAProbes() []ILAProbe {
+	return []ILAProbe{
+		{"wr_addr", 32},
+		{"rd_req_addr", 32},
+		{"bar0_raw_data", 32},
+		{"bar0_raw_valid", 1},
+		{"rd_req_valid", 1},
+		{"intr_req", 1},
+		{"in_is_wr_ready", 1},
+	}
+}
+
+func ILACreateIPTCL(depth int) string {
+	if depth <= 0 {
+		depth = DefaultILADepth
+	}
+	probes := ILAProbes()
+	var b strings.Builder
+	b.WriteString("create_ip -name ila -vendor xilinx.com -library ip -module_name ila_0\n")
+	b.WriteString("set_property -dict [list \\\n")
+	fmt.Fprintf(&b, "  CONFIG.C_NUM_OF_PROBES {%d} \\\n", len(probes))
+	fmt.Fprintf(&b, "  CONFIG.C_DATA_DEPTH {%d} \\\n", depth)
+	b.WriteString("  CONFIG.C_INPUT_PIPE_STAGES {1} \\\n")
+	b.WriteString("  CONFIG.C_ADV_TRIGGER {true} \\\n")
+	b.WriteString("  CONFIG.C_EN_STRG_QUAL {1} \\\n")
+	b.WriteString("  CONFIG.C_TRIGIN_EN {false} \\\n")
+	b.WriteString("  CONFIG.C_TRIGOUT_EN {false} \\\n")
+	b.WriteString("  CONFIG.ALL_PROBE_SAME_MU {true} \\\n")
+	b.WriteString("  CONFIG.ALL_PROBE_SAME_MU_CNT {2} \\\n")
+	for i, p := range probes {
+		fmt.Fprintf(&b, "  CONFIG.C_PROBE%d_WIDTH {%d} \\\n", i, p.Width)
+	}
+	b.WriteString("] [get_ips ila_0]\n")
+	b.WriteString("generate_target all [get_ips ila_0]\n")
+	return b.String()
+}
+
+func ILADebugDoc() string {
+	probes := ILAProbes()
+	var b strings.Builder
+	b.WriteString("ILA debug core - capture workflow\n")
+	b.WriteString("=================================\n\n")
+	b.WriteString("The ILA is wired into pcileech_tlps128_bar_controller and works over JTAG\n")
+	b.WriteString("only (not the data/USB-C port). Connect the board's JTAG to a 2nd PC running\n")
+	b.WriteString("Vivado Hardware Manager; the target PC (with the card inserted) is separate.\n\n")
+	b.WriteString("Probes:\n")
+	for i, p := range probes {
+		fmt.Fprintf(&b, "  probe%d  %-15s (%d bit)\n", i, p.Signal, p.Width)
+	}
+	b.WriteString("\nArming a pre-trigger capture (example: NVMe CQ0 init):\n")
+	b.WriteString("  1. open_hw_manager, connect to the board over JTAG, refresh hw_device.\n")
+	b.WriteString("  2. In the ILA dashboard set a trigger on a probe - e.g. wr_addr == the CQ0\n")
+	b.WriteString("     doorbell offset, or intr_req == 1 for the first completion interrupt.\n")
+	b.WriteString("  3. Set the trigger position early in the window (a pre-trigger position) so\n")
+	b.WriteString("     the buffer captures what happened BEFORE the trigger as well as after.\n")
+	b.WriteString("  4. Enable capture control (storage qualification) to only store samples of\n")
+	b.WriteString("     interest - this stretches the small on-card buffer much further.\n")
+	b.WriteString("  5. Arm the core, then do a warm reboot of the target PC. When the trigger\n")
+	b.WriteString("     arrives during init, the ILA captures the window; export it to a .ila/CSV.\n\n")
+	b.WriteString("Buffers are small, so expect several capture runs, each narrowed to one signal\n")
+	b.WriteString("or window, to reconstruct the full init sequence around a Code 10.\n")
+	return b.String()
+}
+
+func ILAInstanceSV() string {
+	probes := ILAProbes()
+	var b strings.Builder
+	b.WriteString("    ila_0 u_ila_dbg (\n")
+	b.WriteString("        .clk(clk),\n")
+	for i, p := range probes {
+		comma := ","
+		if i == len(probes)-1 {
+			comma = ""
+		}
+		fmt.Fprintf(&b, "        .probe%d(%s)%s\n", i, p.Signal, comma)
+	}
+	b.WriteString("    );\n")
+	return b.String()
+}
diff --git a/internal/firmware/ila_test.go b/internal/firmware/ila_test.go
new file mode 100644
index 0000000..2664e6e
--- /dev/null
+++ b/internal/firmware/ila_test.go
@@ -0,0 +1,71 @@
+package firmware
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestILAProbes_Valid(t *testing.T) {
+	probes := ILAProbes()
+	if len(probes) == 0 {
+		t.Fatal("expected at least one probe")
+	}
+	for _, p := range probes {
+		if p.Signal == "" || p.Width <= 0 {
+			t.Errorf("invalid probe: %+v", p)
+		}
+	}
+}
+
+func TestILACreateIPTCL(t *testing.T) {
+	tcl := ILACreateIPTCL(0)
+	n := len(ILAProbes())
+	for _, want := range []string{
+		"create_ip -name ila -vendor xilinx.com",
+		"-module_name ila_0",
+		fmt.Sprintf("CONFIG.C_NUM_OF_PROBES {%d}", n),
+		"CONFIG.C_DATA_DEPTH {1024}",
+		"CONFIG.C_PROBE0_WIDTH {32}",
+		"CONFIG.C_ADV_TRIGGER {true}",
+		"CONFIG.C_EN_STRG_QUAL {1}",
+		"CONFIG.ALL_PROBE_SAME_MU_CNT {2}",
+		"generate_target all [get_ips ila_0]",
+	} {
+		if !strings.Contains(tcl, want) {
+			t.Errorf("create_ip TCL missing %q:\n%s", want, tcl)
+		}
+	}
+	if !strings.Contains(ILACreateIPTCL(4096), "CONFIG.C_DATA_DEPTH {4096}") {
+		t.Error("custom depth not honored")
+	}
+}
+
+func TestILAInstanceSV(t *testing.T) {
+	sv := ILAInstanceSV()
+	probes := ILAProbes()
+	if !strings.Contains(sv, "ila_0 u_ila_dbg") || !strings.Contains(sv, ".clk(clk)") {
+		t.Errorf("instance missing module/clk:\n%s", sv)
+	}
+	if !strings.Contains(sv, fmt.Sprintf(".probe0(%s)", probes[0].Signal)) {
+		t.Errorf("first probe not wired:\n%s", sv)
+	}
+	last := fmt.Sprintf(".probe%d(%s)\n    );", len(probes)-1, probes[len(probes)-1].Signal)
+	if !strings.Contains(sv, last) {
+		t.Errorf("last probe / closing malformed:\n%s", sv)
+	}
+}
+
+func TestILADebugDoc(t *testing.T) {
+	doc := ILADebugDoc()
+	for _, want := range []string{"JTAG", "trigger", "pre-trigger", "warm reboot", "probe0"} {
+		if !strings.Contains(doc, want) {
+			t.Errorf("ILA debug doc missing %q", want)
+		}
+	}
+	for _, p := range ILAProbes() {
+		if !strings.Contains(doc, p.Signal) {
+			t.Errorf("ILA debug doc should list probe signal %q", p.Signal)
+		}
+	}
+}
diff --git a/internal/firmware/nvme/identify.go b/internal/firmware/nvme/identify.go
index 0416416..c7768a3 100644
--- a/internal/firmware/nvme/identify.go
+++ b/internal/firmware/nvme/identify.go
@@ -20,7 +20,7 @@ type IdentifyData struct {
 func BuildIdentifyData(ids firmware.DeviceIDs, barData []byte) *IdentifyData {
 	d := &IdentifyData{}
 	d.Controller = buildIdentifyController(ids, barData)
-	d.Namespace = buildIdentifyNamespace(barData)
+	d.Namespace = buildIdentifyNamespace(ids, barData)
 	return d
 }
 
@@ -37,7 +37,7 @@ func buildIdentifyController(ids firmware.DeviceIDs, barData []byte) [4096]byte
 	copy(data[0x004:0x018], padASCII(sn, 20))
 
 	// MN (40B ASCII)
-	mn := modelNumberForVendor(ids.VendorID)
+	mn := modelNumberForDevice(ids.VendorID, ids.DeviceID)
 	copy(data[0x018:0x040], padASCII(mn, 40))
 
 	// FR (8B ASCII) - vendor-appropriate firmware revision
@@ -131,11 +131,10 @@ func buildIdentifyController(ids firmware.DeviceIDs, barData []byte) [4096]byte
 }
 
 // buildIdentifyNamespace - CNS=0 NSID=1, NVMe 1.4 spec Figure 245.
-func buildIdentifyNamespace(barData []byte) [4096]byte {
+func buildIdentifyNamespace(ids firmware.DeviceIDs, barData []byte) [4096]byte {
 	var data [4096]byte
 
-	// 1TB / 512B sectors
-	var nsze uint64 = 1953525168
+	nsze := nszeForDevice(ids.VendorID, ids.DeviceID)
 	_ = barData // reserved for future donor extraction
 
 	binary.LittleEndian.PutUint64(data[0x000:], nsze) // NSZE
@@ -195,10 +194,23 @@ func vendorSNPrefix(vid uint16) string {
 	}
 }
 
-func modelNumberForVendor(vid uint16) string {
+func modelNumberForDevice(vid, did uint16) string {
 	switch vid {
 	case 0x144D:
-		return "Samsung SSD 980 PRO 1TB"
+		switch did {
+		case 0xA808:
+			return "Samsung SSD 980 PRO 1TB"
+		case 0xA809:
+			return "Samsung SSD 980 PRO 2TB"
+		case 0xA80C:
+			return "Samsung SSD 980 PRO 512GB"
+		case 0xA80D:
+			return "Samsung SSD 990 PRO 1TB"
+		case 0xA80E:
+			return "Samsung SSD 990 PRO 2TB"
+		default:
+			return "Samsung SSD NVMe 1TB"
+		}
 	case 0x1179:
 		return "TOSHIBA KXG60ZNV1T02"
 	case 0x1987:
@@ -218,6 +230,20 @@ func modelNumberForVendor(vid uint16) string {
 	}
 }
 
+func nszeForDevice(vid, did uint16) uint64 {
+	switch vid {
+	case 0x144D:
+		switch did {
+		case 0xA809, 0xA80E:
+			return 3907029168
+		default:
+			return 1953525168
+		}
+	default:
+		return 1953525168
+	}
+}
+
 func ouiForVendor(vid uint16) [3]byte {
 	switch vid {
 	case 0x144D:
@@ -229,7 +255,7 @@ func ouiForVendor(vid uint16) [3]byte {
 	case 0x1C5C:
 		return [3]byte{0x00, 0xAD, 0x00}
 	default:
-		return [3]byte{0x00, 0x00, 0x00}
+		return [3]byte{0x00, uint8(vid >> 8), uint8(vid)}
 	}
 }
 
diff --git a/internal/firmware/nvme/identify_test.go b/internal/firmware/nvme/identify_test.go
index a267922..d9744de 100644
--- a/internal/firmware/nvme/identify_test.go
+++ b/internal/firmware/nvme/identify_test.go
@@ -2,6 +2,7 @@ package nvme
 
 import (
 	"encoding/binary"
+	"strings"
 	"testing"
 
 	"github.com/sercanarga/pcileechgen/internal/firmware"
@@ -240,3 +241,46 @@ func TestIdentifyController_DifferentVendors(t *testing.T) {
 		}
 	}
 }
+
+func TestModelNumber_DID_Disambiguation(t *testing.T) {
+	ids := sampleIDs()
+	ids.DeviceID = 0xA80D
+	id := BuildIdentifyData(ids, nil)
+	mn := strings.TrimRight(string(id.Controller[0x018:0x040]), " ")
+	if strings.Contains(mn, "980 PRO") {
+		t.Errorf("Samsung DID 0xA80D (990 PRO) MN must not contain '980 PRO', got %q", mn)
+	}
+	if !strings.Contains(mn, "990") {
+		t.Errorf("Samsung DID 0xA80D (990 PRO) MN must contain '990', got %q", mn)
+	}
+}
+
+func TestNamespace_NSZE_2TB(t *testing.T) {
+	ids := sampleIDs()
+	ids.DeviceID = 0xA809
+	id := BuildIdentifyData(ids, nil)
+	nsze := binary.LittleEndian.Uint64(id.Namespace[0x000:])
+	const nsze1TB = uint64(1953525168)
+	if nsze == nsze1TB {
+		t.Errorf("Samsung DID 0xA809 (2TB) NSZE must differ from 1TB default %d, got %d", nsze1TB, nsze)
+	}
+	ncap := binary.LittleEndian.Uint64(id.Namespace[0x008:])
+	nuse := binary.LittleEndian.Uint64(id.Namespace[0x010:])
+	if ncap != nsze {
+		t.Errorf("NCAP %d must equal NSZE %d", ncap, nsze)
+	}
+	if nuse != nsze {
+		t.Errorf("NUSE %d must equal NSZE %d", nuse, nsze)
+	}
+}
+
+func TestOUI_UnknownVID_NotXerox(t *testing.T) {
+	ids := sampleIDs()
+	ids.VendorID = 0xBEEF
+	ids.SubsysVendorID = 0xBEEF
+	id := BuildIdentifyData(ids, nil)
+	oui := id.Controller[0x049:0x04C]
+	if oui[0] == 0 && oui[1] == 0 && oui[2] == 0 {
+		t.Errorf("Unknown VID OUI must not be 00:00:00 (Xerox's real OUI), got %02X:%02X:%02X", oui[0], oui[1], oui[2])
+	}
+}
diff --git a/internal/firmware/output/code10.go b/internal/firmware/output/code10.go
new file mode 100644
index 0000000..255972d
--- /dev/null
+++ b/internal/firmware/output/code10.go
@@ -0,0 +1,138 @@
+package output
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+
+	"github.com/sercanarga/pcileechgen/internal/board"
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func (ow *OutputWriter) code10Risks(ctx *donor.DeviceContext, b *board.Board, ids firmware.DeviceIDs) []string {
+	msixTableSize := 0
+	if ctx.MSIXData != nil && ctx.MSIXData.TableSize > 0 {
+		msixTableSize = ctx.MSIXData.TableSize
+	}
+	demand := firmware.DonorBAR0Demand(ctx, b, msixTableSize)
+	capped := firmware.CappedBAR0Size(ctx, b, msixTableSize)
+
+	devClass := ""
+	if s := devclass.StrategyForClassAndVendor(ctx.Device.ClassCode, ids.VendorID); s != nil {
+		devClass = s.DeviceClass()
+	}
+
+	var risks []string
+
+	if capped < demand {
+		risks = append(risks, fmt.Sprintf(
+			"BAR0 TRUNCATED %d -> %d bytes (board BRAM limit): driver reads above 0x%X return garbage. Use a board with larger bram_size or a smaller-BAR donor.",
+			demand, capped, capped))
+	}
+
+	switch devClass {
+	case devclass.ClassNVMe:
+		risks = append(risks, "NVMe donor: the admin + IO-queue FSM exists but there is NO backing store - IO reads return zeros and writes are discarded, so the disk won't mount (stornvme Event 11). A BRAM/host-DMA sector cache is required.")
+	case devclass.ClassXHCI:
+		risks = append(risks, "xHCI (USB) donor: no transfer engine is implemented (no command ring, event ring, doorbell array or DCBAAP) - the controller enumerates then the USB stack hangs (Code 10).")
+	case devclass.ClassSATA:
+		risks = append(risks, "SATA/AHCI donor: no command-list FSM - PxCI never clears, so storahci commands never complete (Code 10). This class is an identity clone only.")
+	case devclass.ClassWiFi:
+		risks = append(risks, "WiFi donor: no uCode-upload DMA handshake FSM, and the BAR model may fall back to a generic NIC layout - driver init typically fails (Code 10).")
+	case devclass.ClassGPU:
+		risks = append(risks, "GPU donor: only a 4K register window is emulated of a multi-MB VRAM/register space - structurally insufficient for any GPU driver (Code 10).")
+	case devclass.ClassThunderbolt:
+		risks = append(risks, "Thunderbolt donor: no link/mailbox/tunnelling FSM - static snapshot only, driver init will not complete (Code 10).")
+	case devclass.ClassEthernet:
+		risks = append(risks, "Ethernet donor: static identity clone with link-up state but no TX/RX descriptor-ring DMA - enumerates but does not pass traffic.")
+	}
+
+	if !ow.StockBar && isInterruptDrivenClass(devClass) {
+		risks = append(risks, "interrupt-driven class with custom SV: VERIFY intr_req is wired to the PCIe core cfg_interrupt in your pcileech-fpga top module - this tool does not emit that connection, and if it is missing, interrupts never fire (Code 10).")
+	}
+
+	if barData, ok := ctx.BARContents[firmware.LargestBarIndex(ctx.BARContents)]; ok {
+		switch {
+		case len(barData) == 0:
+			risks = append(risks, "selected BAR has no captured content (donor likely in D3/IOMMU off): BAR0 will read as zeros, init will fail. Re-run 'check' and confirm D0 + vfio-pci binding.")
+		case allBytes(barData, 0xFF):
+			risks = append(risks, "selected BAR content is all 0xFF (donor not readable at capture time): the clone's BAR0 will read FF and the driver will Code 10. Wake the donor to D0 and re-collect.")
+		}
+	}
+
+	if msixTableSize == 0 && !hasMSICap(ctx.ConfigSpace) {
+		risks = append(risks, "no MSI-X table and no MSI capability detected on the donor: interrupt-driven drivers may never complete init (Code 10).")
+	}
+
+	if ctx.MSIXData != nil && (ctx.MSIXData.TableBIR != 0 || ctx.MSIXData.PBABIR != 0) {
+		risks = append(risks, fmt.Sprintf(
+			"MSI-X relocated to BAR0: donor BIR was table=%d pba=%d but only BAR0 is emulated, so the clone reports BIR 0. Required for the table to work, but a fidelity/detection divergence from the donor.",
+			ctx.MSIXData.TableBIR, ctx.MSIXData.PBABIR))
+	}
+
+	if !ids.HasDSN {
+		risks = append(risks, "donor has no DSN: serial-number emulation disabled (usually harmless).")
+	}
+	if ids.HasPCIeCap && b.PCIeLanes > 0 && int(ids.LinkWidth) > b.PCIeLanes {
+		risks = append(risks, fmt.Sprintf("donor link width x%d clamped to board x%d: fine for most devices, but bandwidth-sensitive drivers may complain.", ids.LinkWidth, b.PCIeLanes))
+	}
+
+	return risks
+}
+
+func isInterruptDrivenClass(devClass string) bool {
+	switch devClass {
+	case devclass.ClassNVMe, devclass.ClassXHCI, devclass.ClassAudio, devclass.ClassEthernet:
+		return true
+	}
+	return false
+}
+
+func (ow *OutputWriter) writeCode10Report(ctx *donor.DeviceContext, b *board.Board, ids firmware.DeviceIDs) {
+	risks := ow.code10Risks(ctx, b, ids)
+
+	header := fmt.Sprintf("Code-10 risk report for %04x:%04x (%s) on %s",
+		ids.VendorID, ids.DeviceID, ctx.Device.ClassDescription(), b.Name)
+
+	if len(risks) == 0 {
+		slog.Info("code10-risk: none detected", "device", header)
+		_ = ow.writeFile("code10_report.txt", header+"\n\nNo obvious Code-10 risks detected at generation time.\n")
+		return
+	}
+
+	for _, r := range risks {
+		slog.Warn("code10-risk", "detail", r)
+	}
+
+	var sb strings.Builder
+	sb.WriteString(header + "\n\n")
+	for i, r := range risks {
+		fmt.Fprintf(&sb, "%d. %s\n", i+1, r)
+	}
+	sb.WriteString("\nIf the flash still Code-10s after addressing these, run tools/cleanup_device_history.ps1 (Admin) and reboot.\n")
+	_ = ow.writeFile("code10_report.txt", sb.String())
+}
+
+func allBytes(b []byte, v byte) bool {
+	for _, x := range b {
+		if x != v {
+			return false
+		}
+	}
+	return len(b) > 0
+}
+
+func hasMSICap(cs *pci.ConfigSpace) bool {
+	if cs == nil {
+		return false
+	}
+	for _, c := range pci.ParseCapabilities(cs) {
+		if c.ID == pci.CapIDMSI {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/firmware/output/code10_test.go b/internal/firmware/output/code10_test.go
new file mode 100644
index 0000000..24d98a1
--- /dev/null
+++ b/internal/firmware/output/code10_test.go
@@ -0,0 +1,102 @@
+package output
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/board"
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+)
+
+const (
+	ccNVMe = 0x010802
+	ccXHCI = 0x0C0330
+	ccSATA = 0x010601
+	ccWiFi = 0x028000
+	ccGPU  = 0x030000
+	ccEth  = 0x020000
+)
+
+func risksFor(t *testing.T, classCode uint32, stockBar bool) []string {
+	t.Helper()
+	ctx := makeDonorContext(0x1234, 0x5678, classCode)
+	b, err := board.Find("PCIeSquirrel")
+	if err != nil {
+		t.Fatalf("board.Find: %v", err)
+	}
+	ids := firmware.ExtractDeviceIDs(ctx.ConfigSpace, ctx.ExtCapabilities)
+	ow := NewOutputWriter(t.TempDir(), "", 0, 0)
+	ow.StockBar = stockBar
+	return ow.code10Risks(ctx, b, ids)
+}
+
+func joinLower(rs []string) string { return strings.ToLower(strings.Join(rs, "\n")) }
+
+func mustContain(t *testing.T, rs []string, sub string) {
+	t.Helper()
+	if !strings.Contains(joinLower(rs), strings.ToLower(sub)) {
+		t.Errorf("expected a risk mentioning %q, got:\n%s", sub, strings.Join(rs, "\n"))
+	}
+}
+
+func mustNotContain(t *testing.T, rs []string, sub string) {
+	t.Helper()
+	if strings.Contains(joinLower(rs), strings.ToLower(sub)) {
+		t.Errorf("did NOT expect %q in risks, got:\n%s", sub, strings.Join(rs, "\n"))
+	}
+}
+
+func TestCode10_NVMe_BackingStoreNotStaleText(t *testing.T) {
+	rs := risksFor(t, ccNVMe, false)
+	mustContain(t, rs, "backing store")
+	mustNotContain(t, rs, "io queues + bram cache are not implemented")
+}
+
+func TestCode10_XHCI_NoTransferEngine(t *testing.T) {
+	rs := risksFor(t, ccXHCI, false)
+	mustContain(t, rs, "transfer engine")
+}
+
+func TestCode10_SATA_NoFSM(t *testing.T) {
+	rs := risksFor(t, ccSATA, false)
+	mustContain(t, rs, "no command-list")
+}
+
+func TestCode10_WiFi_NoFSM(t *testing.T) {
+	rs := risksFor(t, ccWiFi, false)
+	mustContain(t, rs, "wifi")
+}
+
+func TestCode10_GPU_NoFSM(t *testing.T) {
+	rs := risksFor(t, ccGPU, false)
+	mustContain(t, rs, "gpu")
+}
+
+func TestCode10_InterruptRoutingVerificationNote(t *testing.T) {
+	rs := risksFor(t, ccNVMe, false)
+	mustContain(t, rs, "intr_req")
+
+	stock := risksFor(t, ccNVMe, true)
+	if strings.Contains(joinLower(stock), "intr_req") {
+		t.Errorf("stock-bar mode should not emit the intr_req routing note, got:\n%s", strings.Join(stock, "\n"))
+	}
+}
+
+func TestCode10_Ethernet_NoPanic(t *testing.T) {
+	_ = risksFor(t, ccEth, false)
+}
+
+func TestCode10_MSIX_BIRRelocationWarning(t *testing.T) {
+	ctx := makeDonorContext(0x1234, 0x5678, ccEth)
+	ctx.MSIXData = &donor.MSIXData{TableSize: 4, TableBIR: 2, PBABIR: 2}
+	b, _ := board.Find("PCIeSquirrel")
+	ids := firmware.ExtractDeviceIDs(ctx.ConfigSpace, ctx.ExtCapabilities)
+	ow := NewOutputWriter(t.TempDir(), "", 0, 0)
+	rs := ow.code10Risks(ctx, b, ids)
+	mustContain(t, rs, "relocated to bar0")
+
+	ctx.MSIXData = &donor.MSIXData{TableSize: 4, TableBIR: 0, PBABIR: 0}
+	rs0 := ow.code10Risks(ctx, b, ids)
+	mustNotContain(t, rs0, "relocated to bar0")
+}
diff --git a/internal/firmware/output/ila_wiring_test.go b/internal/firmware/output/ila_wiring_test.go
new file mode 100644
index 0000000..398e08c
--- /dev/null
+++ b/internal/firmware/output/ila_wiring_test.go
@@ -0,0 +1,37 @@
+package output
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/board"
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+)
+
+func TestBuildSVConfig_ILAInstance(t *testing.T) {
+	ctx := makeDonorContext(0x144D, 0xA808, ccNVMe)
+	b, err := board.Find("PCIeSquirrel")
+	if err != nil {
+		t.Fatalf("board.Find: %v", err)
+	}
+	ids := firmware.ExtractDeviceIDs(ctx.ConfigSpace, ctx.ExtCapabilities)
+	ow := NewOutputWriter(t.TempDir(), "", 0, 0)
+	scrubbed, entropy, _ := ow.scrubAndVary(ctx, b, ids)
+
+	cfg, err := ow.buildSVConfig(ctx, scrubbed, ids, entropy, b)
+	if err != nil {
+		t.Fatalf("buildSVConfig (no ILA): %v", err)
+	}
+	if cfg.ILAInstanceSV != "" {
+		t.Error("expected no ILA instance when ILADepth=0")
+	}
+
+	ow.ILADepth = 1024
+	cfg2, err := ow.buildSVConfig(ctx, scrubbed, ids, entropy, b)
+	if err != nil {
+		t.Fatalf("buildSVConfig (ILA): %v", err)
+	}
+	if !strings.Contains(cfg2.ILAInstanceSV, "ila_0 u_ila_dbg") {
+		t.Errorf("expected ILA instance, got %q", cfg2.ILAInstanceSV)
+	}
+}
diff --git a/internal/firmware/output/latency_wiring_test.go b/internal/firmware/output/latency_wiring_test.go
new file mode 100644
index 0000000..c0d1525
--- /dev/null
+++ b/internal/firmware/output/latency_wiring_test.go
@@ -0,0 +1,50 @@
+package output
+
+import (
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/board"
+	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+)
+
+func TestBuildSVConfig_UsesDonorHistogram(t *testing.T) {
+	ctx := makeDonorContext(0x144D, 0xA808, ccNVMe)
+	b, err := board.Find("PCIeSquirrel")
+	if err != nil {
+		t.Fatalf("board.Find: %v", err)
+	}
+	ids := firmware.ExtractDeviceIDs(ctx.ConfigSpace, ctx.ExtCapabilities)
+	ow := NewOutputWriter(t.TempDir(), "", 0, 0)
+	scrubbed, entropy, _ := ow.scrubAndVary(ctx, b, ids)
+
+	cfg, err := ow.buildSVConfig(ctx, scrubbed, ids, entropy, b)
+	if err != nil {
+		t.Fatalf("buildSVConfig (no histogram): %v", err)
+	}
+	if cfg.LatencyConfig.HasHistogram {
+		t.Error("expected HasHistogram=false without a donor histogram")
+	}
+
+	h := &behavior.TimingHistogram{
+		SampleCount:  500,
+		MinCycles:    2,
+		MaxCycles:    9,
+		MedianCycles: 4,
+	}
+	for i := range h.Buckets {
+		h.Buckets[i] = uint8(i)
+		h.CDF[i] = uint8((i + 1) * 16)
+	}
+	ow.TimingHistogram = h
+	cfg2, err := ow.buildSVConfig(ctx, scrubbed, ids, entropy, b)
+	if err != nil {
+		t.Fatalf("buildSVConfig (with histogram): %v", err)
+	}
+	if !cfg2.LatencyConfig.HasHistogram {
+		t.Error("expected HasHistogram=true when a donor histogram is supplied")
+	}
+	if cfg2.LatencyConfig.CDF != h.CDF {
+		t.Errorf("expected CDF derived from donor histogram, got %v", cfg2.LatencyConfig.CDF)
+	}
+}
diff --git a/internal/firmware/output/validator_test.go b/internal/firmware/output/validator_test.go
index 20c8271..225650d 100644
--- a/internal/firmware/output/validator_test.go
+++ b/internal/firmware/output/validator_test.go
@@ -322,7 +322,7 @@ func TestLargeBAR_CmdPathRepro(t *testing.T) {
 	}
 
 	// === tclgen (called from writer.writeTCLScripts) : StockBar forces zerowrite, reports correct Bar0ByteSize ===
-	tclStock := tclgen.GenerateProjectTCL(ctx, b4k, "/tmp/lib", true /*stock*/)
+	tclStock := tclgen.GenerateProjectTCL(ctx, b4k, "/tmp/lib", true /*stock*/, 0)
 	if !strings.Contains(tclStock, "&& 0") {
 		t.Error("--stock-bar must render &&0 to use zerowrite4k path (no donor coe patch)")
 	}
@@ -331,14 +331,14 @@ func TestLargeBAR_CmdPathRepro(t *testing.T) {
 		t.Error("tcl must report Bar0 config (correct donor Bar0ByteSize even under stock)")
 	}
 
-	tclForceOversz := tclgen.GenerateProjectTCL(ctx, b4k, "/tmp/lib", false)
+	tclForceOversz := tclgen.GenerateProjectTCL(ctx, b4k, "/tmp/lib", false, 0)
 	// Bar0ByteSize demand=16k >4k => &&0 , but correct size used for IP bar config
 	if !strings.Contains(tclForceOversz, "CONFIG.Bar0_Size") {
 		t.Error("oversized (force) must still set correct donor Bar0_Size in PCIe IP")
 	}
 
 	// fitting case on large board still >4k so zerowrite for bram_ip (custom handles)
-	tclFit := tclgen.GenerateProjectTCL(ctx, b16k, "/tmp/lib", false)
+	tclFit := tclgen.GenerateProjectTCL(ctx, b16k, "/tmp/lib", false, 0)
 	if !strings.Contains(tclFit, "&& 0") {
 		t.Log("note: large fitting may or not skip based on size; current >4k always skips patch for bram_ip")
 	}
diff --git a/internal/firmware/output/writer.go b/internal/firmware/output/writer.go
index 0ca4131..28fcf3f 100644
--- a/internal/firmware/output/writer.go
+++ b/internal/firmware/output/writer.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/sercanarga/pcileechgen/internal/board"
 	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
 	"github.com/sercanarga/pcileechgen/internal/firmware"
 	"github.com/sercanarga/pcileechgen/internal/firmware/barmodel"
 	"github.com/sercanarga/pcileechgen/internal/firmware/codegen"
@@ -32,6 +33,9 @@ type OutputWriter struct {
 	Timeout   int
 	StockBar  bool
 	Force     bool
+
+	TimingHistogram *behavior.TimingHistogram
+	ILADepth        int
 }
 
 func NewOutputWriter(outputDir, libDir string, jobs, timeout int) *OutputWriter {
@@ -94,6 +98,8 @@ func (ow *OutputWriter) WriteAll(ctx *donor.DeviceContext, b *board.Board) error
 		}
 	}
 
+	ow.writeCode10Report(ctx, b, ids)
+
 	ow.writeManifest(ctx, ids)
 	return nil
 }
@@ -140,6 +146,10 @@ func (ow *OutputWriter) writeConfigSpaceArtifacts(ctx *donor.DeviceContext, scru
 		codegen.GenerateWritemaskCOE(scrubbedCS)); err != nil {
 		return fmt.Errorf("failed to write writemask COE: %w", err)
 	}
+	if err := ow.writeFile("pcileech_cfgspace_w1cmask.coe",
+		codegen.GenerateW1CMaskCOE(scrubbedCS)); err != nil {
+		return fmt.Errorf("failed to write W1C mask COE: %w", err)
+	}
 
 	msixTableSize := 0
 	if ctx.MSIXData != nil && ctx.MSIXData.TableSize > 0 {
@@ -158,13 +168,18 @@ func (ow *OutputWriter) writeConfigSpaceArtifacts(ctx *donor.DeviceContext, scru
 // writeTCLScripts generates Vivado project and build TCL scripts.
 func (ow *OutputWriter) writeTCLScripts(ctx *donor.DeviceContext, b *board.Board) error {
 	if err := ow.writeFile("vivado_generate_project.tcl",
-		tclgen.GenerateProjectTCL(ctx, b, ow.LibDir, ow.StockBar)); err != nil {
+		tclgen.GenerateProjectTCL(ctx, b, ow.LibDir, ow.StockBar, ow.ILADepth)); err != nil {
 		return fmt.Errorf("failed to write project TCL: %w", err)
 	}
 	if err := ow.writeFile("vivado_build.tcl",
 		tclgen.GenerateBuildTCL(b, ow.Jobs, ow.Timeout)); err != nil {
 		return fmt.Errorf("failed to write build TCL: %w", err)
 	}
+	if ow.ILADepth > 0 {
+		if err := ow.writeFile("ila_debug.txt", firmware.ILADebugDoc()); err != nil {
+			return fmt.Errorf("failed to write ILA debug doc: %w", err)
+		}
+	}
 	return nil
 }
 
@@ -334,6 +349,7 @@ func ListOutputFiles() []string {
 		"device_context.json",
 		"pcileech_cfgspace.coe",
 		"pcileech_cfgspace_writemask.coe",
+		"pcileech_cfgspace_w1cmask.coe",
 		"pcileech_bar_zero4k.coe",
 		"bar_behavior_profile.json",
 		"vivado_generate_project.tcl",
@@ -350,6 +366,8 @@ func ListOutputFiles() []string {
 		"config_space_init.hex",
 		"msix_table_init.hex",
 		"scrub_diff_report.txt",
+		"code10_report.txt",
+		"ila_debug.txt",
 		"build_manifest.json",
 	}
 }
@@ -484,7 +502,7 @@ func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.
 		DonorCapabilities: extractDonorCapabilities(scrubbedCS),
 		BARModel:          bm,
 		ClassCode:         ctx.Device.ClassCode,
-		LatencyConfig:     svgen.DefaultLatencyConfig(ctx.Device.ClassCode),
+		LatencyConfig:     svgen.LatencyConfigFromHistogram(ow.TimingHistogram, ctx.Device.ClassCode),
 		HasMSIX:           bm != nil,
 		BuildEntropy:      entropy,
 		PRNGSeeds:         svgen.BuildPRNGSeeds(ids.VendorID, ids.DeviceID, entropy),
@@ -492,6 +510,10 @@ func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.
 		Bar0Size:          bar0Size,
 	}
 
+	if ow.ILADepth > 0 {
+		cfg.ILAInstanceSV = firmware.ILAInstanceSV()
+	}
+
 	if devClass == devclass.ClassNVMe {
 		cfg.NVMeIdentify = nvme.BuildIdentifyData(ids, barData)
 		if len(barData) >= 0x08 {
diff --git a/internal/firmware/scrub/passes.go b/internal/firmware/scrub/passes.go
index 1fc44b8..ab27049 100644
--- a/internal/firmware/scrub/passes.go
+++ b/internal/firmware/scrub/passes.go
@@ -69,10 +69,10 @@ func (p *scrubPMCapPass) Apply(cs *pci.ConfigSpace, b *board.Board, om *overlay.
 
 		// PMCSR (cap+4): force D0, NoSoftReset, clear PME_Status + PME_Enable
 		pmcsr := cs.ReadU16(cap.Offset + 4)
-		pmcsr &= 0xFFFC  // bits [1:0] = 00 (D0)
-		pmcsr &= ^uint16(1 << 8)  // bit 8 = PME_Enable off
-		pmcsr &= 0x7FFF  // bit 15 = PME_Status clear
-		pmcsr |= 0x0008  // bit 3 = NoSoftReset
+		pmcsr &= 0xFFFC          // bits [1:0] = 00 (D0)
+		pmcsr &= ^uint16(1 << 8) // bit 8 = PME_Enable off
+		pmcsr &= 0x7FFF          // bit 15 = PME_Status clear
+		pmcsr |= 0x0008          // bit 3 = NoSoftReset
 		om.WriteU16(cap.Offset+4, pmcsr, "PM: D0, NoSoftReset, PME disabled")
 	}
 }
@@ -190,8 +190,8 @@ func (p *scrubASPMPass) Apply(cs *pci.ConfigSpace, b *board.Board, om *overlay.M
 		// bits 1:0 = ASPM enable, bit 8 = Clock PM enable
 		if cap.Offset+0x10+2 <= pci.ConfigSpaceLegacySize {
 			linkCtl := cs.ReadU16(cap.Offset + 0x10)
-			linkCtl &= 0xFFFC           // bits 1:0 = ASPM enable
-			linkCtl &= ^uint16(1 << 8)  // bit 8 = Enable Clock PM
+			linkCtl &= 0xFFFC          // bits 1:0 = ASPM enable
+			linkCtl &= ^uint16(1 << 8) // bit 8 = Enable Clock PM
 			om.WriteU16(cap.Offset+0x10, linkCtl, "disable ASPM L0s/L1 + Clock PM")
 		}
 		// clear LTR Mechanism Enable in Device Control 2 (cap+0x28)
@@ -229,21 +229,4 @@ type normalizeAERMasksPass struct{}
 
 func (p *normalizeAERMasksPass) Name() string { return "normalize AER masks" }
 func (p *normalizeAERMasksPass) Apply(cs *pci.ConfigSpace, b *board.Board, om *overlay.Map, ctx *ScrubContext) {
-	if cs.Size < pci.ConfigSpaceSize {
-		return
-	}
-	for _, cap := range ctx.ExtCaps {
-		if cap.ID != pci.ExtCapIDAER {
-			continue
-		}
-		if cap.Offset+0x0C <= pci.ConfigSpaceSize {
-			om.WriteU32(cap.Offset+0x08, 0x00462030, "set AER uncorrectable mask (spec defaults)")
-		}
-		if cap.Offset+0x18 <= pci.ConfigSpaceSize {
-			om.WriteU32(cap.Offset+0x14, 0x00002000, "set AER correctable mask (spec defaults)")
-		}
-		if cap.Offset+0x10 <= pci.ConfigSpaceSize {
-			om.WriteU32(cap.Offset+0x0C, 0x0045E011, "set AER uncorrectable severity (CT non-fatal per spec)")
-		}
-	}
 }
diff --git a/internal/firmware/scrub/passes_test.go b/internal/firmware/scrub/passes_test.go
index 2417db8..0d57558 100644
--- a/internal/firmware/scrub/passes_test.go
+++ b/internal/firmware/scrub/passes_test.go
@@ -271,6 +271,72 @@ func TestValidateCapChainPass(t *testing.T) {
 	p.Apply(cs, nil, om, ctxFor(cs))
 }
 
+func TestNormalizeAERMasksPass_PreservesDonorValues(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	aerHeader := uint32(pci.ExtCapIDAER) | (1 << 16)
+	cs.WriteU32(0x100, aerHeader)
+	const donorUncorrMask = uint32(0xDEAD1000)
+	const donorUncorrSev = uint32(0xCAFE2000)
+	const donorCorrMask = uint32(0x5A5A3000)
+	cs.WriteU32(0x108, donorUncorrMask)
+	cs.WriteU32(0x10C, donorUncorrSev)
+	cs.WriteU32(0x114, donorCorrMask)
+
+	om := overlay.NewMap(cs)
+	p := &normalizeAERMasksPass{}
+	p.Apply(cs, nil, om, ctxFor(cs))
+
+	if got := cs.ReadU32(0x108); got != donorUncorrMask {
+		t.Errorf("AER Uncorrectable Mask overwritten: got 0x%08X, want donor 0x%08X", got, donorUncorrMask)
+	}
+	if got := cs.ReadU32(0x10C); got != donorUncorrSev {
+		t.Errorf("AER Uncorrectable Severity overwritten: got 0x%08X, want donor 0x%08X", got, donorUncorrSev)
+	}
+	if got := cs.ReadU32(0x114); got != donorCorrMask {
+		t.Errorf("AER Correctable Mask overwritten: got 0x%08X, want donor 0x%08X", got, donorCorrMask)
+	}
+}
+
+func TestScrubAERPass_StatusZeroedMasksPreserved(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	aerHeader := uint32(pci.ExtCapIDAER) | (1 << 16)
+	cs.WriteU32(0x100, aerHeader)
+	cs.WriteU32(0x104, 0xFFFFFFFF)
+	cs.WriteU32(0x110, 0xFFFFFFFF)
+	cs.WriteU32(0x11C, 0xFFFFFFFF)
+	const donorUncorrMask = uint32(0xABCD0001)
+	const donorUncorrSev = uint32(0x12340002)
+	const donorCorrMask = uint32(0x56780003)
+	cs.WriteU32(0x108, donorUncorrMask)
+	cs.WriteU32(0x10C, donorUncorrSev)
+	cs.WriteU32(0x114, donorCorrMask)
+
+	om := overlay.NewMap(cs)
+	p := &scrubAERPass{}
+	p.Apply(cs, nil, om, ctxFor(cs))
+
+	if cs.ReadU32(0x104) != 0 {
+		t.Error("AER Uncorrectable Status should be zeroed")
+	}
+	if cs.ReadU32(0x110) != 0 {
+		t.Error("AER Correctable Status should be zeroed")
+	}
+	if cs.ReadU32(0x11C) != 0 {
+		t.Error("AER Root Error Status should be zeroed")
+	}
+	if got := cs.ReadU32(0x108); got != donorUncorrMask {
+		t.Errorf("scrubAERPass must not touch Uncorrectable Mask: got 0x%08X, want 0x%08X", got, donorUncorrMask)
+	}
+	if got := cs.ReadU32(0x10C); got != donorUncorrSev {
+		t.Errorf("scrubAERPass must not touch Uncorrectable Severity: got 0x%08X, want 0x%08X", got, donorUncorrSev)
+	}
+	if got := cs.ReadU32(0x114); got != donorCorrMask {
+		t.Errorf("scrubAERPass must not touch Correctable Mask: got 0x%08X, want 0x%08X", got, donorCorrMask)
+	}
+}
+
 // --- Pass name tests ---
 
 func TestPassNames(t *testing.T) {
diff --git a/internal/firmware/scrub/pruning.go b/internal/firmware/scrub/pruning.go
index 01d18fc..984d65c 100644
--- a/internal/firmware/scrub/pruning.go
+++ b/internal/firmware/scrub/pruning.go
@@ -23,9 +23,9 @@ var unsafeStandardCaps = map[uint8]string{
 	pci.CapIDEnhancedAlloc:     "Enhanced Allocation",
 	pci.CapIDFlatteningPortal:  "Flattening Portal",
 	pci.CapIDPCIX:              "PCI-X",
-	pci.CapIDBridgeSubsysVID:  "Bridge Subsystem VID",
-	pci.CapIDSecureDevice:     "Secure Device",
-	pci.CapIDAdvancedFeatures: "Advanced Features",
+	pci.CapIDBridgeSubsysVID:   "Bridge Subsystem VID",
+	pci.CapIDSecureDevice:      "Secure Device",
+	pci.CapIDAdvancedFeatures:  "Advanced Features",
 }
 
 // PruneStandardCaps unlinks unsupported caps and returns what was removed.
@@ -52,8 +52,14 @@ func PruneStandardCaps(cs *pci.ConfigSpace, om *overlay.Map) []string {
 			om.WriteU8(prevNextOff, uint8(nextPtr),
 				fmt.Sprintf("prune cap 0x%02X (%s): relink", capID, name))
 
-			om.WriteU8(ptr, 0, "zero pruned cap header")
-			om.WriteU8(ptr+1, 0, "zero pruned cap next ptr")
+			size := capSizeAt(cs, capID, ptr)
+			if nextPtr > ptr {
+				size = nextPtr - ptr
+			}
+			if ptr+size > pci.ConfigSpaceLegacySize {
+				size = pci.ConfigSpaceLegacySize - ptr
+			}
+			om.ZeroRange(ptr, ptr+size, fmt.Sprintf("zero pruned cap body 0x%02X (%s)", capID, name))
 
 			removed = append(removed, fmt.Sprintf("%s (0x%02X) at 0x%02X", name, capID, ptr))
 		} else {
diff --git a/internal/firmware/scrub/pruning_test.go b/internal/firmware/scrub/pruning_test.go
index 259765e..8ce04d2 100644
--- a/internal/firmware/scrub/pruning_test.go
+++ b/internal/firmware/scrub/pruning_test.go
@@ -99,3 +99,48 @@ func TestValidateCapChain_OutOfBounds(t *testing.T) {
 		t.Error("expected error for out-of-bounds pointer")
 	}
 }
+
+func TestPruneStandardCaps_ZerosPayload(t *testing.T) {
+	cs := pci.NewConfigSpace()
+	cs.Data[0x06] = 0x10
+	cs.WriteU8(0x34, 0x40)
+
+	cs.WriteU8(0x40, pci.CapIDPowerManagement)
+	cs.WriteU8(0x41, 0x50)
+
+	cs.WriteU8(0x50, pci.CapIDVPD)
+	cs.WriteU8(0x51, 0x60)
+	for i := 0x52; i < 0x60; i++ {
+		cs.Data[i] = 0xAA
+	}
+
+	cs.WriteU8(0x60, pci.CapIDPCIExpress)
+	cs.WriteU8(0x61, 0x00)
+	cs.Data[0x62] = 0xBB
+
+	cs.Data[0x04] = 0xCC
+
+	om := overlay.NewMap(cs)
+	removed := PruneStandardCaps(cs, om)
+
+	if len(removed) != 1 {
+		t.Fatalf("expected 1 removed cap, got %d", len(removed))
+	}
+
+	for i := 0x50; i < 0x60; i++ {
+		if cs.ReadU8(i) != 0 {
+			t.Errorf("pruned cap byte 0x%02X not zeroed: got 0x%02X", i, cs.ReadU8(i))
+		}
+	}
+
+	if cs.ReadU8(0x60) != pci.CapIDPCIExpress {
+		t.Errorf("PCIe cap ID at 0x60 corrupted: 0x%02X", cs.ReadU8(0x60))
+	}
+	if cs.Data[0x62] != 0xBB {
+		t.Errorf("PCIe payload at 0x62 corrupted: 0x%02X", cs.Data[0x62])
+	}
+
+	if cs.Data[0x04] != 0xCC {
+		t.Errorf("standard header byte 0x04 corrupted: 0x%02X", cs.Data[0x04])
+	}
+}
diff --git a/internal/firmware/svgen/generator.go b/internal/firmware/svgen/generator.go
index 07699ac..759e442 100644
--- a/internal/firmware/svgen/generator.go
+++ b/internal/firmware/svgen/generator.go
@@ -35,6 +35,7 @@ type SVGeneratorConfig struct {
 	NVMeIdentify       *nvme.IdentifyData // NVMe Identify Controller/Namespace data (nil = no responder)
 	NVMeDoorbellStride uint32             // CAP.DSTRD - doorbell stride (0 = 4B, default)
 	Bar0Size           int
+	ILAInstanceSV      string
 }
 
 // DonorCapabilities summarizes parsed capabilities from donor config space.
diff --git a/internal/firmware/svgen/ila_render_test.go b/internal/firmware/svgen/ila_render_test.go
new file mode 100644
index 0000000..c7b305a
--- /dev/null
+++ b/internal/firmware/svgen/ila_render_test.go
@@ -0,0 +1,36 @@
+package svgen_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+	"github.com/sercanarga/pcileechgen/internal/firmware/svgen"
+)
+
+func TestGenerateBarControllerSV_ILAInstance(t *testing.T) {
+	base := &svgen.SVGeneratorConfig{
+		DeviceIDs:   firmware.DeviceIDs{VendorID: 0x1102, DeviceID: 0x0012},
+		BARModel:    hdaTestBARModel(),
+		DeviceClass: "audio",
+		ClassCode:   0x040300,
+		PRNGSeeds:   [4]uint32{1, 2, 3, 4},
+	}
+
+	without, err := svgen.GenerateBarControllerSV(base)
+	if err != nil {
+		t.Fatalf("render without ILA: %v", err)
+	}
+	if strings.Contains(without, "u_ila_dbg") {
+		t.Error("controller should not contain ILA instance when ILAInstanceSV is empty")
+	}
+
+	base.ILAInstanceSV = firmware.ILAInstanceSV()
+	with, err := svgen.GenerateBarControllerSV(base)
+	if err != nil {
+		t.Fatalf("render with ILA: %v", err)
+	}
+	if !strings.Contains(with, "ila_0 u_ila_dbg") || !strings.Contains(with, ".probe0(wr_addr)") {
+		t.Errorf("controller missing ILA instance:\n%s", with[len(with)-400:])
+	}
+}
diff --git a/internal/firmware/svgen/templates/bar_controller.sv.tmpl b/internal/firmware/svgen/templates/bar_controller.sv.tmpl
index e914b6c..d1157b1 100644
--- a/internal/firmware/svgen/templates/bar_controller.sv.tmpl
+++ b/internal/firmware/svgen/templates/bar_controller.sv.tmpl
@@ -797,5 +797,5 @@ module pcileech_tlps128_bar_controller(
     endgenerate
 
     assign intr_req = bar2_intr_req{{ if eq .DeviceClass "audio" }} | hda_intr_req{{ end }}{{ if eq .DeviceClass "nvme" }} | nvme_msix_trigger{{ end }};
-
+{{ .ILAInstanceSV }}
 endmodule
diff --git a/internal/firmware/tclgen/ila_test.go b/internal/firmware/tclgen/ila_test.go
new file mode 100644
index 0000000..b94d593
--- /dev/null
+++ b/internal/firmware/tclgen/ila_test.go
@@ -0,0 +1,40 @@
+package tclgen
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/sercanarga/pcileechgen/internal/board"
+	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/pci"
+)
+
+func ilaTestCtx() (*donor.DeviceContext, *board.Board) {
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	cs.WriteU16(0x00, 0x8086)
+	cs.WriteU16(0x02, 0x1533)
+	return &donor.DeviceContext{
+		Device:      pci.PCIDevice{VendorID: 0x8086, DeviceID: 0x1533, ClassCode: 0x020000},
+		ConfigSpace: cs,
+		BARs:        []pci.BAR{},
+	}, &board.Board{Name: "TestBoard", FPGAPart: "xc7a35tfgg484-2", PCIeLanes: 1, TopModule: "test_top"}
+}
+
+func TestGenerateProjectTCL_ILAEnabled(t *testing.T) {
+	ctx, b := ilaTestCtx()
+	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false, 2048)
+	for _, want := range []string{"create_ip -name ila", "-module_name ila_0", "CONFIG.C_DATA_DEPTH {2048}", "generate_target all [get_ips ila_0]"} {
+		if !strings.Contains(tcl, want) {
+			t.Errorf("ILA-enabled TCL missing %q", want)
+		}
+	}
+}
+
+func TestGenerateProjectTCL_ILADisabled(t *testing.T) {
+	ctx, b := ilaTestCtx()
+	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false, 0)
+	if strings.Contains(tcl, "create_ip -name ila") {
+		t.Error("ILA must not be emitted when depth is 0")
+	}
+}
diff --git a/internal/firmware/tclgen/msi_test.go b/internal/firmware/tclgen/msi_test.go
index 3e72335..808e622 100644
--- a/internal/firmware/tclgen/msi_test.go
+++ b/internal/firmware/tclgen/msi_test.go
@@ -154,7 +154,7 @@ func TestGenerateProjectTCL_MSIXConfig(t *testing.T) {
 		},
 	}
 
-	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false)
+	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false, 0)
 
 	for _, want := range []string{
 		"MSIx_Table_Size",
@@ -189,7 +189,7 @@ func TestGenerateProjectTCL_NoMSIX(t *testing.T) {
 		BARs:        []pci.BAR{},
 	}
 
-	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false)
+	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false, 0)
 
 	// MSI-X should NOT be configured when donor has no MSI-X
 	if strings.Contains(tcl, "MSIx_Table_Size") {
diff --git a/internal/firmware/tclgen/tclgen.go b/internal/firmware/tclgen/tclgen.go
index 9aa1deb..dc2ebb8 100644
--- a/internal/firmware/tclgen/tclgen.go
+++ b/internal/firmware/tclgen/tclgen.go
@@ -43,6 +43,7 @@ type projectTCLData struct {
 
 	DSNEnabled       bool
 	MSICapVectorsStr string
+	ILABlock         string
 
 	// MSI-X
 	MSIXEnabled     bool
@@ -110,7 +111,7 @@ func buildBAR0Config(bar0Size int, ctx *donor.DeviceContext) bar0Config {
 // generated TCL (no donor content patch into bram_bar_zero4k), while still
 // reporting the correct (donor-demanded) Bar0ByteSize for PCIe IP BAR sizing
 // and other config. This matches --stock-bar CLI semantics.
-func GenerateProjectTCL(ctx *donor.DeviceContext, b *board.Board, libDir string, stockBar bool) string {
+func GenerateProjectTCL(ctx *donor.DeviceContext, b *board.Board, libDir string, stockBar bool, ilaDepth int) string {
 	ids := firmware.ExtractDeviceIDs(ctx.ConfigSpace, ctx.ExtCapabilities)
 
 	// Use the board's max link speed for the Xilinx IP core.
@@ -165,6 +166,10 @@ func GenerateProjectTCL(ctx *donor.DeviceContext, b *board.Board, libDir string,
 		MSICapVectorsStr: msiVectorsToTCL(msiVectors),
 	}
 
+	if ilaDepth > 0 {
+		data.ILABlock = firmware.ILACreateIPTCL(ilaDepth)
+	}
+
 	if ctx.MSIXData != nil && ctx.MSIXData.TableSize > 0 {
 		data.MSIXEnabled = true
 		data.MSIXTableSize = ctx.MSIXData.TableSize - 1
diff --git a/internal/firmware/tclgen/tclgen_test.go b/internal/firmware/tclgen/tclgen_test.go
index ff26949..48bc866 100644
--- a/internal/firmware/tclgen/tclgen_test.go
+++ b/internal/firmware/tclgen/tclgen_test.go
@@ -37,7 +37,7 @@ func TestGenerateProjectTCL(t *testing.T) {
 		BARs:            []pci.BAR{},
 	}
 
-	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false)
+	tcl := GenerateProjectTCL(ctx, b, "/tmp/lib", false, 0)
 
 	if !strings.Contains(tcl, "8086") {
 		t.Error("TCL should contain vendor ID")
diff --git a/internal/firmware/tclgen/templates/project.tcl.tmpl b/internal/firmware/tclgen/templates/project.tcl.tmpl
index 2db97d1..4aadc5b 100644
--- a/internal/firmware/tclgen/templates/project.tcl.tmpl
+++ b/internal/firmware/tclgen/templates/project.tcl.tmpl
@@ -98,6 +98,7 @@ set all_ips [get_ips -quiet *]
 if {[llength $all_ips] > 0} {
   upgrade_ip $all_ips
 }
+{{ .ILABlock }}
 
 # Point BRAM IPs to the generated COE files (library defaults are all-zero)
 set bar_bram [get_ips -quiet bram_bar_zero4k]
diff --git a/internal/vivado/builder.go b/internal/vivado/builder.go
index ad5095a..4299cab 100644
--- a/internal/vivado/builder.go
+++ b/internal/vivado/builder.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/sercanarga/pcileechgen/internal/board"
 	"github.com/sercanarga/pcileechgen/internal/donor"
+	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
 	fwout "github.com/sercanarga/pcileechgen/internal/firmware/output"
 	"github.com/sercanarga/pcileechgen/internal/util"
 )
@@ -22,6 +23,9 @@ type BuildOptions struct {
 	SkipVivado bool
 	StockBar   bool
 	Force      bool
+
+	TimingHistogram *behavior.TimingHistogram
+	ILADepth        int
 }
 
 // WithDefaults returns a copy of opts with zero values replaced by sensible defaults.
@@ -60,6 +64,8 @@ func (b *Builder) Build(ctx *donor.DeviceContext) error {
 	ow := fwout.NewOutputWriter(b.opts.OutputDir, b.opts.LibDir, b.opts.Jobs, b.opts.Timeout)
 	ow.StockBar = b.opts.StockBar
 	ow.Force = b.opts.Force
+	ow.TimingHistogram = b.opts.TimingHistogram
+	ow.ILADepth = b.opts.ILADepth
 	if err := ow.WriteAll(ctx, b.board); err != nil {
 		return fmt.Errorf("artifact generation failed: %w", err)
 	}
diff --git a/sim/README.md b/sim/README.md
new file mode 100644
index 0000000..f15e544
--- /dev/null
+++ b/sim/README.md
@@ -0,0 +1,32 @@
+# sim/ — behavioral RTL unit simulations
+
+Self-contained Icarus Verilog testbenches for the behavioral modules that
+address the emulation-gap audit (config-space W1C, MSI-X PBA, NVMe backing
+store). These prove the *logic* of each module in simulation; they are not the
+full PCILeech datapath (that needs the `pcileech-fpga` submodule + Vivado).
+
+## Run
+
+    make sim                 # all modules
+    ./sim/run.sh             # all modules
+    ./sim/run.sh cfg_w1c_shadow   # one module
+
+Requires `iverilog` (`apt-get install iverilog`). Each `<name>_tb.sv` is
+compiled with its DUT `<name>.sv`; a module passes only when its testbench
+prints `ALL TESTS PASSED`. The harness exits non-zero on any failure and the
+red path is verified (a wrong DUT makes the testbench report `FAIL`).
+
+## Modules
+
+| DUT | Audit gap it closes |
+|-----|---------------------|
+| `cfg_w1c_shadow.sv` | config-space registers are write-1-to-clear (shadow BRAM stored writes verbatim → detectable). Driven by `pcileech_cfgspace_w1cmask.coe`. |
+| `msix_pba.sv` | MSI-X PBA was a static zero array; pending bits now set on masked requests and deliver on unmask. |
+| `nvme_store.sv` | NVMe IO reads returned zeros and writes were discarded (Event 11); this is the BRAM sector cache the responder writes through. |
+
+## Integrating into firmware
+
+These are reference modules. Wiring them into the generated SV (e.g. routing
+`cfg_w1c_shadow` into the config-space shadow write path, instantiating
+`nvme_store` in `pcileech_nvme_admin_responder.sv`) is the next step and must be
+validated with Vivado synthesis + on-hardware testing.
diff --git a/sim/cfg_w1c_shadow.sv b/sim/cfg_w1c_shadow.sv
new file mode 100644
index 0000000..6cf285c
--- /dev/null
+++ b/sim/cfg_w1c_shadow.sv
@@ -0,0 +1,14 @@
+`default_nettype none
+module cfg_w1c_shadow (
+    input  wire [31:0] cur_val,
+    input  wire [31:0] wr_data,
+    input  wire [31:0] wr_mask,
+    input  wire [31:0] w1c_mask,
+    output wire [31:0] new_val
+);
+    wire [31:0] ro_keep   = cur_val & ~wr_mask & ~w1c_mask;
+    wire [31:0] rw_take   = wr_data & wr_mask & ~w1c_mask;
+    wire [31:0] w1c_keep  = cur_val & w1c_mask & ~wr_data;
+    assign new_val = ro_keep | rw_take | w1c_keep;
+endmodule
+`default_nettype wire
diff --git a/sim/cfg_w1c_shadow_tb.sv b/sim/cfg_w1c_shadow_tb.sv
new file mode 100644
index 0000000..9b6125f
--- /dev/null
+++ b/sim/cfg_w1c_shadow_tb.sv
@@ -0,0 +1,45 @@
+`default_nettype none
+`timescale 1ns/1ps
+module cfg_w1c_shadow_tb;
+    reg  [31:0] cur, data, wmask, w1c;
+    wire [31:0] nv;
+    integer errors = 0;
+
+    cfg_w1c_shadow dut (.cur_val(cur), .wr_data(data), .wr_mask(wmask), .w1c_mask(w1c), .new_val(nv));
+
+    task check(input [255:0] name, input [31:0] got, input [31:0] exp);
+        begin
+            if (got !== exp) begin
+                $display("FAIL %0s: got %08x exp %08x", name, got, exp);
+                errors = errors + 1;
+            end else begin
+                $display("ok   %0s = %08x", name, got);
+            end
+        end
+    endtask
+
+    initial begin
+        cur = 32'hF900_0000; data = 32'h0800_0000; wmask = 32'hFFFF_0006; w1c = 32'hF900_0000;
+        #1; check("w1c clears written bit", nv, 32'hF100_0000);
+
+        cur = 32'hF900_0000; data = 32'h0000_0000; wmask = 32'hFFFF_0006; w1c = 32'hF900_0000;
+        #1; check("w1c keeps unwritten bits", nv, 32'hF900_0000);
+
+        cur = 32'hF900_0000; data = 32'hF900_0000; wmask = 32'hFFFF_0006; w1c = 32'hF900_0000;
+        #1; check("w1c full clear", nv, 32'h0000_0000);
+
+        cur = 32'h0000_0000; data = 32'h0000_0002; wmask = 32'hFFFF_0006; w1c = 32'hF900_0000;
+        #1; check("rw bit takes data", nv, 32'h0000_0002);
+
+        cur = 32'h0000_0000; data = 32'h0000_0001; wmask = 32'hFFFF_0006; w1c = 32'hF900_0000;
+        #1; check("ro bit ignored", nv, 32'h0000_0000);
+
+        cur = 32'hF900_0000; data = 32'h0800_0002; wmask = 32'hFFFF_0006; w1c = 32'hF900_0000;
+        #1; check("mixed w1c+rw", nv, 32'hF100_0002);
+
+        if (errors == 0) $display("ALL TESTS PASSED");
+        else $display("%0d FAILURES", errors);
+        $finish;
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/msix_pba.sv b/sim/msix_pba.sv
new file mode 100644
index 0000000..14806d8
--- /dev/null
+++ b/sim/msix_pba.sv
@@ -0,0 +1,45 @@
+`default_nettype none
+module msix_pba #(parameter NVEC = 4) (
+    input  wire                     clk,
+    input  wire                     rst_n,
+    input  wire [NVEC-1:0]          vector_mask,
+    input  wire                     req_valid,
+    input  wire [$clog2(NVEC)-1:0] req_vec,
+    output reg  [NVEC-1:0]          pba,
+    output reg                      deliver_valid,
+    output reg  [$clog2(NVEC)-1:0] deliver_vec
+);
+    localparam VW = $clog2(NVEC);
+
+    reg     found;
+    integer i;
+
+    always @(posedge clk or negedge rst_n) begin
+        if (!rst_n) begin
+            pba           <= {NVEC{1'b0}};
+            deliver_valid <= 1'b0;
+            deliver_vec   <= {VW{1'b0}};
+        end else begin
+            deliver_valid <= 1'b0;
+            deliver_vec   <= {VW{1'b0}};
+
+            if (req_valid && vector_mask[req_vec]) begin
+                pba[req_vec] <= 1'b1;
+            end else if (req_valid) begin
+                deliver_valid <= 1'b1;
+                deliver_vec   <= req_vec;
+            end else begin
+                found = 1'b0;
+                for (i = 0; i < NVEC; i = i + 1) begin
+                    if (!found && !vector_mask[i] && pba[i]) begin
+                        deliver_valid <= 1'b1;
+                        deliver_vec   <= i[VW-1:0];
+                        pba[i]        <= 1'b0;
+                        found          = 1'b1;
+                    end
+                end
+            end
+        end
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/msix_pba_tb.sv b/sim/msix_pba_tb.sv
new file mode 100644
index 0000000..9517e4d
--- /dev/null
+++ b/sim/msix_pba_tb.sv
@@ -0,0 +1,81 @@
+`default_nettype none
+`timescale 1ns/1ps
+module msix_pba_tb;
+    localparam NVEC = 4;
+    localparam VW   = $clog2(NVEC);
+
+    reg             clk         = 0;
+    reg             rst_n       = 0;
+    reg [NVEC-1:0]  vector_mask = 0;
+    reg             req_valid   = 0;
+    reg [VW-1:0]    req_vec     = 0;
+    wire [NVEC-1:0] pba;
+    wire            deliver_valid;
+    wire [VW-1:0]   deliver_vec;
+
+    integer errors = 0;
+
+    msix_pba #(.NVEC(NVEC)) dut (
+        .clk(clk), .rst_n(rst_n),
+        .vector_mask(vector_mask),
+        .req_valid(req_valid), .req_vec(req_vec),
+        .pba(pba), .deliver_valid(deliver_valid), .deliver_vec(deliver_vec)
+    );
+
+    always #5 clk = ~clk;
+
+    task check(input [255:0] name, input [31:0] got, input [31:0] exp);
+        begin
+            if (got !== exp) begin
+                $display("FAIL %0s: got %08x exp %08x", name, got, exp);
+                errors = errors + 1;
+            end else begin
+                $display("ok   %0s = %08x", name, got);
+            end
+        end
+    endtask
+
+    initial begin
+        rst_n = 0;
+        repeat (2) @(posedge clk);
+        rst_n = 1;
+        @(posedge clk); #1;
+        check("reset clears pba", {28'b0, pba}, 32'h0);
+
+        vector_mask = 4'b0010;
+        req_valid = 1; req_vec = 2'd1;
+        @(posedge clk); #1;
+        req_valid = 0;
+        check("T1 pba[1] set on masked req",    {31'b0, pba[1]},        32'h1);
+        check("T1 deliver_valid=0 (no deliver)",{31'b0, deliver_valid}, 32'h0);
+
+        vector_mask = 4'b0000;
+        req_valid = 1; req_vec = 2'd2;
+        @(posedge clk); #1;
+        req_valid = 0;
+        check("T2 deliver_valid=1",             {31'b0, deliver_valid}, 32'h1);
+        check("T2 deliver_vec=2",               {30'b0, deliver_vec},   32'h2);
+        check("T2 pba[2] stays 0",              {31'b0, pba[2]},        32'h0);
+
+        check("T3 pre: pba[1] still pending",   {31'b0, pba[1]},        32'h1);
+        @(posedge clk); #1;
+        check("T3 deliver_valid=1 on unmask",   {31'b0, deliver_valid}, 32'h1);
+        check("T3 deliver_vec=1",               {30'b0, deliver_vec},   32'h1);
+        check("T3 pba[1] cleared",              {31'b0, pba[1]},        32'h0);
+        @(posedge clk); #1;
+        check("T3 deliver_valid falls next cycle",{31'b0,deliver_valid},32'h0);
+
+        vector_mask = 4'b1111;
+        req_valid = 1; req_vec = 2'd0; @(posedge clk); #1; req_valid = 0;
+        req_valid = 1; req_vec = 2'd3; @(posedge clk); #1; req_valid = 0;
+        check("T4 pre: pba has pending bits",   {31'b0, |pba},          32'h1);
+        rst_n = 0; @(posedge clk); #1;
+        rst_n = 1; @(posedge clk); #1;
+        check("T4 pba cleared by reset",        {28'b0, pba},           32'h0);
+
+        if (errors == 0) $display("ALL TESTS PASSED");
+        else $display("%0d FAILURES", errors);
+        $finish;
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/nvme_store.sv b/sim/nvme_store.sv
new file mode 100644
index 0000000..5afecac
--- /dev/null
+++ b/sim/nvme_store.sv
@@ -0,0 +1,38 @@
+`default_nettype none
+module nvme_store #(
+    parameter NSECT   = 4,
+    parameter SECT_DW = 8
+) (
+    input  wire clk,
+    input  wire [$clog2(NSECT)-1:0]   wr_sector,
+    input  wire [$clog2(SECT_DW)-1:0] wr_dw,
+    input  wire [31:0]                 wr_data,
+    input  wire                        wr_en,
+    input  wire [$clog2(NSECT)-1:0]   rd_sector,
+    input  wire [$clog2(SECT_DW)-1:0] rd_dw,
+    input  wire                        rd_en,
+    output reg  [31:0]                 rd_data,
+    output reg                         rd_valid
+);
+    localparam DEPTH = NSECT * SECT_DW;
+    localparam AW    = $clog2(NSECT) + $clog2(SECT_DW);
+
+    reg [31:0] mem [0:DEPTH-1];
+    integer i;
+    initial begin
+        for (i = 0; i < DEPTH; i = i + 1)
+            mem[i] = 32'h0000_0000;
+    end
+
+    wire [AW-1:0] wr_addr = {wr_sector, wr_dw};
+    wire [AW-1:0] rd_addr = {rd_sector, rd_dw};
+
+    always @(posedge clk) begin
+        if (wr_en)
+            mem[wr_addr] <= wr_data;
+        rd_valid <= rd_en;
+        if (rd_en)
+            rd_data <= mem[rd_addr];
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/nvme_store_tb.sv b/sim/nvme_store_tb.sv
new file mode 100644
index 0000000..476d1f4
--- /dev/null
+++ b/sim/nvme_store_tb.sv
@@ -0,0 +1,89 @@
+`default_nettype none
+`timescale 1ns/1ps
+module nvme_store_tb;
+    localparam NSECT   = 4;
+    localparam SECT_DW = 8;
+
+    reg clk = 0;
+    always #5 clk = ~clk;
+
+    reg         wr_en     = 0;
+    reg  [1:0]  wr_sector = 0;
+    reg  [2:0]  wr_dw     = 0;
+    reg  [31:0] wr_data   = 0;
+    reg         rd_en     = 0;
+    reg  [1:0]  rd_sector = 0;
+    reg  [2:0]  rd_dw     = 0;
+    wire [31:0] rd_data;
+    wire        rd_valid;
+
+    nvme_store #(.NSECT(NSECT), .SECT_DW(SECT_DW)) dut (
+        .clk(clk),
+        .wr_en(wr_en), .wr_sector(wr_sector), .wr_dw(wr_dw), .wr_data(wr_data),
+        .rd_en(rd_en), .rd_sector(rd_sector), .rd_dw(rd_dw),
+        .rd_data(rd_data), .rd_valid(rd_valid)
+    );
+
+    integer errors = 0;
+
+    task check;
+        input [255:0] name;
+        input [31:0]  got;
+        input [31:0]  exp;
+        begin
+            if (got !== exp) begin
+                $display("FAIL %0s: got %08x exp %08x", name, got, exp);
+                errors = errors + 1;
+            end else begin
+                $display("ok   %0s = %08x", name, got);
+            end
+        end
+    endtask
+
+    task do_write;
+        input [1:0]  sect;
+        input [2:0]  dw;
+        input [31:0] data;
+        begin
+            wr_en = 1; wr_sector = sect; wr_dw = dw; wr_data = data;
+            @(posedge clk); #1;
+            wr_en = 0;
+        end
+    endtask
+
+    task do_read;
+        input [1:0] sect;
+        input [2:0] dw;
+        begin
+            rd_en = 1; rd_sector = sect; rd_dw = dw;
+            @(posedge clk); #1;
+            rd_en = 0;
+        end
+    endtask
+
+    initial begin
+        @(posedge clk); #1;
+
+        do_write(0, 0, 32'hDEAD_BEEF);
+        do_read(0, 0);
+        check("write-readback",   rd_data,           32'hDEAD_BEEF);
+        check("rd_valid-high",    {31'd0, rd_valid},  32'h0000_0001);
+
+        do_read(2, 5);
+        check("unwritten-zero",   rd_data,            32'h0000_0000);
+
+        do_write(0, 0, 32'hCAFE_F00D);
+        do_read(1, 0);
+        check("no-alias-sector",  rd_data,            32'h0000_0000);
+
+        do_write(0, 0, 32'h1234_5678);
+        do_write(0, 0, 32'hABCD_EF01);
+        do_read(0, 0);
+        check("overwrite-new",    rd_data,            32'hABCD_EF01);
+
+        if (errors == 0) $display("ALL TESTS PASSED");
+        else $display("%0d FAILURES", errors);
+        $finish;
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/run.sh b/sim/run.sh
new file mode 100755
index 0000000..f4f506f
--- /dev/null
+++ b/sim/run.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -uo pipefail
+cd "$(dirname "$0")"
+mkdir -p build
+
+command -v iverilog >/dev/null 2>&1 || { echo "iverilog not installed (apt-get install iverilog)"; exit 127; }
+
+if [ "$#" -gt 0 ]; then
+  tbs=()
+  for n in "$@"; do tbs+=("${n%_tb.sv}_tb.sv"); done
+else
+  tbs=(*_tb.sv)
+fi
+
+fail=0
+for tb in "${tbs[@]}"; do
+  base="${tb%_tb.sv}"
+  dut="${base}.sv"
+  if [ ! -f "$tb" ]; then echo "[MISS] testbench $tb not found"; fail=1; continue; fi
+  if [ ! -f "$dut" ]; then echo "[MISS] DUT $dut not found"; fail=1; continue; fi
+  if ! iverilog -g2012 -Wall -o "build/${base}.vvp" "$dut" "$tb" 2>"build/${base}.log"; then
+    echo "[FAIL] $base (compile)"; cat "build/${base}.log"; fail=1; continue
+  fi
+  out="$(vvp "build/${base}.vvp" 2>&1)"
+  if echo "$out" | grep -q "ALL TESTS PASSED"; then
+    echo "[PASS] $base"
+  else
+    echo "[FAIL] $base"; echo "$out"; fail=1
+  fi
+done
+
+if [ "$fail" -eq 0 ]; then echo "== sim: all modules passed =="; else echo "== sim: FAILURES =="; fi
+exit $fail

From 3031f56ffd7cd0ae34f9cffe83fe87a980b2c339 Mon Sep 17 00:00:00 2001
From: VoidChecksum <89574102+VoidChecksum@users.noreply.github.com>
Date: Tue, 30 Jun 2026 12:36:41 +0200
Subject: [PATCH 27/31] Skip destructive BAR write-probing for network donors
 (fixes "hung on BAR")

BAR profiling mmaps the donor BAR read-write and writes 0xFFFFFFFF/0x0/test
patterns to every register to map RW/W1C bits. On firmware-mailbox NICs like
Aquantia 10GbE (Gen3 x4) this deadlocks the on-chip firmware and the next MMIO
read hangs the CPU - the device "hangs on BAR" during data collection.

- Never write-probe network-class donors (base class 0x02); a read-only dump is
  enough to clone them and devclass models supply the register behavior.
- Add --probe-bars (default true) so any other donor that hangs can be collected
  read-only with --probe-bars=false.
---
 cmd/pcileechgen/build.go               |  3 +++
 internal/donor/bar_probe_guard.go      | 18 +++++++++++++++
 internal/donor/bar_probe_guard_test.go | 31 ++++++++++++++++++++++++++
 internal/donor/collector.go            | 25 +++++++++++++++------
 4 files changed, 70 insertions(+), 7 deletions(-)
 create mode 100644 internal/donor/bar_probe_guard.go
 create mode 100644 internal/donor/bar_probe_guard_test.go

diff --git a/cmd/pcileechgen/build.go b/cmd/pcileechgen/build.go
index f0194b1..5043305 100644
--- a/cmd/pcileechgen/build.go
+++ b/cmd/pcileechgen/build.go
@@ -29,6 +29,7 @@ type buildFlags struct {
 	mmioTrace  string
 	ila        bool
 	ilaDepth   int
+	probeBars  bool
 }
 
 var buildOpts buildFlags
@@ -156,6 +157,7 @@ func loadDonorContext() (*donor.DeviceContext, error) {
 	slog.Info("collecting donor device data")
 
 	collector := donor.NewCollector()
+	collector.ProbeBARs = buildOpts.probeBars
 	ctx, err := collector.Collect(bdf)
 	if err != nil {
 		return nil, fmt.Errorf("device data collection failed: %w", err)
@@ -204,6 +206,7 @@ func init() {
 	buildCmd.Flags().BoolVar(&buildOpts.force, "force", false, "ignore donor BAR > board BRAM check")
 	buildCmd.Flags().BoolVar(&buildOpts.ila, "ila", false, "insert a Vivado ILA debug core probing BAR/TLP/interrupt signals")
 	buildCmd.Flags().IntVar(&buildOpts.ilaDepth, "ila-depth", firmware.DefaultILADepth, "ILA capture depth in samples (with --ila)")
+	buildCmd.Flags().BoolVar(&buildOpts.probeBars, "probe-bars", true, "write-probe BAR registers to map RW/W1C bits (always skipped for network cards; set false if a donor hangs on BAR)")
 
 	_ = buildCmd.MarkFlagRequired("board")
 
diff --git a/internal/donor/bar_probe_guard.go b/internal/donor/bar_probe_guard.go
new file mode 100644
index 0000000..a127719
--- /dev/null
+++ b/internal/donor/bar_probe_guard.go
@@ -0,0 +1,18 @@
+package donor
+
+func isNetworkClass(classCode uint32) bool {
+	return (classCode>>16)&0xFF == 0x02
+}
+
+func shouldProbeBAR(enabled bool, classCode uint32, content []byte) bool {
+	if !enabled {
+		return false
+	}
+	if len(content) > 0 && isAllFF(content) {
+		return false
+	}
+	if isNetworkClass(classCode) {
+		return false
+	}
+	return true
+}
diff --git a/internal/donor/bar_probe_guard_test.go b/internal/donor/bar_probe_guard_test.go
new file mode 100644
index 0000000..d7715fe
--- /dev/null
+++ b/internal/donor/bar_probe_guard_test.go
@@ -0,0 +1,31 @@
+package donor
+
+import "testing"
+
+func TestShouldProbeBAR(t *testing.T) {
+	good := []byte{0x00, 0x01, 0x02, 0x03}
+	ff := []byte{0xFF, 0xFF, 0xFF, 0xFF}
+
+	cases := []struct {
+		name      string
+		enabled   bool
+		classCode uint32
+		content   []byte
+		want      bool
+	}{
+		{"disabled", false, 0x010802, good, false},
+		{"network ethernet skipped", true, 0x020000, good, false},
+		{"network other-subclass skipped (aquantia 10GbE)", true, 0x028000, good, false},
+		{"all-FF skipped", true, 0x010802, ff, false},
+		{"nvme probed", true, 0x010802, good, true},
+		{"audio probed", true, 0x040300, good, true},
+		{"no content still probed (non-network)", true, 0x010802, nil, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := shouldProbeBAR(c.enabled, c.classCode, c.content); got != c.want {
+				t.Errorf("shouldProbeBAR(%v, %#x, len=%d) = %v, want %v", c.enabled, c.classCode, len(c.content), got, c.want)
+			}
+		})
+	}
+}
diff --git a/internal/donor/collector.go b/internal/donor/collector.go
index 7c893ba..ab85f25 100644
--- a/internal/donor/collector.go
+++ b/internal/donor/collector.go
@@ -22,18 +22,24 @@ const (
 // Collector gathers donor PCI data from sysfs.
 type Collector struct {
 	sysfs *SysfsReader
+	// ProbeBARs enables destructive write-readback BAR profiling. Network-class
+	// donors are never probed regardless, since writing live NIC registers
+	// (e.g. Aquantia firmware-mailbox 10GbE chips) hangs the device on BAR.
+	ProbeBARs bool
 }
 
 func NewCollector() *Collector {
 	return &Collector{
-		sysfs: NewSysfsReader(),
+		sysfs:     NewSysfsReader(),
+		ProbeBARs: true,
 	}
 }
 
 // NewCollectorWithSysfs lets tests inject a fake sysfs reader.
 func NewCollectorWithSysfs(sr *SysfsReader) *Collector {
 	return &Collector{
-		sysfs: sr,
+		sysfs:     sr,
+		ProbeBARs: true,
 	}
 }
 
@@ -65,7 +71,7 @@ func (c *Collector) Collect(bdf pci.BDF) (*DeviceContext, error) {
 	ctx.BARs = bars
 
 	ctx.BARContents = c.collectBARMemory(bdf, bars)
-	ctx.BARProfiles = c.collectBARProfiles(bdf, bars, ctx.BARContents)
+	ctx.BARProfiles = c.collectBARProfiles(bdf, bars, ctx.BARContents, ctx.Device.ClassCode)
 	ctx.Capabilities = pci.ParseCapabilities(cs)
 	ctx.ExtCapabilities = pci.ParseExtCapabilities(cs)
 	ctx.MSIXData = c.collectMSIXData(cs, ctx.BARContents)
@@ -413,14 +419,19 @@ func (c *Collector) readBARs(bdf pci.BDF, eligible []pci.BAR, contents map[int][
 	}
 }
 
-func (c *Collector) collectBARProfiles(bdf pci.BDF, bars []pci.BAR, barContents map[int][]byte) map[int]*BARProfile {
+func (c *Collector) collectBARProfiles(bdf pci.BDF, bars []pci.BAR, barContents map[int][]byte, classCode uint32) map[int]*BARProfile {
 	profiler := NewBARProfiler()
 	profiles := make(map[int]*BARProfile)
 
+	if isNetworkClass(classCode) {
+		slog.Info("BAR profiling skipped: network-class donor (write-probing hangs NIC firmware, e.g. Aquantia)", "class", fmt.Sprintf("0x%06X", classCode))
+		return profiles
+	}
+
 	for _, bar := range eligibleBARs(bars) {
-		// don't probe unresponsive BARs, writes can brick the device
-		if data, ok := barContents[bar.Index]; ok && isAllFF(data) {
-			slog.Info("BAR profiling skipped: content is all 0xFF", "bar", bar.Index)
+		// don't probe unresponsive BARs or when disabled, writes can brick the device
+		if !shouldProbeBAR(c.ProbeBARs, classCode, barContents[bar.Index]) {
+			slog.Info("BAR profiling skipped", "bar", bar.Index, "probe_enabled", c.ProbeBARs)
 			continue
 		}
 

From 3730fa16cbe5eb4b867356784aeda8c5c6d4c189 Mon Sep 17 00:00:00 2001
From: VoidChecksum <89574102+VoidChecksum@users.noreply.github.com>
Date: Tue, 30 Jun 2026 14:37:23 +0200
Subject: [PATCH 28/31] docs: document new build flags, artifacts, sim target,
 and Aquantia fix

- README: --mmio-trace/--ila/--ila-depth/--probe-bars + global log flags,
  new artifacts (w1cmask coe, code10_report.txt, ila_debug.txt), make sim.
- KNOWN_ISSUES: correct stale NVMe note (IO queues exist; backing store is the
  gap) and add the Aquantia "hangs on BAR" entry + --probe-bars=false workaround.
---
 KNOWN_ISSUES | 11 +++++++++--
 README       | 14 ++++++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/KNOWN_ISSUES b/KNOWN_ISSUES
index 89745fe..92925bc 100644
--- a/KNOWN_ISSUES
+++ b/KNOWN_ISSUES
@@ -54,8 +54,15 @@ cause: usually BIOS / Windows DMA settings, not the firmware.
 fix: recheck BIOS + Windows settings; compare to a known-good firmware.
 
 Note (not a bug): NVMe full disk emulation is still in progress.
-The admin queue and init work, but BRAM cache + IO queues are not done yet, so
-NVMe donors commonly hit Code 10 / stornvme Event 11 until then.
+The admin queue, init, and IO submission/completion queues work, but there is no
+backing store yet (IO reads return zeros, writes are discarded), so NVMe donors
+commonly hit Code 10 / stornvme Event 11 until a sector cache is added.
+
+problem: NIC "hangs on BAR" during data collection (e.g. Aquantia 10GbE)
+cause: BAR profiling write-probes live device registers to map RW/W1C bits;
+       firmware-mailbox NICs deadlock and the next MMIO read hangs the CPU.
+fix: fixed - network-class donors are no longer write-probed. For any other
+     card that hangs on BAR, collect read-only with: build --probe-bars=false
 
 Note (not a bug): xHCI (USB) emulation is partial.
 Clones enumerate, but host read/write + doorbell gaps remain, so USBXHCI often
diff --git a/README b/README
index 08da464..1b58e49 100644
--- a/README
+++ b/README
@@ -85,6 +85,16 @@ COMMANDS
     --force            allow donor BAR > board BRAM (may truncate)
     --from-json <f>    offline build from saved device_context.json
     --output <dir>     output directory (default: pcileech_datastore)
+    --mmio-trace <f>   shape TLP latency emulation from a saved donor MMIO trace
+    --ila              insert a Vivado ILA debug core (probes BAR/TLP/interrupt)
+    --ila-depth <n>    ILA capture depth in samples (default 1024)
+    --probe-bars       write-probe BAR registers (default on; auto-skipped for
+                       network cards; set --probe-bars=false if a donor hangs)
+
+  Global flags (all commands):
+    --log-level <lvl>  debug|info|warn|error (default info)
+    --log-file <f>     tee the full pre/mid/post-generation run to a file
+    --json-logs        structured JSON logs
 
   Offline MMIO trace import:
     pcileechgen mmio-trace --trace-file mmiotrace.txt --bar-base 0xf7800000 \
@@ -156,6 +166,7 @@ OUTPUT
     device_context.json                 donor snapshot
     pcileech_cfgspace.coe               4KB scrubbed config space
     pcileech_cfgspace_writemask.coe     per-register write masks
+    pcileech_cfgspace_w1cmask.coe       per-bit write-1-to-clear mask
     pcileech_bar_zero4k.coe             BAR0 content (sized to donor/BRAM)
     pcileech_bar_impl_device.sv         register-level BAR implementation
     pcileech_tlps128_bar_controller.sv  TLP BAR controller
@@ -169,6 +180,8 @@ OUTPUT
     identify_init.hex                   NVMe Identify ROM (if NVMe)
     vivado_generate_project.tcl         project creation
     vivado_build.tcl                    synthesis script
+    code10_report.txt                   Code-10 risk summary for this build
+    ila_debug.txt                       ILA JTAG capture workflow (if --ila)
     build_manifest.json                 checksums + metadata
     src/                                patched board SV sources
     *.bin                               bitstream (after Vivado)
@@ -180,6 +193,7 @@ DEVELOPMENT
   make test-coverage  tests with coverage report
   make lint           run linter
   make check          vet + lint + test
+  make sim            unit-simulate the behavioral RTL modules (needs iverilog)
 
 
 UTILITIES

From b05c25626030bff4528259bb8fc918e03c72054c Mon Sep 17 00:00:00 2001
From: VoidChecksum <89574102+VoidChecksum@users.noreply.github.com>
Date: Tue, 30 Jun 2026 14:51:13 +0200
Subject: [PATCH 29/31] sim: AHCI port command engine (fixes SATA Code 10 "I/O
 adapter hardware error")

SATA/AHCI clones had no command engine: PxCI was a static register that never
cleared and no completion FIS was posted, so storahci times out at init -> Code
10. New behavioral RTL ahci_engine.sv implements the slot-0 command FSM: walks
the command list -> command table H2D FIS -> PRDT, services IDENTIFY and READ/
WRITE DMA EXT over a BRAM sector store, writes the D2H Register FIS, sets PxTFD
ready + PxIS.DHRS + intr, and clears PxCI. iverilog testbench proves IDENTIFY
completion and a WRITE->READ sector round-trip (10 checks).

Logic verified under simulation; wiring into the generated controller (BAR5/
ABAR datapath, real PCIe TLP DMA, donor IDENTIFY block) is the next step and
needs Vivado + on-hardware validation.
---
 sim/README.md         |   1 +
 sim/ahci_engine.sv    | 107 ++++++++++++++++++++++++++++++++++++++++++
 sim/ahci_engine_tb.sv |  89 +++++++++++++++++++++++++++++++++++
 3 files changed, 197 insertions(+)
 create mode 100644 sim/ahci_engine.sv
 create mode 100644 sim/ahci_engine_tb.sv

diff --git a/sim/README.md b/sim/README.md
index f15e544..55a57e2 100644
--- a/sim/README.md
+++ b/sim/README.md
@@ -23,6 +23,7 @@ red path is verified (a wrong DUT makes the testbench report `FAIL`).
 | `cfg_w1c_shadow.sv` | config-space registers are write-1-to-clear (shadow BRAM stored writes verbatim → detectable). Driven by `pcileech_cfgspace_w1cmask.coe`. |
 | `msix_pba.sv` | MSI-X PBA was a static zero array; pending bits now set on masked requests and deliver on unmask. |
 | `nvme_store.sv` | NVMe IO reads returned zeros and writes were discarded (Event 11); this is the BRAM sector cache the responder writes through. |
+| `ahci_engine.sv` | SATA/AHCI had no command engine — PxCI never cleared, so storahci times out (Code 10 "I/O adapter hardware error"). Implements the slot-0 command FSM: IDENTIFY + READ/WRITE DMA over a sector store, D2H FIS, PxIS/intr, PxCI clear. |
 
 ## Integrating into firmware
 
diff --git a/sim/ahci_engine.sv b/sim/ahci_engine.sv
new file mode 100644
index 0000000..0104f07
--- /dev/null
+++ b/sim/ahci_engine.sv
@@ -0,0 +1,107 @@
+`default_nettype none
+// AHCI port command engine (slot 0). On PxCI bit0 with PxCMD.ST+FRE set it
+// walks the command list -> command table (H2D FIS) -> PRDT data base, then:
+//   IDENTIFY (0xEC)      -> DMA identify block to DBA
+//   READ DMA EXT (0x25)  -> DMA one sector from backing store to DBA
+//   WRITE DMA EXT (0x35) -> DMA one sector from DBA into backing store
+// then writes a D2H Register FIS to PxFB+0x40, sets PxTFD ready, PxIS.DHRS,
+// raises intr, and clears PxCI -- the handshake storahci waits on at init.
+// (identify payload here is a placeholder pattern; the real donor-derived
+// block is loaded from the codegen-emitted ahci_identify_init.hex.)
+module ahci_engine #(
+    parameter SECT_DW = 128,  // 512 bytes / sector
+    parameter NSECT   = 4
+)(
+    input  wire        clk,
+    input  wire        rst_n,
+    input  wire        reg_wr,
+    input  wire [11:0] reg_addr,
+    input  wire [31:0] reg_wdata,
+    input  wire [11:0] reg_raddr,
+    output reg  [31:0] reg_rdata,
+    output reg         mem_rd,
+    output reg  [31:0] mem_addr,
+    input  wire [31:0] mem_rdata,
+    input  wire        mem_rvalid,
+    output reg         mem_wr,
+    output reg  [31:0] mem_waddr,
+    output reg  [31:0] mem_wdata,
+    output reg         intr
+);
+    localparam [11:0] A_PxCLB=12'h100, A_PxFB=12'h108, A_PxIS=12'h110,
+                      A_PxIE=12'h114, A_PxCMD=12'h118, A_PxTFD=12'h120,
+                      A_PxSIG=12'h124, A_PxSSTS=12'h128, A_PxCI=12'h138;
+
+    reg [31:0] pxclb, pxfb, pxis, pxie, pxcmd, pxtfd, pxci;
+    wire [31:0] pxsig  = 32'h00000101;
+    wire [31:0] pxssts = 32'h00000113;
+
+    reg [31:0] store [0:NSECT*SECT_DW-1];
+
+    localparam S_IDLE=0,S_HDR=1,S_HDRW=2,S_F0=3,S_F0W=4,S_F1=5,S_F1W=6,
+               S_PRDT=7,S_PRDTW=8,S_WDATA=9,S_RD=10,S_RDW=11,S_FIS=12,S_DONE=13;
+    reg [3:0]  st;
+    reg [31:0] ctba, dba, cmd, lba;
+    reg [8:0]  cnt;
+    wire [13:0] sidx = lba[1:0]*SECT_DW + cnt;
+
+    always @(*) begin
+        case (reg_raddr)
+            A_PxCLB: reg_rdata=pxclb; A_PxFB: reg_rdata=pxfb;
+            A_PxIS:  reg_rdata=pxis;  A_PxIE: reg_rdata=pxie;
+            A_PxCMD: reg_rdata=pxcmd; A_PxTFD:reg_rdata=pxtfd;
+            A_PxSIG: reg_rdata=pxsig; A_PxSSTS:reg_rdata=pxssts;
+            A_PxCI:  reg_rdata=pxci;  default:reg_rdata=32'h0;
+        endcase
+    end
+
+    always @(posedge clk) begin
+        if (!rst_n) begin
+            pxclb<=0;pxfb<=0;pxis<=0;pxie<=0;pxcmd<=0;pxtfd<=32'h50;pxci<=0;
+            st<=S_IDLE;mem_rd<=0;mem_wr<=0;intr<=0;cnt<=0;
+        end else begin
+            mem_rd<=0; mem_wr<=0; intr<=0;
+            if (reg_wr) case (reg_addr)
+                A_PxCLB: pxclb<=reg_wdata;  A_PxFB: pxfb<=reg_wdata;
+                A_PxIE:  pxie<=reg_wdata;   A_PxCMD:pxcmd<=reg_wdata;
+                A_PxIS:  pxis<=pxis & ~reg_wdata;
+                A_PxCI:  pxci<=pxci | reg_wdata;
+                default: ;
+            endcase
+
+            case (st)
+                S_IDLE: if (pxci[0]&&pxcmd[0]&&pxcmd[4]) begin
+                            pxtfd<=32'h80; mem_rd<=1; mem_addr<=pxclb+32'h8; st<=S_HDR;
+                        end
+                S_HDR:  st<=S_HDRW;
+                S_HDRW: if (mem_rvalid) begin ctba<=mem_rdata; mem_rd<=1; mem_addr<=mem_rdata; st<=S_F0; end
+                S_F0:   st<=S_F0W;
+                S_F0W:  if (mem_rvalid) begin cmd<=mem_rdata; mem_rd<=1; mem_addr<=ctba+32'h4; st<=S_F1; end
+                S_F1:   st<=S_F1W;
+                S_F1W:  if (mem_rvalid) begin lba<=mem_rdata; mem_rd<=1; mem_addr<=ctba+32'h80; st<=S_PRDT; end
+                S_PRDT: st<=S_PRDTW;
+                S_PRDTW:if (mem_rvalid) begin
+                            dba<=mem_rdata; cnt<=0;
+                            st<=(cmd[23:16]==8'h35)?S_RD:S_WDATA; // 0x35 write reads host first
+                        end
+                // IDENTIFY / READ: produce data to DBA
+                S_WDATA: if (cnt<SECT_DW) begin
+                            mem_wr<=1; mem_waddr<=dba+{cnt,2'b00};
+                            mem_wdata<=(cmd[23:16]==8'hEC)?(32'hA5000000|cnt):store[sidx];
+                            cnt<=cnt+1;
+                        end else st<=S_FIS;
+                // WRITE: pull data from DBA into backing store
+                S_RD:   if (cnt<SECT_DW) begin mem_rd<=1; mem_addr<=dba+{cnt,2'b00}; st<=S_RDW; end
+                        else st<=S_FIS;
+                S_RDW:  if (mem_rvalid) begin store[sidx]<=mem_rdata; cnt<=cnt+1; st<=S_RD; end
+                S_FIS:  begin mem_wr<=1; mem_waddr<=pxfb+32'h40; mem_wdata<=32'h00500034; st<=S_DONE; end
+                S_DONE: begin
+                            pxci<=pxci & ~32'h1; pxtfd<=32'h50; pxis<=pxis|32'h1;
+                            if (pxie[0]) intr<=1; st<=S_IDLE;
+                        end
+                default: st<=S_IDLE;
+            endcase
+        end
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/ahci_engine_tb.sv b/sim/ahci_engine_tb.sv
new file mode 100644
index 0000000..506e5a2
--- /dev/null
+++ b/sim/ahci_engine_tb.sv
@@ -0,0 +1,89 @@
+`default_nettype none
+`timescale 1ns/1ps
+module ahci_engine_tb;
+    reg clk=0, rst_n=0;
+    reg        reg_wr=0;
+    reg [11:0] reg_addr=0, reg_raddr=0;
+    reg [31:0] reg_wdata=0;
+    wire [31:0] reg_rdata;
+    wire        mem_rd, mem_wr;
+    wire [31:0] mem_addr, mem_waddr, mem_wdata;
+    reg  [31:0] mem_rdata; reg mem_rvalid;
+    wire        intr;
+    integer errors=0, i;
+
+    ahci_engine dut(.clk(clk),.rst_n(rst_n),
+        .reg_wr(reg_wr),.reg_addr(reg_addr),.reg_wdata(reg_wdata),
+        .reg_raddr(reg_raddr),.reg_rdata(reg_rdata),
+        .mem_rd(mem_rd),.mem_addr(mem_addr),.mem_rdata(mem_rdata),.mem_rvalid(mem_rvalid),
+        .mem_wr(mem_wr),.mem_waddr(mem_waddr),.mem_wdata(mem_wdata),.intr(intr));
+
+    always #5 clk=~clk;
+
+    reg [31:0] hm [0:1023];
+    always @(posedge clk) begin
+        mem_rvalid <= mem_rd;
+        if (mem_rd) mem_rdata <= hm[mem_addr[11:2]];
+        if (mem_wr) hm[mem_waddr[11:2]] <= mem_wdata;
+    end
+
+    reg intr_seen=0;
+    always @(posedge clk) if (intr) intr_seen<=1;
+
+    task wr(input [11:0] a, input [31:0] d);
+        begin @(posedge clk); reg_wr<=1; reg_addr<=a; reg_wdata<=d;
+              @(posedge clk); reg_wr<=0; end
+    endtask
+    task chk(input [255:0] n, input [31:0] g, input [31:0] e);
+        begin if (g!==e) begin $display("FAIL %0s: got %08x exp %08x",n,g,e); errors=errors+1; end
+              else $display("ok   %0s = %08x",n,g); end
+    endtask
+    // issue one command via slot 0, wait for PxCI to clear
+    task issue(input [7:0] cmd, input [31:0] lba, input [31:0] dba);
+        begin
+            hm['h08>>2]  = 32'h00000200;                 // cmd header dw2 = CTBA
+            hm['h200>>2] = {8'h00, cmd, 16'h0027};       // H2D FIS dword0
+            hm['h204>>2] = lba;                          // FIS dword1 (LBA)
+            hm['h280>>2] = dba;                          // PRDT[0] DBA
+            intr_seen=0;
+            wr(12'h138, 32'h1);                          // PxCI bit0
+            reg_raddr<=12'h138; @(posedge clk);
+            i=0; while (reg_rdata!==0 && i<500) begin @(posedge clk); i=i+1; end
+        end
+    endtask
+
+    initial begin
+        for (i=0;i<1024;i=i+1) hm[i]=0;
+        @(posedge clk); rst_n<=1;
+        wr(12'h100,32'h0);      // PxCLB
+        wr(12'h108,32'h600);    // PxFB
+        wr(12'h114,32'h1);      // PxIE
+        wr(12'h118,32'h11);     // PxCMD ST+FRE
+
+        // 1) IDENTIFY -> data at DBA 0x400
+        issue(8'hEC, 0, 32'h400);
+        reg_raddr<=12'h138; @(posedge clk); chk("identify: PxCI clear", reg_rdata, 0);
+        chk("identify data[0]",   hm['h400>>2],        32'hA5000000);
+        chk("identify data[127]", hm[('h400>>2)+127],  32'hA500007F);
+        chk("identify intr",      {31'h0,intr_seen},   32'h1);
+
+        // 2) WRITE sector 1 from host buffer 0x800
+        for (i=0;i<128;i=i+1) hm[('h800>>2)+i] = 32'hBEEF0000 | i;
+        issue(8'h35, 1, 32'h800);
+        reg_raddr<=12'h138; @(posedge clk); chk("write: PxCI clear", reg_rdata, 0);
+
+        // 3) READ sector 1 back to 0xA00 -> must equal what we wrote
+        for (i=0;i<128;i=i+1) hm[('hA00>>2)+i] = 32'h0;
+        issue(8'h25, 1, 32'hA00);
+        reg_raddr<=12'h138; @(posedge clk); chk("read: PxCI clear", reg_rdata, 0);
+        chk("read-back[0]",   hm['hA00>>2],        32'hBEEF0000);
+        chk("read-back[63]",  hm[('hA00>>2)+63],   32'hBEEF003F);
+        chk("read-back[127]", hm[('hA00>>2)+127],  32'hBEEF007F);
+        chk("D2H FIS",        hm['h640>>2],        32'h00500034);
+
+        if (errors==0) $display("ALL TESTS PASSED");
+        else $display("%0d FAILURES", errors);
+        $finish;
+    end
+endmodule
+`default_nettype wire

From 995905e0d7fd463754331314ce19817e0486eab3 Mon Sep 17 00:00:00 2001
From: VoidChecksum <89574102+VoidChecksum@users.noreply.github.com>
Date: Tue, 30 Jun 2026 14:57:06 +0200
Subject: [PATCH 30/31] ahci: generate donor ATA IDENTIFY block for SATA clones

New internal/firmware/ahci builds the 256-word ATA IDENTIFY DEVICE block (model,
serial, LBA48 sector count, feature words, integrity checksum) and renders it as
128-dword hex for the AHCI engine's identify ROM. writer emits
ahci_identify_init.hex for SATA-class donors so the cloned disk returns a valid
IDENTIFY instead of a placeholder. Tested: string round-trip, LBA48 count,
checksum zero, 128-line hex.
---
 internal/firmware/ahci/identify.go      | 86 +++++++++++++++++++++++++
 internal/firmware/ahci/identify_test.go | 64 ++++++++++++++++++
 internal/firmware/output/writer.go      | 11 ++++
 3 files changed, 161 insertions(+)
 create mode 100644 internal/firmware/ahci/identify.go
 create mode 100644 internal/firmware/ahci/identify_test.go

diff --git a/internal/firmware/ahci/identify.go b/internal/firmware/ahci/identify.go
new file mode 100644
index 0000000..15d5880
--- /dev/null
+++ b/internal/firmware/ahci/identify.go
@@ -0,0 +1,86 @@
+// Package ahci builds the ATA IDENTIFY DEVICE data an AHCI/SATA clone returns
+// to storahci. A real block (model, serial, LBA count, feature words) is what
+// lets the disk enumerate instead of failing init.
+package ahci
+
+import (
+	"fmt"
+	"strings"
+)
+
+// BuildIdentify returns the 256-word ATA IDENTIFY DEVICE block for a SATA disk
+// of the given size in 512-byte sectors. Strings are byte-swapped per the ATA
+// word convention.
+func BuildIdentify(model, serial, fwRev string, sectors uint64) [256]uint16 {
+	var w [256]uint16
+
+	w[0] = 0x0040 // ATA device, non-removable
+	putATAString(&w, 10, 10, serial)
+	putATAString(&w, 23, 4, fwRev)
+	putATAString(&w, 27, 20, model)
+	w[47] = 0x8000 | 0x10 // max sectors per READ/WRITE MULTIPLE
+	w[49] = 0x0300        // LBA + DMA supported
+	w[50] = 0x4000
+	w[53] = 0x0006 // words 70:64 and 88 valid
+
+	// 28-bit total sectors (capped); 48-bit in words 100-103.
+	lba28 := sectors
+	if lba28 > 0x0FFFFFFF {
+		lba28 = 0x0FFFFFFF
+	}
+	w[60] = uint16(lba28)
+	w[61] = uint16(lba28 >> 16)
+
+	w[64] = 0x0003 // PIO modes 3,4
+	w[80] = 0x01F0 // ATA-4..8
+	w[81] = 0x0000
+	w[82] = 0x0000
+	w[83] = 0x4400 // LBA48 + flush-ext supported
+	w[84] = 0x4000
+	w[85] = 0x0000
+	w[86] = 0x4400 // LBA48 + flush-ext enabled
+	w[87] = 0x4000
+	w[88] = 0x203F // UDMA modes 0-5, mode 5 selected
+
+	w[100] = uint16(sectors)
+	w[101] = uint16(sectors >> 16)
+	w[102] = uint16(sectors >> 32)
+	w[103] = uint16(sectors >> 48)
+
+	w[106] = 0x4000
+	w[217] = 0x0001 // non-rotating (SSD)
+
+	// Integrity word: signature 0xA5 in low byte, checksum in high byte so the
+	// two's-complement sum of all 512 bytes is zero.
+	w[255] = 0x00A5
+	var sum uint8
+	for i := 0; i < 255; i++ {
+		sum += uint8(w[i]) + uint8(w[i]>>8)
+	}
+	sum += 0xA5
+	w[255] |= uint16(uint8(-int8(sum))) << 8
+
+	return w
+}
+
+// IdentifyHex renders the block as 128 little-endian 32-bit words, one hex
+// dword per line, for $readmemh into the AHCI engine's identify ROM.
+func IdentifyHex(w [256]uint16) string {
+	var b strings.Builder
+	for i := 0; i < 256; i += 2 {
+		dw := uint32(w[i]) | uint32(w[i+1])<<16
+		fmt.Fprintf(&b, "%08x\n", dw)
+	}
+	return b.String()
+}
+
+func putATAString(w *[256]uint16, start, words int, s string) {
+	buf := make([]byte, words*2)
+	for i := range buf {
+		buf[i] = ' '
+	}
+	copy(buf, []byte(s))
+	for i := 0; i < words; i++ {
+		w[start+i] = uint16(buf[2*i])<<8 | uint16(buf[2*i+1])
+	}
+}
diff --git a/internal/firmware/ahci/identify_test.go b/internal/firmware/ahci/identify_test.go
new file mode 100644
index 0000000..e23f556
--- /dev/null
+++ b/internal/firmware/ahci/identify_test.go
@@ -0,0 +1,64 @@
+package ahci
+
+import (
+	"strings"
+	"testing"
+)
+
+func ataString(w [256]uint16, start, words int) string {
+	var b []byte
+	for i := 0; i < words; i++ {
+		b = append(b, byte(w[start+i]>>8), byte(w[start+i]))
+	}
+	return strings.TrimRight(string(b), " ")
+}
+
+func TestBuildIdentify(t *testing.T) {
+	const sectors = uint64(0x1_0000_0000) // 4G sectors -> 48-bit range
+	w := BuildIdentify("PCILeech SATA SSD", "SN0001", "1.0", sectors)
+
+	if w[0] != 0x0040 {
+		t.Errorf("word0 = %04x, want 0040", w[0])
+	}
+	if w[49]&0x0300 != 0x0300 {
+		t.Errorf("word49 LBA+DMA not set: %04x", w[49])
+	}
+	if w[83]&0x0400 == 0 {
+		t.Errorf("word83 LBA48 not advertised: %04x", w[83])
+	}
+	if got := ataString(w, 27, 20); got != "PCILeech SATA SSD" {
+		t.Errorf("model = %q", got)
+	}
+	if got := ataString(w, 10, 10); got != "SN0001" {
+		t.Errorf("serial = %q", got)
+	}
+	got := uint64(w[100]) | uint64(w[101])<<16 | uint64(w[102])<<32 | uint64(w[103])<<48
+	if got != sectors {
+		t.Errorf("LBA48 sectors = %x, want %x", got, sectors)
+	}
+
+	// integrity: signature 0xA5 + checksum so the byte sum is 0 mod 256
+	if byte(w[255]) != 0xA5 {
+		t.Errorf("integrity signature = %02x, want a5", byte(w[255]))
+	}
+	var sum uint8
+	for i := 0; i < 256; i++ {
+		sum += uint8(w[i]) + uint8(w[i]>>8)
+	}
+	if sum != 0 {
+		t.Errorf("checksum byte-sum = %d, want 0", sum)
+	}
+}
+
+func TestIdentifyHex(t *testing.T) {
+	w := BuildIdentify("M", "S", "F", 2048)
+	hex := IdentifyHex(w)
+	lines := strings.Split(strings.TrimRight(hex, "\n"), "\n")
+	if len(lines) != 128 {
+		t.Fatalf("want 128 dword lines, got %d", len(lines))
+	}
+	// dword0 = word1<<16 | word0 ; word0 = 0x0040
+	if !strings.HasSuffix(lines[0], "0040") {
+		t.Errorf("dword0 = %q, want low word 0040", lines[0])
+	}
+}
diff --git a/internal/firmware/output/writer.go b/internal/firmware/output/writer.go
index 28fcf3f..30734a5 100644
--- a/internal/firmware/output/writer.go
+++ b/internal/firmware/output/writer.go
@@ -15,6 +15,7 @@ import (
 	"github.com/sercanarga/pcileechgen/internal/firmware/barmodel"
 	"github.com/sercanarga/pcileechgen/internal/firmware/codegen"
 	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
+	"github.com/sercanarga/pcileechgen/internal/firmware/ahci"
 	"github.com/sercanarga/pcileechgen/internal/firmware/nvme"
 	"github.com/sercanarga/pcileechgen/internal/firmware/overlay"
 	"github.com/sercanarga/pcileechgen/internal/firmware/scrub"
@@ -627,6 +628,16 @@ func (ow *OutputWriter) writeConditionalArtifacts(cfg *svgen.SVGeneratorConfig,
 		}
 	}
 
+	if cfg.DeviceClass == devclass.ClassSATA {
+		model := "PCILeech SATA Disk"
+		serial := fmt.Sprintf("PL%012X", cfg.DeviceIDs.DSN&0xFFFFFFFFFFFF)
+		const sataSectors = uint64(0x1D1C0000) // ~250 GB at 512 B/sector
+		idw := ahci.BuildIdentify(model, serial, "1.0", sataSectors)
+		if err := ow.writeFile("ahci_identify_init.hex", ahci.IdentifyHex(idw)); err != nil {
+			return err
+		}
+	}
+
 	if cfg.DeviceClass == devclass.ClassAudio && cfg.BARModel != nil {
 		hdaSV, err := svgen.GenerateHDARIRBDMASV(cfg)
 		if err != nil {

From 4227df032ded80d4778e122a7707c9615750ecbc Mon Sep 17 00:00:00 2001
From: VoidChecksum <89574102+VoidChecksum@users.noreply.github.com>
Date: Wed, 1 Jul 2026 13:01:45 +0200
Subject: [PATCH 31/31] Close 13 emulation gaps: NVMe backing store, xHCI ring
 engine, multi-BAR, vendor dispatch fixes, SATA/quirks/fallback/Thunderbolt

- NVMe: real BRAM sector-store backing IO read/write (was zero-read/discard-write)
- xHCI: command/event ring engine surviving driver init handshake (was register-only facade); fixes DBOFF/RTSOFF canonicalization and TLP backpressure along the way
- BAR3-6 unblocked for donors needing more than 2 extra apertures (GPUs, HBAs)
- strategy.go: xHCI dispatch now gated on progIF==0x30 (was misrouting UHCI/OHCI/EHCI); GPU and Ethernet get real vendor-specific dispatch instead of one-size-fits-all NVIDIA/Realtek profiles; 0x0280 catch-all no longer force-fits WWAN/modem silicon into a WiFi profile
- New SD Host Controller (SDHCI) profile for class 0x0805
- SATA: BRAM-size-aware port clamping (PI/Px* no longer overclaim ports the board can't back)
- Vendor quirks: ASMedia/VIA xHCI entries alongside the existing Renesas one
- fallback package wired into the real build pipeline (was fully built, tested, and never called), now respects PreferredBAR
- DeviceContext now captures multi-function sibling relationships (donor/collector.go)
---
 cmd/pcileechgen/build.go                      |  58 +-
 cmd/pcileechgen/fallback_defaults.yaml        |  78 +++
 internal/donor/collector.go                   |  32 ++
 internal/donor/context.go                     |  78 ++-
 internal/donor/synthetic/builder.go           |   1 +
 internal/firmware/barmodel/model.go           |  29 +-
 internal/firmware/codegen/codegen.go          |  17 +-
 internal/firmware/codegen/codegen_test.go     |  40 ++
 internal/firmware/devclass/ethernet.go        |  45 ++
 internal/firmware/devclass/gpu.go             | 130 ++++-
 internal/firmware/devclass/sdhci.go           | 115 ++++
 internal/firmware/devclass/strategy.go        |  55 +-
 internal/firmware/devclass/thunderbolt.go     |   5 +-
 internal/firmware/devclass/xhci.go            |  31 +-
 internal/firmware/fallback/fallback.go        |  17 +-
 internal/firmware/fallback/fallback_test.go   |  31 +
 internal/firmware/output/coverage_test.go     |  29 +
 internal/firmware/output/writer.go            |  54 +-
 internal/firmware/output/writer_test.go       |  17 +
 internal/firmware/scrub/bar.go                | 179 +++---
 internal/firmware/scrub/bar_test.go           |  30 +-
 internal/firmware/scrub/quirks.go             |  15 +
 internal/firmware/svgen/generator.go          |  13 +
 .../firmware/svgen/nvme_responder_test.go     |   4 +-
 internal/firmware/svgen/svgen_test.go         |  44 ++
 .../svgen/templates/bar_controller.sv.tmpl    | 187 +++++-
 .../svgen/templates/bar_impl_device.sv.tmpl   |  30 +
 .../templates/nvme_admin_responder.sv.tmpl    |  64 ++-
 .../svgen/templates/xhci_ring_engine.sv.tmpl  | 539 ++++++++++++++++++
 sim/README.md                                 |   1 +
 sim/xhci_ring_engine.sv                       | 241 ++++++++
 sim/xhci_ring_engine_tb.sv                    | 130 +++++
 32 files changed, 2144 insertions(+), 195 deletions(-)
 create mode 100644 cmd/pcileechgen/fallback_defaults.yaml
 create mode 100644 internal/firmware/devclass/sdhci.go
 create mode 100644 internal/firmware/svgen/templates/xhci_ring_engine.sv.tmpl
 create mode 100644 sim/xhci_ring_engine.sv
 create mode 100644 sim/xhci_ring_engine_tb.sv

diff --git a/cmd/pcileechgen/build.go b/cmd/pcileechgen/build.go
index 5043305..7a0e5c7 100644
--- a/cmd/pcileechgen/build.go
+++ b/cmd/pcileechgen/build.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	_ "embed"
 	"fmt"
 	"log/slog"
 
@@ -8,28 +9,48 @@ import (
 	"github.com/sercanarga/pcileechgen/internal/donor"
 	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
 	"github.com/sercanarga/pcileechgen/internal/firmware"
+	"github.com/sercanarga/pcileechgen/internal/firmware/fallback"
+	"github.com/sercanarga/pcileechgen/internal/firmware/output"
 	"github.com/sercanarga/pcileechgen/internal/pci"
 	"github.com/sercanarga/pcileechgen/internal/vivado"
 	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v3"
 )
 
+//go:embed fallback_defaults.yaml
+var fallbackDefaultsYAML []byte
+
+// loadFallbackConfig loads --fallback-config if given, otherwise falls back
+// to the built-in embedded defaults (fallback recovery is on by default).
+func loadFallbackConfig(path string) (*fallback.Config, error) {
+	if path != "" {
+		return fallback.LoadConfig(path)
+	}
+	var cfg fallback.Config
+	if err := yaml.Unmarshal(fallbackDefaultsYAML, &cfg); err != nil {
+		return nil, fmt.Errorf("failed to parse embedded fallback defaults: %w", err)
+	}
+	return &cfg, nil
+}
+
 // buildFlags groups all build command flags.
 type buildFlags struct {
-	bdf        string
-	board      string
-	vivadoPath string
-	output     string
-	skipVivado bool
-	jobs       int
-	timeout    int
-	libDir     string
-	fromJSON   string
-	stockBar   bool
-	force      bool
-	mmioTrace  string
-	ila        bool
-	ilaDepth   int
-	probeBars  bool
+	bdf            string
+	board          string
+	vivadoPath     string
+	output         string
+	skipVivado     bool
+	jobs           int
+	timeout        int
+	libDir         string
+	fromJSON       string
+	stockBar       bool
+	force          bool
+	mmioTrace      string
+	ila            bool
+	ilaDepth       int
+	probeBars      bool
+	fallbackConfig string
 }
 
 var buildOpts buildFlags
@@ -112,6 +133,12 @@ func runBuild(cmd *cobra.Command, args []string) error {
 		slog.Info("ILA debug core enabled", "depth", depth, "probes", len(firmware.ILAProbes()))
 	}
 
+	fbCfg, err := loadFallbackConfig(buildOpts.fallbackConfig)
+	if err != nil {
+		return fmt.Errorf("load fallback config: %w", err)
+	}
+	output.DefaultFallbackConfig = fbCfg
+
 	return vivado.NewBuilder(b, bopts).Build(ctx)
 }
 
@@ -207,6 +234,7 @@ func init() {
 	buildCmd.Flags().BoolVar(&buildOpts.ila, "ila", false, "insert a Vivado ILA debug core probing BAR/TLP/interrupt signals")
 	buildCmd.Flags().IntVar(&buildOpts.ilaDepth, "ila-depth", firmware.DefaultILADepth, "ILA capture depth in samples (with --ila)")
 	buildCmd.Flags().BoolVar(&buildOpts.probeBars, "probe-bars", true, "write-probe BAR registers to map RW/W1C bits (always skipped for network cards; set false if a donor hangs on BAR)")
+	buildCmd.Flags().StringVar(&buildOpts.fallbackConfig, "fallback-config", "", "path to a custom fallback defaults YAML (fills zeroed BAR registers by device class); empty uses the built-in embedded defaults")
 
 	_ = buildCmd.MarkFlagRequired("board")
 
diff --git a/cmd/pcileechgen/fallback_defaults.yaml b/cmd/pcileechgen/fallback_defaults.yaml
new file mode 100644
index 0000000..839fb69
--- /dev/null
+++ b/cmd/pcileechgen/fallback_defaults.yaml
@@ -0,0 +1,78 @@
+# fallback_defaults.yaml - built-in class-specific BAR register fallbacks.
+#
+# Consumed by internal/firmware/fallback.Apply, which only fills BAR
+# registers that are currently zero (real donor data is never overwritten).
+# Keys under device_classes are fallback.ClassKey(baseClass, subClass), e.g.
+# "0108" for NVMe (base 01 mass storage, sub 08 NVMe).
+#
+# bar0_defaults values are copied verbatim from the .Reset field of the
+# matching internal/firmware/devclass profile's BARDefaults (the same
+# per-class register defaults the scrub strategies already trust), keyed by
+# the register .Offset. Registers whose profile .Reset is 0x00000000 are
+# omitted: Apply() never writes a zero default over a zeroed register anyway.
+device_classes:
+  "0108": # NVMe (devclass/nvme.go: nvmeProfile)
+    description: "NVMe controller"
+    bar0_defaults:
+      "0x00000000": 0x0040FF17 # CAP_LO
+      "0x00000004": 0x00000020 # CAP_HI
+      "0x00000008": 0x00010400 # VS
+      "0x00000014": 0x00460001 # CC
+      "0x0000001C": 0x00000001 # CSTS
+      "0x00000024": 0x001F001F # AQA
+
+  "0C03": # xHCI USB (devclass/xhci.go: xhciProfile)
+    description: "xHCI USB controller"
+    bar0_defaults:
+      "0x00000000": 0x01100020 # CAPLENGTH_HCIVER
+      "0x00000004": 0x02000120 # HCSPARAMS1
+      "0x00000010": 0x00000001 # HCCPARAMS1
+      "0x00000014": 0x00000100 # DBOFF
+      "0x00000018": 0x00000200 # RTSOFF
+      "0x00000020": 0x00000001 # USBCMD
+      "0x00000028": 0x00000001 # PAGESIZE
+      "0x00000420": 0x000002A0 # PORTSC1
+      "0x00000430": 0x000002A0 # PORTSC2
+
+  "0200": # Ethernet (devclass/ethernet.go: ethernetProfile)
+    description: "Ethernet controller"
+    bar0_defaults:
+      "0x00000000": 0xBEADDE02 # MAC0_3
+      "0x00000004": 0x000000EF # MAC4_5
+      "0x00000034": 0x0C000000 # CHIPCMD_DW
+      "0x00000040": 0x2F000000 # TXCONFIG
+      "0x00000044": 0x00000E00 # RXCONFIG
+      "0x00000050": 0x00003FFF # RXMAXSIZE
+      "0x00000058": 0x00002060 # CPLUSCMD
+      "0x0000006C": 0x00003010 # PHYSTATUS
+      "0x000000DC": 0x80000000 # PHYAR
+      "0x000000E0": 0x80000000 # ERIAR
+
+  "0300": # GPU (devclass/gpu.go: gpuProfile)
+    description: "GPU"
+    bar0_defaults:
+      "0x00000200": 0xFFFFFFFF # PMC_ENABLE
+      "0x00001804": 0x00100006 # PBUS_PCI_NV_1
+
+  "0106": # SATA AHCI (devclass/sata.go: sataProfile)
+    description: "SATA AHCI controller"
+    bar0_defaults:
+      "0x00000000": 0x40341F05 # CAP
+      "0x00000004": 0x80000000 # GHC
+      "0x0000000C": 0x00000001 # PI
+      "0x00000010": 0x00010301 # VS
+      "0x00000024": 0x00000004 # CAP2
+      "0x00000124": 0x00000101 # PxSIG (port 0)
+      "0x00000128": 0x00000113 # PxSSTS (port 0)
+
+  "0280": # Wi-Fi (devclass/wifi.go: wifiProfile)
+    description: "Wi-Fi controller"
+    bar0_defaults:
+      "0x00000024": 0x00000080 # GP_CTL
+      "0x00000054": 0x00000001 # UCODE_DRV_GP1
+
+  "0C80": # Thunderbolt (devclass/thunderbolt.go: thunderboltProfile)
+    description: "Thunderbolt controller"
+    bar0_defaults:
+      "0x00000008": 0x00000001 # LC_STS
+      "0x00000014": 0x00000001 # THUNDERBOLT_CAP
diff --git a/internal/donor/collector.go b/internal/donor/collector.go
index ab85f25..a45cb5f 100644
--- a/internal/donor/collector.go
+++ b/internal/donor/collector.go
@@ -64,6 +64,11 @@ func (c *Collector) Collect(bdf pci.BDF) (*DeviceContext, error) {
 	}
 	ctx.ConfigSpace = cs
 
+	if cs.IsMultiFunction() {
+		ctx.IsMultiFunction = true
+		ctx.SiblingFunctions = c.collectSiblingFunctions(bdf)
+	}
+
 	bars, err := c.sysfs.ReadResourceFile(bdf)
 	if err != nil {
 		bars = pci.ParseBARsFromConfigSpace(cs)
@@ -346,6 +351,33 @@ func (c *Collector) collectConfigSpace(bdf pci.BDF) (*pci.ConfigSpace, error) {
 	return cs, nil
 }
 
+// collectSiblingFunctions enumerates other PCI functions at the same
+// bus:slot as bdf (function 0-7, excluding bdf itself). Real TB3/TB4
+// controllers commonly split bridge/NHI across sibling functions, and this
+// captures just their identity - no BAR/capability collection is repeated
+// for them. Siblings that don't exist or aren't accessible (permission
+// denied, e.g. not bound to vfio-pci) are skipped rather than failing.
+func (c *Collector) collectSiblingFunctions(bdf pci.BDF) []SiblingFunction {
+	var siblings []SiblingFunction
+	for fn := 0; fn < 8; fn++ {
+		if uint8(fn) == bdf.Function {
+			continue
+		}
+		sibBDF := pci.BDF{Domain: bdf.Domain, Bus: bdf.Bus, Device: bdf.Device, Function: uint8(fn)}
+		dev, err := c.sysfs.ReadDeviceInfo(sibBDF)
+		if err != nil {
+			continue
+		}
+		siblings = append(siblings, SiblingFunction{
+			Function:  uint8(fn),
+			VendorID:  dev.VendorID,
+			DeviceID:  dev.DeviceID,
+			ClassCode: dev.ClassCode,
+		})
+	}
+	return siblings
+}
+
 func (c *Collector) collectBARMemory(bdf pci.BDF, bars []pci.BAR) map[int][]byte {
 	eligible := eligibleBARs(bars)
 	if len(eligible) == 0 {
diff --git a/internal/donor/context.go b/internal/donor/context.go
index 88c0e5c..8202307 100644
--- a/internal/donor/context.go
+++ b/internal/donor/context.go
@@ -22,48 +22,68 @@ type MSIXData struct {
 	Entries     []pci.MSIXEntry `json:"entries"`
 }
 
+// SiblingFunction captures the identity of another PCI function found at the
+// same bus:slot as the primary donor device (e.g. a TB3/TB4 controller's
+// bridge and NHI functions). Metadata only - siblings never get BAR or
+// capability collection, just enough to know they exist.
+//
+// ponytail: not firmware.DeviceIDs - internal/firmware already imports
+// internal/donor (see helpers.go), so importing it back here would cycle.
+type SiblingFunction struct {
+	Function  uint8  `json:"function"`
+	VendorID  uint16 `json:"vendor_id"`
+	DeviceID  uint16 `json:"device_id"`
+	ClassCode uint32 `json:"class_code"`
+}
+
 // DeviceContext is the full snapshot of a donor device.
 type DeviceContext struct {
 	CollectedAt time.Time `json:"collected_at"`
 	ToolVersion string    `json:"tool_version"`
 	Hostname    string    `json:"hostname"`
 
-	Device          pci.PCIDevice       `json:"device"`
-	ConfigSpace     *pci.ConfigSpace    `json:"config_space"`
-	BARs            []pci.BAR           `json:"bars"`
-	BARContents     map[int][]byte      `json:"-"` // BAR memory contents, keyed by BAR index
-	BARProfiles     map[int]*BARProfile `json:"-"` // probing results, keyed by BAR index
-	Capabilities    []pci.Capability    `json:"capabilities"`
-	ExtCapabilities []pci.ExtCapability `json:"ext_capabilities,omitempty"`
-	MSIXData        *MSIXData           `json:"msix_data,omitempty"`
+	Device           pci.PCIDevice       `json:"device"`
+	ConfigSpace      *pci.ConfigSpace    `json:"config_space"`
+	BARs             []pci.BAR           `json:"bars"`
+	BARContents      map[int][]byte      `json:"-"` // BAR memory contents, keyed by BAR index
+	BARProfiles      map[int]*BARProfile `json:"-"` // probing results, keyed by BAR index
+	Capabilities     []pci.Capability    `json:"capabilities"`
+	ExtCapabilities  []pci.ExtCapability `json:"ext_capabilities,omitempty"`
+	MSIXData         *MSIXData           `json:"msix_data,omitempty"`
+	IsMultiFunction  bool                `json:"is_multi_function,omitempty"`
+	SiblingFunctions []SiblingFunction   `json:"sibling_functions,omitempty"`
 }
 
 // JSON wire format - config space as hex words, BARs as base64.
 type deviceContextJSON struct {
-	CollectedAt     time.Time              `json:"collected_at"`
-	ToolVersion     string                 `json:"tool_version"`
-	Hostname        string                 `json:"hostname"`
-	Device          pci.PCIDevice          `json:"device"`
-	ConfigSpaceHex  []string               `json:"config_space_hex"`
-	ConfigSpaceSize int                    `json:"config_space_size"`
-	BARs            []pci.BAR              `json:"bars"`
-	BARContents     map[string]string      `json:"bar_contents,omitempty"` // key: BAR index, value: base64
-	BARProfiles     map[string]*BARProfile `json:"bar_profiles,omitempty"`
-	Capabilities    []pci.Capability       `json:"capabilities"`
-	ExtCapabilities []pci.ExtCapability    `json:"ext_capabilities,omitempty"`
-	MSIXData        *MSIXData              `json:"msix_data,omitempty"`
+	CollectedAt      time.Time              `json:"collected_at"`
+	ToolVersion      string                 `json:"tool_version"`
+	Hostname         string                 `json:"hostname"`
+	Device           pci.PCIDevice          `json:"device"`
+	ConfigSpaceHex   []string               `json:"config_space_hex"`
+	ConfigSpaceSize  int                    `json:"config_space_size"`
+	BARs             []pci.BAR              `json:"bars"`
+	BARContents      map[string]string      `json:"bar_contents,omitempty"` // key: BAR index, value: base64
+	BARProfiles      map[string]*BARProfile `json:"bar_profiles,omitempty"`
+	Capabilities     []pci.Capability       `json:"capabilities"`
+	ExtCapabilities  []pci.ExtCapability    `json:"ext_capabilities,omitempty"`
+	MSIXData         *MSIXData              `json:"msix_data,omitempty"`
+	IsMultiFunction  bool                   `json:"is_multi_function,omitempty"`
+	SiblingFunctions []SiblingFunction      `json:"sibling_functions,omitempty"`
 }
 
 func (dc *DeviceContext) MarshalJSON() ([]byte, error) {
 	j := deviceContextJSON{
-		CollectedAt:     dc.CollectedAt,
-		ToolVersion:     dc.ToolVersion,
-		Hostname:        dc.Hostname,
-		Device:          dc.Device,
-		BARs:            dc.BARs,
-		Capabilities:    dc.Capabilities,
-		ExtCapabilities: dc.ExtCapabilities,
-		MSIXData:        dc.MSIXData,
+		CollectedAt:      dc.CollectedAt,
+		ToolVersion:      dc.ToolVersion,
+		Hostname:         dc.Hostname,
+		Device:           dc.Device,
+		BARs:             dc.BARs,
+		Capabilities:     dc.Capabilities,
+		ExtCapabilities:  dc.ExtCapabilities,
+		MSIXData:         dc.MSIXData,
+		IsMultiFunction:  dc.IsMultiFunction,
+		SiblingFunctions: dc.SiblingFunctions,
 	}
 
 	if dc.ConfigSpace != nil {
@@ -111,6 +131,8 @@ func (dc *DeviceContext) UnmarshalJSON(data []byte) error {
 	dc.Capabilities = j.Capabilities
 	dc.ExtCapabilities = j.ExtCapabilities
 	dc.MSIXData = j.MSIXData
+	dc.IsMultiFunction = j.IsMultiFunction
+	dc.SiblingFunctions = j.SiblingFunctions
 
 	// Reconstruct config space from hex words
 	if len(j.ConfigSpaceHex) > 0 {
diff --git a/internal/donor/synthetic/builder.go b/internal/donor/synthetic/builder.go
index 241b014..1363790 100644
--- a/internal/donor/synthetic/builder.go
+++ b/internal/donor/synthetic/builder.go
@@ -27,6 +27,7 @@ var profiles = map[string]classProfile{
 	devclass.ClassSATA:        {0x8086, 0x9d03, 0x010601, 0x00, 0x2000},
 	devclass.ClassWiFi:        {0x8086, 0x24fd, 0x028000, 0x00, 0x2000},
 	devclass.ClassThunderbolt: {0x8086, 0x15d9, 0x080700, 0x00, 0x4000},
+	devclass.ClassSDHCI:       {0x10ec, 0x5229, 0x080501, 0x00, 0x1000},
 	devclass.ClassGeneric:     {0x1234, 0x5678, 0x000000, 0x00, 0x1000},
 }
 
diff --git a/internal/firmware/barmodel/model.go b/internal/firmware/barmodel/model.go
index 6eedc83..391ac7a 100644
--- a/internal/firmware/barmodel/model.go
+++ b/internal/firmware/barmodel/model.go
@@ -207,14 +207,39 @@ func buildXHCIBARModel(barData []byte) *BARModel {
 		{Offset: 0x28, Width: 4, Name: "PAGESIZE", RWMask: 0x00000000},
 		// Device Notification Control
 		{Offset: 0x34, Width: 4, Name: "DNCTRL", RWMask: 0x0000FFFF},
-		// Command Ring Control - 64-bit
-		{Offset: 0x38, Width: 4, Name: "CRCR_LO", RWMask: 0xFFFFFFF7},
+		// Command Ring Control - 64-bit. bits[2:0] = RCS/CS/CA (RW), bit3 = CRR
+		// (RO - not modeled by the ring engine, see xhci_ring_engine.sv.tmpl),
+		// bits[5:4] reserved, bits[31:6] = 64-byte-aligned pointer (RW).
+		{Offset: 0x38, Width: 4, Name: "CRCR_LO", RWMask: 0xFFFFFFC7},
 		{Offset: 0x3C, Width: 4, Name: "CRCR_HI", RWMask: 0xFFFFFFFF},
 		// Device Context Base Address Array Pointer - 64-bit
 		{Offset: 0x50, Width: 4, Name: "DCBAAP_LO", RWMask: 0xFFFFFFC0},
 		{Offset: 0x54, Width: 4, Name: "DCBAAP_HI", RWMask: 0xFFFFFFFF},
 		// Configure (CONFIG)
 		{Offset: 0x58, Width: 4, Name: "CONFIG", RWMask: 0x000000FF},
+
+		// Primary interrupter (Runtime Register Space, RTSOFF fixed at 0x200
+		// per xhci.go's ScrubBAR/PostInitRegisters -- IR0 registers live at
+		// RTSOFF+0x20). Consumed by xhci_ring_engine.sv.tmpl (Command
+		// Completion Event delivery) and bar_impl_device.sv.tmpl.
+		// IMAN: bit0=IP (RW1C, HW-set by the ring engine on event post),
+		// bit1=IE (plain RW). IsFSMDriven because IP is hardware-settable,
+		// not just software-clearable, so it needs the same hand-rolled
+		// write path as USBCMD/USBSTS above.
+		{Offset: 0x220, Width: 4, Name: "IMAN", RWMask: 0x00000002, W1CMask: 0x00000001, IsFSMDriven: true},
+		// IMOD: interrupt moderation - accepted, not enforced (no rate limiting emulated).
+		{Offset: 0x224, Width: 4, Name: "IMOD", RWMask: 0xFFFFFFFF},
+		// ERSTSZ: number of segments in the Event Ring Segment Table.
+		{Offset: 0x228, Width: 4, Name: "ERSTSZ", RWMask: 0x0000FFFF},
+		// ERSTBA - 64-bit, 16-byte aligned pointer to the (single-segment) ERST.
+		{Offset: 0x230, Width: 4, Name: "ERSTBA_LO", RWMask: 0xFFFFFFF0},
+		{Offset: 0x234, Width: 4, Name: "ERSTBA_HI", RWMask: 0xFFFFFFFF},
+		// ERDP - 64-bit. bit0 = EHB (Event Handler Busy); left as plain RW
+		// (ponytail: the ring engine never throttles on EHB -- a handful of
+		// init-time commands never overrun a driver that hasn't drained
+		// events yet, so there's no real backpressure to model here).
+		{Offset: 0x238, Width: 4, Name: "ERDP_LO", RWMask: 0xFFFFFFF7},
+		{Offset: 0x23C, Width: 4, Name: "ERDP_HI", RWMask: 0xFFFFFFFF},
 	}
 
 	populateResetValues(regs, barData)
diff --git a/internal/firmware/codegen/codegen.go b/internal/firmware/codegen/codegen.go
index 2a5b21e..2ea9beb 100644
--- a/internal/firmware/codegen/codegen.go
+++ b/internal/firmware/codegen/codegen.go
@@ -96,7 +96,22 @@ func GenerateWritemaskCOE(cs *pci.ConfigSpace) string {
 
 	masks[10] = 0x00000000 // 0x28: CardBus CIS (read-only)
 	masks[11] = 0x00000000 // 0x2C: SubsysVID:SubsysDID (read-only identity)
-	masks[12] = 0x00000000 // 0x30: Expansion ROM (not implemented on FPGA)
+
+	// 0x30: Expansion ROM Base Address. Layout is bit0=Enable, bits[10:1]
+	// reserved, bits[31:11]=address/size field. Mirror the BAR loop above:
+	// if the donor's own ROM BAR is enabled with a real address, preserve
+	// its writable bits (Enable + address bits, using the donor's own
+	// alignment as the size mask) so a BAR-sizing probe reads back the same
+	// size-encoding the donor reports. Most donors report 0 here (BIOS
+	// already claims/hides the option ROM at OS-probe time), in which case
+	// masks[12] stays 0 exactly as before - that already matches reality.
+	romVal := cs.ReadU32(0x30)
+	if romVal&0x01 != 0 && romVal&0xFFFFF800 != 0 {
+		masks[12] = (romVal & 0xFFFFF800) | 0x00000001
+	} else {
+		masks[12] = 0x00000000
+	}
+
 	masks[13] = 0x00000000 // 0x34: CapPtr + reserved (read-only)
 	masks[14] = 0x00000000 // 0x38: reserved
 	masks[15] = 0x000000FF // 0x3C: IntLine writable, IntPin/MinGnt/MaxLat RO
diff --git a/internal/firmware/codegen/codegen_test.go b/internal/firmware/codegen/codegen_test.go
index 9906a75..ee7dde2 100644
--- a/internal/firmware/codegen/codegen_test.go
+++ b/internal/firmware/codegen/codegen_test.go
@@ -137,3 +137,43 @@ func TestConfigSpaceHex_DWORDFormat(t *testing.T) {
 		t.Error("HEX should contain BAR0 at offset [010]")
 	}
 }
+
+// nthCOEWord returns the raw hex word for masks[idx] from a formatCOE-style
+// vector (one word per line, no per-line offset comment).
+func nthCOEWord(t *testing.T, coe string, idx int) string {
+	t.Helper()
+	lines := strings.Split(coe, "\n")
+	start := -1
+	for i, l := range lines {
+		if l == "memory_initialization_vector=" {
+			start = i + 1
+			break
+		}
+	}
+	if start == -1 || start+idx >= len(lines) {
+		t.Fatalf("could not find word %d in COE", idx)
+	}
+	return strings.TrimRight(lines[start+idx], ",;")
+}
+
+// masks[12] (Expansion ROM, 0x30) must mirror the donor's own ROM BAR state
+// instead of unconditionally hardcoding read-only.
+func TestGenerateWritemaskCOE_ExpansionROM(t *testing.T) {
+	// most donors report no live ROM BAR - masks[12] stays read-only.
+	cs := pci.NewConfigSpace()
+	cs.Size = pci.ConfigSpaceSize
+	coe := GenerateWritemaskCOE(cs)
+	if got := nthCOEWord(t, coe, 12); got != "00000000" {
+		t.Errorf("expected masks[12]=00000000 for unused ROM BAR, got %s", got)
+	}
+
+	// donor with an enabled ROM BAR: writemask should preserve Enable + the
+	// address/size bits, not hardcode to zero.
+	cs2 := pci.NewConfigSpace()
+	cs2.Size = pci.ConfigSpaceSize
+	cs2.WriteU32(0x30, 0xFFFF0001) // enabled, 64KB-aligned ROM base
+	coe2 := GenerateWritemaskCOE(cs2)
+	if got := nthCOEWord(t, coe2, 12); got != "ffff0001" {
+		t.Errorf("expected masks[12]=ffff0001 for enabled ROM BAR, got %s", got)
+	}
+}
diff --git a/internal/firmware/devclass/ethernet.go b/internal/firmware/devclass/ethernet.go
index 2c303bf..1912ecb 100644
--- a/internal/firmware/devclass/ethernet.go
+++ b/internal/firmware/devclass/ethernet.go
@@ -101,3 +101,48 @@ func ethernetProfile() *DeviceProfile {
 			"at 2500Mbps full-duplex. TxConfig carries chip version ID.",
 	}
 }
+
+// --- Generic (non-Realtek) fallback ---
+//
+// ponytail: e1000e/tg3/Aquantia/Marvell etc each have their own distinct,
+// incompatible MMIO register layouts. Faking any of them correctly needs
+// per-vendor modeling, out of scope for this pass. Honest passthrough
+// (no writes) beats garbage RTL8168/8125 offsets into unrelated chips.
+
+type ethernetStrategyGenericImpl struct{ baseStrategy }
+
+func ethernetStrategyGeneric() DeviceStrategy {
+	return &ethernetStrategyGenericImpl{baseStrategy{"Ethernet (Generic)", ClassEthernet, ethernetGenericProfile}}
+}
+
+func (s *ethernetStrategyGenericImpl) ScrubBAR(data []byte) {}
+
+func (s *ethernetStrategyGenericImpl) PostInitRegisters(regs map[uint32]*uint32) {}
+
+func ethernetGenericProfile() *DeviceProfile {
+	return &DeviceProfile{
+		ClassName:         "Ethernet (Generic)",
+		PreferredBAR:      0,
+		MinBARSize:        4096,
+		Uses64BitBAR:      true,
+		BARIsPrefetchable: false,
+
+		PrefersMSIX:    true,
+		MinMSIXVectors: 1,
+
+		ExpectedCaps: []uint8{
+			pci.CapIDPowerManagement,
+			pci.CapIDMSIX,
+			pci.CapIDPCIExpress,
+		},
+
+		SupportsPME:   true,
+		MaxPowerState: 3,
+
+		Notes: "Vendor-agnostic Ethernet passthrough. e1000e/tg3/Aquantia/Marvell and " +
+			"other non-Realtek NICs each use distinct, incompatible MMIO register " +
+			"layouts that would need per-vendor modeling to fake correctly, out of " +
+			"scope for this pass, so no BAR writes are made and no register defaults " +
+			"are assumed.",
+	}
+}
diff --git a/internal/firmware/devclass/gpu.go b/internal/firmware/devclass/gpu.go
index 94bcaa7..1981bf1 100644
--- a/internal/firmware/devclass/gpu.go
+++ b/internal/firmware/devclass/gpu.go
@@ -60,7 +60,135 @@ func gpuProfile() *DeviceProfile {
 			{Offset: 0x9410, Width: 4, Name: "PTIMER_TIME_1", Reset: 0x00000000, RWMask: 0x00000000},
 		},
 
-		Notes: "NVIDIA/AMD GPU profile. Only 4K BRAM window visible - " +
+		Notes: "NVIDIA GPU profile (NV_PMC/NV_PBUS/NV_PTIMER). Only 4K BRAM window visible - " +
 			"driver sees PMC_ENABLE and PTIMER but can't touch VRAM.",
 	}
 }
+
+// --- AMD GPU ---
+
+type amdGPUStrategy struct{ baseStrategy }
+
+// ponytail: no verified AMD MMIO register map (RCC_DEV0_EPF0_STRAP0 family /
+// ASIC revision regs) grounded from a real donor - safe no-op passthrough
+// until a real AMD donor sample is available to reverse the layout.
+func (s *amdGPUStrategy) ScrubBAR(data []byte) {}
+
+func (s *amdGPUStrategy) PostInitRegisters(regs map[uint32]*uint32) {}
+
+func amdGPUProfile() *DeviceProfile {
+	return &DeviceProfile{
+		ClassName:         "GPU (AMD)",
+		PreferredBAR:      0,
+		MinBARSize:        4096,
+		Uses64BitBAR:      true,
+		BARIsPrefetchable: true,
+
+		PrefersMSIX:    true,
+		MinMSIXVectors: 1,
+
+		ExpectedCaps: []uint8{
+			pci.CapIDPowerManagement,
+			pci.CapIDMSIX,
+			pci.CapIDPCIExpress,
+		},
+		ExpectedExtCaps: []uint16{
+			pci.ExtCapIDAER,
+			pci.ExtCapIDLTR,
+		},
+
+		SupportsPME:   true,
+		MaxPowerState: 3,
+
+		// ponytail: no BARDefaults - AMDGPU register offsets not grounded,
+		// injecting fabricated values would be worse than leaving the BAR blank.
+		Notes: "AMD GPU profile. No verified amdgpu MMIO register map - " +
+			"safe passthrough (no BAR register scrub/defaults) until a real donor sample is available.",
+	}
+}
+
+// --- Intel GPU ---
+
+type intelGPUStrategy struct{ baseStrategy }
+
+// ponytail: Intel iGPU register semantics (GTTMMADR, FORCEWAKE/FORCEWAKE_ACK
+// protocol) are documented but nontrivial and not grounded from a real donor
+// here - safe no-op passthrough until a real Intel donor sample is available.
+func (s *intelGPUStrategy) ScrubBAR(data []byte) {}
+
+func (s *intelGPUStrategy) PostInitRegisters(regs map[uint32]*uint32) {}
+
+func intelGPUProfile() *DeviceProfile {
+	return &DeviceProfile{
+		ClassName:         "GPU (Intel)",
+		PreferredBAR:      0,
+		MinBARSize:        4096,
+		Uses64BitBAR:      true,
+		BARIsPrefetchable: true,
+
+		PrefersMSIX:    true,
+		MinMSIXVectors: 1,
+
+		ExpectedCaps: []uint8{
+			pci.CapIDPowerManagement,
+			pci.CapIDMSIX,
+			pci.CapIDPCIExpress,
+		},
+		ExpectedExtCaps: []uint16{
+			pci.ExtCapIDAER,
+			pci.ExtCapIDLTR,
+		},
+
+		SupportsPME:   true,
+		MaxPowerState: 3,
+
+		// ponytail: no BARDefaults - GTTMMADR/forcewake register offsets not
+		// grounded, injecting fabricated values would be worse than leaving the BAR blank.
+		Notes: "Intel GPU profile. No verified i915 MMIO register map - " +
+			"safe passthrough (no BAR register scrub/defaults) until a real donor sample is available.",
+	}
+}
+
+// --- Generic/unknown vendor GPU ---
+
+type genericGPUStrategy struct{ baseStrategy }
+
+// ponytail: unrecognized GPU vendor - never guess a register map, always
+// safe no-op passthrough.
+func (s *genericGPUStrategy) ScrubBAR(data []byte) {}
+
+func (s *genericGPUStrategy) PostInitRegisters(regs map[uint32]*uint32) {}
+
+func genericGPUProfile() *DeviceProfile {
+	return &DeviceProfile{
+		ClassName:         "GPU (Generic)",
+		PreferredBAR:      0,
+		MinBARSize:        4096,
+		Uses64BitBAR:      true,
+		BARIsPrefetchable: true,
+
+		PrefersMSIX:    true,
+		MinMSIXVectors: 1,
+
+		SupportsPME:   true,
+		MaxPowerState: 3,
+
+		Notes: "Unrecognized GPU vendor. No register map to ground against - " +
+			"safe passthrough (no BAR register scrub/defaults).",
+	}
+}
+
+// gpuStrategyForAMD returns the AMD GPU strategy.
+func gpuStrategyForAMD() DeviceStrategy {
+	return &amdGPUStrategy{baseStrategy{"GPU (AMD)", ClassGPU, amdGPUProfile}}
+}
+
+// gpuStrategyForIntel returns the Intel GPU strategy.
+func gpuStrategyForIntel() DeviceStrategy {
+	return &intelGPUStrategy{baseStrategy{"GPU (Intel)", ClassGPU, intelGPUProfile}}
+}
+
+// gpuStrategyGeneric returns the neutral fallback strategy for unrecognized GPU vendors.
+func gpuStrategyGeneric() DeviceStrategy {
+	return &genericGPUStrategy{baseStrategy{"GPU (Generic)", ClassGPU, genericGPUProfile}}
+}
diff --git a/internal/firmware/devclass/sdhci.go b/internal/firmware/devclass/sdhci.go
new file mode 100644
index 0000000..bdaf577
--- /dev/null
+++ b/internal/firmware/devclass/sdhci.go
@@ -0,0 +1,115 @@
+package devclass
+
+import (
+	"github.com/sercanarga/pcileechgen/internal/pci"
+	"github.com/sercanarga/pcileechgen/internal/util"
+)
+
+type sdhciStrategy struct{ baseStrategy }
+
+// presentStateNoCard is Present State (0x24) with no card in the slot: CINS/CSS/CDPL
+// clear (bits 16-18), command/data lines idle (bits 0-2), DAT[3:0]/CMD signal levels
+// pulled high (bus idle-high, bits 20-24), WP reads "not protected" (bit 19) since
+// there's no card to protect. A host driver enumerates fine with no card present -
+// card presence is a separate polled/interrupt event, not an enumeration blocker.
+const presentStateNoCard = 0x01F80000
+
+func (s *sdhciStrategy) ScrubBAR(data []byte) {
+	if len(data) < 0x30 {
+		return
+	}
+	util.WriteLE32(data, 0x24, presentStateNoCard)
+
+	// Clock Control: force Internal Clock Stable (bit1) so a driver polling for clock
+	// lock never spins, and clear the Software Reset bits (24-26) so a donor dump
+	// captured mid-reset doesn't replay as "reset still in progress".
+	cc := util.ReadLE32(data, 0x2C)
+	cc |= 0x00000002
+	cc &^= 0x07000000
+	util.WriteLE32(data, 0x2C, cc)
+
+	if len(data) >= 0x34 {
+		// Normal/Error Interrupt Status - no pending interrupts at boot.
+		util.WriteLE32(data, 0x30, 0x00000000)
+	}
+}
+
+func (s *sdhciStrategy) PostInitRegisters(regs map[uint32]*uint32) {
+	if v, ok := regs[0x24]; ok {
+		*v = presentStateNoCard
+	}
+	if v, ok := regs[0x2C]; ok {
+		*v |= 0x00000002
+		*v &^= 0x07000000
+	}
+}
+
+func sdhciProfile() *DeviceProfile {
+	return &DeviceProfile{
+		ClassName:         "SD Host Controller",
+		PreferredBAR:      0, // sdhci-pci (Linux) ioremaps BAR0 for the standard register set
+		MinBARSize:        4096,
+		Uses64BitBAR:      false,
+		BARIsPrefetchable: false,
+
+		PrefersMSIX:    false,
+		MinMSIXVectors: 0,
+
+		ExpectedCaps: []uint8{
+			pci.CapIDPowerManagement,
+			pci.CapIDMSI,
+			pci.CapIDPCIExpress,
+		},
+		ExpectedExtCaps: []uint16{
+			pci.ExtCapIDAER,
+		},
+
+		SupportsPME:   true,
+		MaxPowerState: 3,
+
+		BARDefaults: []BARDefault{
+			// SDMA System Address / Argument2 (for Auto CMD23)
+			{Offset: 0x00, Width: 4, Name: "SDMASYSADDR_ARG2", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
+			// Block Size [15:0] (xfer size[11:0] + SDMA boundary[14:12]) + Block Count [31:16]
+			{Offset: 0x04, Width: 4, Name: "BLOCKSIZE_BLOCKCOUNT", Reset: 0x00000000, RWMask: 0xFFFF7FFF},
+			// Argument1 - command argument
+			{Offset: 0x08, Width: 4, Name: "ARGUMENT1", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
+			// Transfer Mode [15:0] (bits 0-5 used) + Command [31:16] (bits 0-13 used)
+			{Offset: 0x0C, Width: 4, Name: "XFERMODE_COMMAND", Reset: 0x00000000, RWMask: 0x3FFF003F},
+			// Response 0-3 - card response, read-only (no card, no command ever completes)
+			{Offset: 0x10, Width: 4, Name: "RESPONSE0", Reset: 0x00000000, RWMask: 0x00000000},
+			{Offset: 0x14, Width: 4, Name: "RESPONSE1", Reset: 0x00000000, RWMask: 0x00000000},
+			{Offset: 0x18, Width: 4, Name: "RESPONSE2", Reset: 0x00000000, RWMask: 0x00000000},
+			{Offset: 0x1C, Width: 4, Name: "RESPONSE3", Reset: 0x00000000, RWMask: 0x00000000},
+			// Buffer Data Port - PIO data window
+			{Offset: 0x20, Width: 4, Name: "BUFFERDATAPORT", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
+			// Present State - no card inserted, bus idle, lines pulled high
+			{Offset: 0x24, Width: 4, Name: "PRESENTSTATE", Reset: presentStateNoCard, RWMask: 0x00000000},
+			// Host Control 1 [7:0] + Power Control [15:8] + Block Gap Control [23:16] + Wakeup Control [31:24]
+			{Offset: 0x28, Width: 4, Name: "HOSTCTRL1_PWRCTRL_BGAP_WAKECTRL", Reset: 0x00000000, RWMask: 0x070F0FFF},
+			// Clock Control [15:0] (ICS bit1 is RO, forced via Scrub/PostInit) + Timeout Control [23:16] + Software Reset [31:24]
+			{Offset: 0x2C, Width: 4, Name: "CLOCKCTRL_TIMEOUTCTRL_SWRESET", Reset: 0x000E0000, RWMask: 0x070FFFCD},
+			// Normal Interrupt Status [15:0] (bits 0-7 W1C, bit8 Card Interrupt is RO-live) + Error Interrupt Status [31:16] (bits 0-9 W1C)
+			{Offset: 0x30, Width: 4, Name: "NORMALINTSTS_ERRORINTSTS", Reset: 0x00000000, RWMask: 0x00000000, W1CMask: 0x03FF00FF},
+			// Normal Interrupt Status Enable [15:0] (bits 0-8) + Error Interrupt Status Enable [31:16] (bits 0-9)
+			{Offset: 0x34, Width: 4, Name: "NORMALINTEN_ERRORINTEN", Reset: 0x00000000, RWMask: 0x03FF01FF},
+			// Normal Interrupt Signal Enable [15:0] + Error Interrupt Signal Enable [31:16] - masked off,
+			// matches this codebase's "interrupts off for FPGA" convention (see sata.go GHC.IE)
+			{Offset: 0x38, Width: 4, Name: "NORMALSIGEN_ERRORSIGEN", Reset: 0x00000000, RWMask: 0x03FF01FF},
+			// Capabilities - SDHCI 2.00 feature set: SDMA yes, no ADMA/high-speed/UHS, 3.3V only
+			// ponytail: base/timeout clock frequencies (50MHz/50KHz) are plausible round numbers picked
+			// for internal consistency, not lifted from a real silicon datasheet
+			{Offset: 0x40, Width: 4, Name: "CAPABILITIES", Reset: 0x01403232, RWMask: 0x00000000},
+			// Slot Interrupt Status [15:0] (no pending) + Host Controller Version [31:16].
+			// Version field = 0x01 -> SD Host Spec Version 2.00 (register encodes 0x00=1.00, 0x01=2.00,
+			// 0x02=3.00 per spec Table 2-16), consistent with the no-UHS/no-ADMA Capabilities above.
+			{Offset: 0xFC, Width: 4, Name: "SLOTINTSTS_HCVERSION", Reset: 0x00010000, RWMask: 0x00000000},
+		},
+
+		Notes: "SDHCI (SD Host Controller Simplified Spec) 2.00 profile - vendor-agnostic per-spec register " +
+			"set, the same layout Linux's sdhci.c targets regardless of silicon vendor. No card inserted: " +
+			"Present State CINS/CSS/CDPL clear, host still enumerates normally (card detect is a separate " +
+			"polled/interrupt path). SDMA supported, no ADMA2/high-speed/UHS, 3.3V only. Interrupt Signal " +
+			"Enable masked off (interrupts off for FPGA).",
+	}
+}
diff --git a/internal/firmware/devclass/strategy.go b/internal/firmware/devclass/strategy.go
index 77a1e30..bd1910f 100644
--- a/internal/firmware/devclass/strategy.go
+++ b/internal/firmware/devclass/strategy.go
@@ -9,6 +9,7 @@ const (
 	ClassSATA        = "sata"
 	ClassWiFi        = "wifi"
 	ClassThunderbolt = "thunderbolt"
+	ClassSDHCI       = "sdhci"
 	ClassGeneric     = "generic"
 )
 
@@ -16,7 +17,7 @@ const (
 func AllClasses() []string {
 	return []string{
 		ClassNVMe, ClassXHCI, ClassEthernet, ClassAudio, ClassGPU,
-		ClassSATA, ClassWiFi, ClassThunderbolt, ClassGeneric,
+		ClassSATA, ClassWiFi, ClassThunderbolt, ClassSDHCI, ClassGeneric,
 	}
 }
 
@@ -50,39 +51,83 @@ func StrategyForClass(classCode uint32) DeviceStrategy {
 func StrategyForClassAndVendor(classCode uint32, vendorID uint16) DeviceStrategy {
 	baseClass := (classCode >> 16) & 0xFF
 	subClass := (classCode >> 8) & 0xFF
+	progIF := classCode & 0xFF
 
 	switch {
 	case baseClass == 0x01 && subClass == 0x08:
 		return &nvmeStrategy{baseStrategy{"NVMe", ClassNVMe, nvmeProfile}}
-	case baseClass == 0x0C && subClass == 0x03:
+	case baseClass == 0x0C && subClass == 0x03 && progIF == 0x30:
 		return &xhciStrategy{baseStrategy{"xHCI", ClassXHCI, xhciProfile}}
 	case baseClass == 0x02 && subClass == 0x00:
-		return &ethernetStrategy{baseStrategy{"Ethernet", ClassEthernet, ethernetProfile}}
+		return ethernetStrategyForVendor(vendorID)
 	case baseClass == 0x04 && subClass == 0x03:
 		return &audioStrategy{baseStrategy{"HD Audio", ClassAudio, audioProfile}}
-	case baseClass == 0x03 && subClass == 0x00:
-		return &gpuStrategy{baseStrategy{"GPU", ClassGPU, gpuProfile}}
+	case baseClass == 0x03 && subClass == 0x00,
+		baseClass == 0x03 && subClass == 0x02 && progIF == 0x00:
+		return gpuStrategyForVendor(vendorID)
 	case baseClass == 0x01 && subClass == 0x06:
 		return &sataStrategy{baseStrategy{"SATA AHCI", ClassSATA, sataProfile}}
 	case baseClass == 0x02 && subClass == 0x80:
 		return wifiStrategyForVendor(vendorID)
 	case baseClass == 0x0C && subClass == 0x80:
 		return &thunderboltStrategy{baseStrategy{"Thunderbolt", ClassThunderbolt, thunderboltProfile}}
+	case baseClass == 0x08 && subClass == 0x05:
+		return &sdhciStrategy{baseStrategy{"SD Host Controller", ClassSDHCI, sdhciProfile}}
 	default:
 		return &genericStrategy{baseStrategy{"Generic", ClassGeneric, genericProfile}}
 	}
 }
 
 // wifiStrategyForVendor selects between mediatek and intel/broadcom wifi profiles.
+// WWAN/cellular modem vendors under class 0x0280 don't share the iwlwifi-shaped
+// register layout the wifi profiles assume, so they get routed to the safe
+// generic passthrough instead of wrong register writes.
 func wifiStrategyForVendor(vendorID uint16) DeviceStrategy {
+	switch vendorID {
+	case 0x1199, 0x17CB, 0x2CB7, 0x2C7C: // Sierra Wireless, Qualcomm, Fibocom, Quectel
+		return &genericStrategy{baseStrategy{"Generic", ClassGeneric, genericProfile}}
+	}
 	if vendorID == mediatekVID {
 		return &mediatekWifiStrategy{baseStrategy{"Wi-Fi (MediaTek)", ClassWiFi, mediatekWifiProfile}}
 	}
 	return &wifiStrategy{baseStrategy{"Wi-Fi", ClassWiFi, wifiProfile}}
 }
 
+// gpuStrategyForVendor selects a vendor-specific GPU strategy. NVIDIA is the
+// only one with real register evidence today; AMD/Intel/generic bodies live
+// in gpu.go.
+func gpuStrategyForVendor(vendorID uint16) DeviceStrategy {
+	switch vendorID {
+	case 0, 0x10DE: // unknown (no vendor context) or NVIDIA
+		return &gpuStrategy{baseStrategy{"GPU", ClassGPU, gpuProfile}}
+	case 0x1002: // AMD
+		return gpuStrategyForAMD()
+	case 0x8086: // Intel
+		return gpuStrategyForIntel()
+	default:
+		return gpuStrategyGeneric()
+	}
+}
+
+// ethernetStrategyForVendor selects a vendor-specific ethernet strategy.
+// Realtek is the one with real register evidence today; the generic body
+// lives in ethernet.go.
+func ethernetStrategyForVendor(vendorID uint16) DeviceStrategy {
+	if vendorID == 0 || vendorID == 0x10EC { // unknown (no vendor context) or Realtek
+		return &ethernetStrategy{baseStrategy{"Ethernet", ClassEthernet, ethernetProfile}}
+	}
+	return ethernetStrategyGeneric()
+}
+
 // --- Generic fallback ---
 
+// genericStrategy is the deliberate default for PCI base classes with no
+// PCI-SIG-standardized common register layout (e.g. 0x09 input controllers,
+// 0x0A docking stations, 0x10 encryption accelerators, 0x11 signal
+// processors). Donor silicon in these classes is vendor-proprietary and
+// heterogeneous, unlike NVMe/xHCI/AHCI/SDHCI, so raw donor-snapshot
+// passthrough is the correct, honest default rather than fabricating
+// unverifiable fake registers. This is a scope boundary, not an oversight.
 type genericStrategy struct{ baseStrategy }
 
 func (s *genericStrategy) ScrubBAR(data []byte) {}
diff --git a/internal/firmware/devclass/thunderbolt.go b/internal/firmware/devclass/thunderbolt.go
index ed29f97..2defbe7 100644
--- a/internal/firmware/devclass/thunderbolt.go
+++ b/internal/firmware/devclass/thunderbolt.go
@@ -60,6 +60,9 @@ func thunderboltProfile() *DeviceProfile {
 		},
 
 		Notes: "Intel Thunderbolt controller profile. " +
-			"LC_STS.READY=1. SECURITY_LEVEL=0 (no security) for full DMA access.",
+			"LC_STS.READY=1. SECURITY_LEVEL=0 (no security) for full DMA access. " +
+			"Models a single PCIe-tunneling function only - does not emulate the NHI " +
+			"(native host interface) DMA path or a full multi-function TB controller " +
+			"relationship (bridge + NHI as sibling functions).",
 	}
 }
diff --git a/internal/firmware/devclass/xhci.go b/internal/firmware/devclass/xhci.go
index 6042085..c485543 100644
--- a/internal/firmware/devclass/xhci.go
+++ b/internal/firmware/devclass/xhci.go
@@ -22,14 +22,12 @@ func (s *xhciStrategy) ScrubBAR(data []byte) {
 	}
 
 	if len(data) > 0x1C {
-		dboff := util.ReadLE32(data, 0x14)
-		if dboff > 0x800 {
-			util.WriteLE32(data, 0x14, 0x00000100)
-		}
-		rtsoff := util.ReadLE32(data, 0x18)
-		if rtsoff > 0xC00 {
-			util.WriteLE32(data, 0x18, 0x00000200)
-		}
+		// DBOFF/RTSOFF are internal wiring constants, not donor-identity
+		// fields: bar_controller.sv.tmpl and barmodel's buildXHCIBARModel
+		// hardcode the doorbell/runtime layout at 0x100/0x200, so any donor
+		// value must be forced to match regardless of what the donor reports.
+		util.WriteLE32(data, 0x14, 0x00000100)
+		util.WriteLE32(data, 0x18, 0x00000200)
 	}
 }
 
@@ -90,14 +88,27 @@ func xhciProfile() *DeviceProfile {
 			{Offset: 0x28, Width: 4, Name: "PAGESIZE", Reset: 0x00000001, RWMask: 0x00000000},
 			// DNCTRL - device notification control
 			{Offset: 0x34, Width: 4, Name: "DNCTRL", Reset: 0x00000000, RWMask: 0x0000FFFF},
-			// CRCR - command ring control
-			{Offset: 0x38, Width: 4, Name: "CRCR_LO", Reset: 0x00000000, RWMask: 0xFFFFFFF0},
+			// CRCR - command ring control. bits[2:0]=RCS/CS/CA (RW), bit3=CRR
+			// (RO), bits[5:4] reserved, bits[31:6]=pointer (RW). Reconciled
+			// with barmodel/model.go's buildXHCIBARModel, which is what
+			// actually drives the generated SV (this profile's RWMask is
+			// only a donor-scrub/name-hint value, see barmodel.classRegisterNames).
+			{Offset: 0x38, Width: 4, Name: "CRCR_LO", Reset: 0x00000000, RWMask: 0xFFFFFFC7},
 			{Offset: 0x3C, Width: 4, Name: "CRCR_HI", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
 			// DCBAAP - device context base address
 			{Offset: 0x50, Width: 4, Name: "DCBAAP_LO", Reset: 0x00000000, RWMask: 0xFFFFFFC0},
 			{Offset: 0x54, Width: 4, Name: "DCBAAP_HI", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
 			// CONFIG - max device slots enabled
 			{Offset: 0x58, Width: 4, Name: "CONFIG", Reset: 0x00000000, RWMask: 0x000000FF},
+			// Primary interrupter (Runtime Register Space, RTSOFF+0x20 -- see
+			// ScrubBAR/PostInitRegisters fixing RTSOFF at 0x200 above).
+			{Offset: 0x220, Width: 4, Name: "IMAN", Reset: 0x00000000, RWMask: 0x00000002, W1CMask: 0x00000001},
+			{Offset: 0x224, Width: 4, Name: "IMOD", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
+			{Offset: 0x228, Width: 4, Name: "ERSTSZ", Reset: 0x00000000, RWMask: 0x0000FFFF},
+			{Offset: 0x230, Width: 4, Name: "ERSTBA_LO", Reset: 0x00000000, RWMask: 0xFFFFFFF0},
+			{Offset: 0x234, Width: 4, Name: "ERSTBA_HI", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
+			{Offset: 0x238, Width: 4, Name: "ERDP_LO", Reset: 0x00000000, RWMask: 0xFFFFFFF7},
+			{Offset: 0x23C, Width: 4, Name: "ERDP_HI", Reset: 0x00000000, RWMask: 0xFFFFFFFF},
 			// PORTSC1 - port 1 status/control (powered, no device)
 			{Offset: 0x420, Width: 4, Name: "PORTSC1", Reset: 0x000002A0, RWMask: 0x8EFFC3F2},
 			// PORTSC2 - port 2 status/control
diff --git a/internal/firmware/fallback/fallback.go b/internal/firmware/fallback/fallback.go
index b4d5a15..8952272 100644
--- a/internal/firmware/fallback/fallback.go
+++ b/internal/firmware/fallback/fallback.go
@@ -6,6 +6,8 @@ import (
 	"log/slog"
 	"os"
 
+	"github.com/sercanarga/pcileechgen/internal/firmware"
+	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
 	"gopkg.in/yaml.v3"
 )
 
@@ -72,13 +74,18 @@ func Apply(cfg *Config, classCode uint32, barContents map[int][]byte) []ApplyRes
 	var results []ApplyResult
 	slog.Info("applying fallback defaults", "description", dc.Description, "class", key)
 
-	// Find the target BAR: try each available BAR, preferring larger ones
+	// Prefer the device class's preferred BAR (e.g. BAR5/ABAR for SATA); fall
+	// back to the largest available BAR when the preferred one has no data.
 	var targetBAR []byte
 	var targetIdx int
-	for idx, data := range barContents {
-		if len(data) >= 4 && len(data) > len(targetBAR) {
-			targetBAR = data
-			targetIdx = idx
+	if pref := devclass.ProfileForClass(classCode).PreferredBAR; len(barContents[pref]) >= 4 {
+		targetBAR = barContents[pref]
+		targetIdx = pref
+	} else {
+		targetIdx = firmware.LargestBarIndex(barContents)
+		targetBAR = barContents[targetIdx]
+		if len(targetBAR) < 4 {
+			targetBAR = nil
 		}
 	}
 
diff --git a/internal/firmware/fallback/fallback_test.go b/internal/firmware/fallback/fallback_test.go
index ecaa6f0..cab42f0 100644
--- a/internal/firmware/fallback/fallback_test.go
+++ b/internal/firmware/fallback/fallback_test.go
@@ -110,6 +110,37 @@ func TestApply_SkipsNonZero(t *testing.T) {
 	}
 }
 
+func TestApply_PrefersPreferredBAROverLargest(t *testing.T) {
+	cfg := &Config{
+		DeviceClasses: map[string]*DeviceClass{
+			// SATA/AHCI: PreferredBAR is 5 (ABAR).
+			"0106": {
+				Description: "SATA AHCI",
+				BAR0Defaults: map[string]uint32{
+					"0x00000000": 0x00000001,
+				},
+			},
+		},
+	}
+
+	barContents := map[int][]byte{
+		0: make([]byte, 8192), // larger than BAR5, but not the ABAR
+		5: make([]byte, 4096), // smaller, but the class's preferred (ABAR) BAR
+	}
+
+	// class 01:06:01 -> SATA AHCI
+	results := Apply(cfg, 0x010601, barContents)
+	if len(results) != 1 {
+		t.Fatalf("expected 1 result, got %d", len(results))
+	}
+	if results[0].Field != "BAR5[0x0000]" {
+		t.Errorf("expected default stamped into BAR5 (preferred/ABAR), got field %s", results[0].Field)
+	}
+	if barContents[0][0] != 0 {
+		t.Errorf("BAR0 should be untouched, got %#v", barContents[0][:4])
+	}
+}
+
 func TestApply_UnknownClass(t *testing.T) {
 	cfg := &Config{
 		DeviceClasses: map[string]*DeviceClass{},
diff --git a/internal/firmware/output/coverage_test.go b/internal/firmware/output/coverage_test.go
index 95707ec..38b5e41 100644
--- a/internal/firmware/output/coverage_test.go
+++ b/internal/firmware/output/coverage_test.go
@@ -188,6 +188,35 @@ func TestWriteConditionalArtifacts_NVMe(t *testing.T) {
 	}
 }
 
+func TestWriteConditionalArtifacts_XHCI(t *testing.T) {
+	dir := t.TempDir()
+	ctx := makeDonorContext(0x8086, 0xA36D, 0x0C0330)
+	ow := NewOutputWriter(dir, "", 0, 0)
+	ids := firmware.ExtractDeviceIDs(ctx.ConfigSpace, ctx.ExtCapabilities)
+
+	cfg, err := ow.buildSVConfig(ctx, ctx.ConfigSpace, ids, 0x42, &board.Board{}); if err != nil { t.Fatal(err) }
+	if cfg.BARModel == nil {
+		t.Fatal("xHCI should have a BARModel")
+	}
+
+	if err := ow.writeConditionalArtifacts(cfg, ctx); err != nil {
+		t.Fatalf("writeConditionalArtifacts failed: %v", err)
+	}
+
+	// Regression check for the "no Go code ever renders xhci_ring_engine"
+	// showstopper: bar_controller.sv.tmpl instantiates pcileech_xhci_ring_engine
+	// and pcileech_xhci_dma_bridge, so the file defining them must exist.
+	data, err := os.ReadFile(filepath.Join(dir, "pcileech_xhci_ring_engine.sv"))
+	if err != nil {
+		t.Fatalf("pcileech_xhci_ring_engine.sv not created: %v", err)
+	}
+	for _, module := range []string{"module pcileech_xhci_ring_engine", "module pcileech_xhci_dma_bridge"} {
+		if !strings.Contains(string(data), module) {
+			t.Errorf("pcileech_xhci_ring_engine.sv missing %q", module)
+		}
+	}
+}
+
 func TestWriteConditionalArtifacts_MSIXDonor(t *testing.T) {
 	dir := t.TempDir()
 	ctx := makeDonorContext(0x8086, 0x15B7, 0x020000)
diff --git a/internal/firmware/output/writer.go b/internal/firmware/output/writer.go
index 30734a5..f749104 100644
--- a/internal/firmware/output/writer.go
+++ b/internal/firmware/output/writer.go
@@ -12,10 +12,11 @@ import (
 	"github.com/sercanarga/pcileechgen/internal/donor"
 	"github.com/sercanarga/pcileechgen/internal/donor/behavior"
 	"github.com/sercanarga/pcileechgen/internal/firmware"
+	"github.com/sercanarga/pcileechgen/internal/firmware/ahci"
 	"github.com/sercanarga/pcileechgen/internal/firmware/barmodel"
 	"github.com/sercanarga/pcileechgen/internal/firmware/codegen"
 	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
-	"github.com/sercanarga/pcileechgen/internal/firmware/ahci"
+	"github.com/sercanarga/pcileechgen/internal/firmware/fallback"
 	"github.com/sercanarga/pcileechgen/internal/firmware/nvme"
 	"github.com/sercanarga/pcileechgen/internal/firmware/overlay"
 	"github.com/sercanarga/pcileechgen/internal/firmware/scrub"
@@ -37,8 +38,18 @@ type OutputWriter struct {
 
 	TimingHistogram *behavior.TimingHistogram
 	ILADepth        int
+	FallbackConfig  *fallback.Config
 }
 
+// DefaultFallbackConfig seeds new OutputWriters with the class-specific BAR
+// register fallbacks (see internal/firmware/fallback). cmd/pcileechgen/build.go
+// sets this once, from --fallback-config or the embedded defaults, before the
+// vivado.Builder it invokes constructs an OutputWriter.
+// ponytail: package-level var, not a threaded field on vivado.BuildOptions/Builder
+// (out of scope here) - fine for the CLI's one-build-per-process usage; revisit
+// if concurrent in-process builds are ever needed.
+var DefaultFallbackConfig *fallback.Config
+
 func NewOutputWriter(outputDir, libDir string, jobs, timeout int) *OutputWriter {
 	if jobs <= 0 {
 		jobs = 4
@@ -47,10 +58,11 @@ func NewOutputWriter(outputDir, libDir string, jobs, timeout int) *OutputWriter
 		timeout = 3600
 	}
 	return &OutputWriter{
-		OutputDir: outputDir,
-		LibDir:    libDir,
-		Jobs:      jobs,
-		Timeout:   timeout,
+		OutputDir:      outputDir,
+		LibDir:         libDir,
+		Jobs:           jobs,
+		Timeout:        timeout,
+		FallbackConfig: DefaultFallbackConfig,
 	}
 }
 
@@ -158,6 +170,10 @@ func (ow *OutputWriter) writeConfigSpaceArtifacts(ctx *donor.DeviceContext, scru
 	}
 	bar0Size := firmware.CappedBAR0Size(ctx, b, msixTableSize)
 
+	if results := fallback.Apply(ow.FallbackConfig, ctx.Device.ClassCode, ctx.BARContents); len(results) > 0 {
+		slog.Info("fallback defaults applied", "modifications", len(results))
+	}
+
 	scrub.ScrubBarContent(ctx.BARContents, ctx.Device.ClassCode, ctx.Device.VendorID, bar0Size)
 	if err := ow.writeFile("pcileech_bar_zero4k.coe",
 		codegen.GenerateBarContentCOE(ctx.BARContents, firmware.CappedBAR0Size(ctx, b, msixTableSize))); err != nil {
@@ -449,6 +465,20 @@ func extractMSIInfo(cs *pci.ConfigSpace) *svgen.MSIConfig {
 	return nil
 }
 
+// extraBARPresence reports, for BAR indices 3-6 (result index 0=BAR3 ...
+// 3=BAR6), whether the donor's real hardware has a populated (nonzero-size)
+// BAR there. Used by bar_controller.sv.tmpl to present a real aperture
+// instead of pcileech_bar_impl_none for donors with genuine extra BARs.
+func extraBARPresence(bars []pci.BAR) [4]bool {
+	var present [4]bool
+	for _, bar := range bars {
+		if idx := bar.Index - 3; idx >= 0 && idx < 4 && !bar.IsDisabled() {
+			present[idx] = true
+		}
+	}
+	return present
+}
+
 // buildSVConfig assembles the SVGeneratorConfig from donor context.
 func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.ConfigSpace, ids firmware.DeviceIDs, entropy uint32, b *board.Board) (*svgen.SVGeneratorConfig, error) {
 	// Use the same BAR index for content data and probe profile to avoid
@@ -509,6 +539,7 @@ func (ow *OutputWriter) buildSVConfig(ctx *donor.DeviceContext, scrubbedCS *pci.
 		PRNGSeeds:         svgen.BuildPRNGSeeds(ids.VendorID, ids.DeviceID, entropy),
 		DeviceClass:       devClass,
 		Bar0Size:          bar0Size,
+		ExtraBARPresent:   extraBARPresence(ctx.BARs),
 	}
 
 	if ow.ILADepth > 0 {
@@ -638,6 +669,16 @@ func (ow *OutputWriter) writeConditionalArtifacts(cfg *svgen.SVGeneratorConfig,
 		}
 	}
 
+	if cfg.DeviceClass == devclass.ClassXHCI && cfg.BARModel != nil {
+		xhciSV, err := svgen.GenerateXHCIRingEngineSV(cfg)
+		if err != nil {
+			return fmt.Errorf("generating pcileech_xhci_ring_engine.sv: %w", err)
+		}
+		if err := ow.writeFile("pcileech_xhci_ring_engine.sv", xhciSV); err != nil {
+			return err
+		}
+	}
+
 	if cfg.DeviceClass == devclass.ClassAudio && cfg.BARModel != nil {
 		hdaSV, err := svgen.GenerateHDARIRBDMASV(cfg)
 		if err != nil {
@@ -672,6 +713,9 @@ func (ow *OutputWriter) logSVSummary(cfg *svgen.SVGeneratorConfig) {
 		}
 	case devclass.ClassXHCI:
 		features = append(features, "xHCI FSM")
+		if cfg.BARModel != nil {
+			features = append(features, "xHCI Ring Engine", "xHCI DMA Bridge")
+		}
 	case devclass.ClassAudio:
 		features = append(features, "HD Audio FSM", "RIRB DMA Bridge")
 		if cfg.MSIConfig != nil {
diff --git a/internal/firmware/output/writer_test.go b/internal/firmware/output/writer_test.go
index d609a44..4ef1d15 100644
--- a/internal/firmware/output/writer_test.go
+++ b/internal/firmware/output/writer_test.go
@@ -111,3 +111,20 @@ func TestWriteBARBehaviorProfile_writesProfileArtifact(t *testing.T) {
 		t.Fatalf("unexpected BAR profile: %+v", profile.BARs)
 	}
 }
+
+func TestExtraBARPresence(t *testing.T) {
+	bars := []pci.BAR{
+		{Index: 0, Size: 4096, Type: pci.BARTypeMem32},
+		{Index: 3, Size: 65536, Type: pci.BARTypeMem32}, // real, populated
+		{Index: 4, Size: 0, Type: pci.BARTypeDisabled},  // genuinely absent
+		{Index: 5, Size: 256, Type: pci.BARTypeIO},      // real, populated
+		// BAR6 not present at all in the donor's list.
+	}
+
+	present := extraBARPresence(bars)
+
+	want := [4]bool{true, false, true, false} // BAR3, BAR4, BAR5, BAR6
+	if present != want {
+		t.Errorf("extraBARPresence() = %v, want %v", present, want)
+	}
+}
diff --git a/internal/firmware/scrub/bar.go b/internal/firmware/scrub/bar.go
index a736af3..ff09da2 100644
--- a/internal/firmware/scrub/bar.go
+++ b/internal/firmware/scrub/bar.go
@@ -1,6 +1,8 @@
 package scrub
 
 import (
+	"math/bits"
+
 	"github.com/sercanarga/pcileechgen/internal/firmware"
 	"github.com/sercanarga/pcileechgen/internal/firmware/devclass"
 	"github.com/sercanarga/pcileechgen/internal/util"
@@ -29,6 +31,9 @@ func ScrubBarContentWithBRAM(barContents map[int][]byte, classCode uint32, vendo
 	if strategy.DeviceClass() == devclass.ClassXHCI {
 		scrubXHCIBar0(data, bramSize)
 	}
+	if strategy.DeviceClass() == devclass.ClassSATA {
+		scrubSATABar0(data, bramSize)
+	}
 }
 
 // scrubXHCIBar0 clamps xHCI BAR0 registers to fit BRAM and fakes a running controller.
@@ -48,8 +53,8 @@ func scrubXHCIBar0(data []byte, bramSize int) {
 	xhciClampScratchpads(data)
 	xhciClampXECP(data, bramSize)
 
-	maxSlots = xhciClampDBOFF(data, capLen, maxSlots, bramSize)
-	maxIntrs = xhciClampRTSOFF(data, capLen, maxIntrs, bramSize)
+	maxSlots = xhciClampDBOFF(data, maxSlots, bramSize)
+	maxIntrs = xhciClampRTSOFF(data, maxIntrs, bramSize)
 	maxPorts = xhciClampPorts(capLen, maxPorts, bramSize)
 
 	// write back clamped HCSPARAMS1
@@ -103,97 +108,45 @@ func xhciClampXECP(data []byte, bramSize int) {
 	}
 }
 
-// xhciClampDBOFF clamps doorbell offset to fit BRAM, shrinking MaxSlots if needed.
-func xhciClampDBOFF(data []byte, capLen, maxSlots, bramSize int) int {
-	dboff := util.ReadLE32(data, 0x14) & ^uint32(0x03)
-	doorbellSize := (maxSlots + 1) * 4
-
-	if int(dboff)+doorbellSize > bramSize {
-		newDBOFF := bramSize - doorbellSize
-		if newDBOFF < 0 {
-			newDBOFF = capLen + 0x20
+// clampCountToFit shrinks claimed to the largest count whose region
+// [base, base+claimed*itemSize) fits within bramSize, floored at 1.
+func clampCountToFit(base, itemSize, claimed, bramSize int) int {
+	if base < bramSize {
+		maxFit := (bramSize - base) / itemSize
+		if claimed > maxFit {
+			claimed = maxFit
 		}
-		newDBOFF = newDBOFF & ^0x1F
-		if newDBOFF < capLen+0x20 {
-			// can't fit, shrink MaxSlots
-			available := bramSize - (capLen + 0x20)
-			if available < 8 {
-				available = 8
-			}
-			maxSlots = available/4 - 1
-			if maxSlots < 1 {
-				maxSlots = 1
-			}
-			doorbellSize = (maxSlots + 1) * 4
-			newDBOFF = bramSize - doorbellSize
-			if newDBOFF < 0 {
-				newDBOFF = capLen + 0x20
-			}
-			newDBOFF = newDBOFF & ^0x1F
-		}
-		util.WriteLE32(data, 0x14, uint32(newDBOFF))
 	}
-	return maxSlots
+	if claimed < 1 {
+		claimed = 1
+	}
+	return claimed
 }
 
-func xhciClampRTSOFF(data []byte, capLen, maxIntrs, bramSize int) int {
-	rtsoff := int(util.ReadLE32(data, 0x18) & ^uint32(0x1F))
-
-	if rtsoff > 0 && maxIntrs > 0 {
-		remaining := bramSize - rtsoff - 0x20
-		if remaining < 0x20 {
-			remaining = 0x20
-		}
-		maxFit := remaining / 0x20
-		if maxFit < 1 {
-			maxFit = 1
-		}
-		if maxIntrs > maxFit {
-			maxIntrs = maxFit
-		}
+// xhciClampDBOFF shrinks MaxSlots so the doorbell array fits within BRAM.
+// DBOFF itself is never relocated: bar_controller.sv.tmpl and barmodel's
+// buildXHCIBARModel hardcode the doorbell array at a fixed offset (see
+// devclass/xhci.go's ScrubBAR), so moving it here would desync the SV
+// wiring from what the driver was told.
+func xhciClampDBOFF(data []byte, maxSlots, bramSize int) int {
+	dboff := int(util.ReadLE32(data, 0x14) & ^uint32(0x03))
+	maxSlots = clampCountToFit(dboff, 4, maxSlots+1, bramSize) - 1
+	if maxSlots < 1 {
+		maxSlots = 1
 	}
-	if maxIntrs < 1 {
-		maxIntrs = 1
-	}
-
-	runtimeSize := 0x20 + maxIntrs*0x20
-	if rtsoff+runtimeSize > bramSize {
-		newRTSOFF := capLen + 0x20
-		newRTSOFF = (newRTSOFF + 0x1F) & ^0x1F
-		if newRTSOFF+runtimeSize > bramSize {
-			newRTSOFF = bramSize - runtimeSize
-			newRTSOFF = newRTSOFF & ^0x1F
-		}
-		rtsoff = newRTSOFF
-		util.WriteLE32(data, 0x18, uint32(rtsoff))
+	return maxSlots
+}
 
-		remaining := bramSize - rtsoff - 0x20
-		if remaining < 0x20 {
-			remaining = 0x20
-		}
-		maxFit := remaining / 0x20
-		if maxFit < 1 {
-			maxFit = 1
-		}
-		if maxIntrs > maxFit {
-			maxIntrs = maxFit
-		}
-	}
-	return maxIntrs
+// xhciClampRTSOFF shrinks MaxIntrs so the runtime interrupter register sets
+// (starting at RTSOFF+0x20) fit within BRAM. RTSOFF itself is never
+// relocated, for the same reason DBOFF isn't -- see xhciClampDBOFF.
+func xhciClampRTSOFF(data []byte, maxIntrs, bramSize int) int {
+	rtsoff := int(util.ReadLE32(data, 0x18) & ^uint32(0x1F))
+	return clampCountToFit(rtsoff+0x20, 0x20, maxIntrs, bramSize)
 }
 
 func xhciClampPorts(capLen, maxPorts, bramSize int) int {
-	portBase := capLen + 0x400
-	if portBase < bramSize {
-		maxPortsFit := (bramSize - portBase) / 0x10
-		if maxPorts > maxPortsFit {
-			maxPorts = maxPortsFit
-		}
-	}
-	if maxPorts < 1 {
-		maxPorts = 1
-	}
-	return maxPorts
+	return clampCountToFit(capLen+0x400, 0x10, maxPorts, bramSize)
 }
 
 // xhciSetOperationalState makes the controller look like it's running.
@@ -218,3 +171,61 @@ func xhciSetOperationalState(data []byte, capLen, maxSlots int) {
 	usbsts &= ^uint32(0x01 | 0x04)
 	util.WriteLE32(data, capLen+4, usbsts)
 }
+
+// scrubSATABar0 clamps AHCI PI (Ports Implemented) to fit BRAM and fakes
+// "no device present" for any port that fits but has no real donor data.
+func scrubSATABar0(data []byte, bramSize int) {
+	if len(data) < 0x10 {
+		return
+	}
+
+	pi := util.ReadLE32(data, 0x0C)
+	claimedPorts := bits.OnesCount32(pi)
+	if claimedPorts == 0 {
+		return
+	}
+
+	maxPorts := sataClampPorts(claimedPorts, bramSize)
+	if maxPorts < claimedPorts {
+		// shrink to only the low N ports (0..maxPorts-1) that fit
+		pi &= (uint32(1) << uint(maxPorts)) - 1
+		util.WriteLE32(data, 0x0C, pi)
+	}
+
+	// Port 0 always has real profile/donor data. Any other implemented
+	// port that fits in BRAM but was never actually captured (its PxSSTS
+	// block is still zero) needs an explicit "no device" state, otherwise
+	// the host driver sees a phantom drive with garbage register content.
+	for port := 1; port < 32; port++ {
+		if pi&(1<<uint(port)) == 0 {
+			continue
+		}
+		base := 0x100 + port*0x80
+		if base+0x80 > len(data) {
+			break
+		}
+		if util.ReadLE32(data, base+0x28) != 0 {
+			continue // real donor data already shows a device here
+		}
+		sataMarkPortEmpty(data, base)
+	}
+}
+
+// sataClampPorts clamps the AHCI port count to what fits within BRAM. Each
+// port block is 0x80 bytes starting at 0x100.
+// ponytail: assumes PI is the common contiguous 0..N-1 port bitmask; a
+// sparse PI (spec-legal but rare) would need per-bit offset checks instead
+// of a popcount-derived port count.
+func sataClampPorts(claimedPorts, bramSize int) int {
+	return clampCountToFit(0x100, 0x80, claimedPorts, bramSize)
+}
+
+// sataMarkPortEmpty writes the canonical "no device" register state for an
+// AHCI port block that has no real donor data backing it.
+func sataMarkPortEmpty(data []byte, base int) {
+	util.WriteLE32(data, base+0x28, 0x00000000) // PxSSTS - no device detected
+	util.WriteLE32(data, base+0x24, 0xFFFFFFFF) // PxSIG - no device signature
+	tfd := util.ReadLE32(data, base+0x20)
+	tfd &^= 0x81 // PxTFD - clear BSY/ERR so driver doesn't hang on phantom port
+	util.WriteLE32(data, base+0x20, tfd)
+}
diff --git a/internal/firmware/scrub/bar_test.go b/internal/firmware/scrub/bar_test.go
index 8a5ce4d..b34c8e8 100644
--- a/internal/firmware/scrub/bar_test.go
+++ b/internal/firmware/scrub/bar_test.go
@@ -186,7 +186,7 @@ func TestXhciSetOperationalState(t *testing.T) {
 func TestXhciClampDBOFF_FitsInBRAM(t *testing.T) {
 	data := make([]byte, 4096)
 	util.WriteLE32(data, 0x14, 0x00000400) // DBOFF = 0x400
-	slots := xhciClampDBOFF(data, 0x20, 32, 4096)
+	slots := xhciClampDBOFF(data, 32, 4096)
 	if slots != 32 {
 		t.Errorf("slots should stay 32 when it fits, got %d", slots)
 	}
@@ -194,21 +194,23 @@ func TestXhciClampDBOFF_FitsInBRAM(t *testing.T) {
 
 func TestXhciClampDBOFF_TooLarge(t *testing.T) {
 	data := make([]byte, 4096)
-	util.WriteLE32(data, 0x14, 0x00000F00) // DBOFF = 0xF00
-	slots := xhciClampDBOFF(data, 0x20, 64, 1024)
+	util.WriteLE32(data, 0x14, 0x00000100) // canonical DBOFF (see devclass/xhci.go ScrubBAR)
+	slots := xhciClampDBOFF(data, 64, 300)
 	if slots < 1 {
 		t.Errorf("slots should be >= 1, got %d", slots)
 	}
-	dboff := util.ReadLE32(data, 0x14)
-	if int(dboff)+(slots+1)*4 > 1024 {
-		t.Errorf("DBOFF + doorbell area exceeds BRAM: dboff=0x%X slots=%d bram=1024", dboff, slots)
+	if slots >= 64 {
+		t.Errorf("slots should shrink when the doorbell area doesn't fit, got %d", slots)
+	}
+	if dboff := util.ReadLE32(data, 0x14); dboff != 0x100 {
+		t.Errorf("DBOFF must never be relocated, got 0x%X", dboff)
 	}
 }
 
 func TestXhciClampDBOFF_VerySmallBRAM(t *testing.T) {
 	data := make([]byte, 4096)
 	util.WriteLE32(data, 0x14, 0x00000100)
-	slots := xhciClampDBOFF(data, 0x20, 128, 128)
+	slots := xhciClampDBOFF(data, 128, 128)
 	if slots < 1 {
 		t.Errorf("slots should be >= 1 even with tiny BRAM, got %d", slots)
 	}
@@ -217,7 +219,7 @@ func TestXhciClampDBOFF_VerySmallBRAM(t *testing.T) {
 func TestXhciClampRTSOFF_FitsInBRAM(t *testing.T) {
 	data := make([]byte, 4096)
 	util.WriteLE32(data, 0x18, 0x00000200) // RTSOFF = 0x200
-	intrs := xhciClampRTSOFF(data, 0x20, 8, 4096)
+	intrs := xhciClampRTSOFF(data, 8, 4096)
 	if intrs != 8 {
 		t.Errorf("intrs should stay 8 when it fits, got %d", intrs)
 	}
@@ -225,17 +227,23 @@ func TestXhciClampRTSOFF_FitsInBRAM(t *testing.T) {
 
 func TestXhciClampRTSOFF_TooLarge(t *testing.T) {
 	data := make([]byte, 4096)
-	util.WriteLE32(data, 0x18, 0x00000F00) // RTSOFF = 0xF00
-	intrs := xhciClampRTSOFF(data, 0x20, 64, 1024)
+	util.WriteLE32(data, 0x18, 0x00000200) // canonical RTSOFF (see devclass/xhci.go ScrubBAR)
+	intrs := xhciClampRTSOFF(data, 64, 600)
 	if intrs < 1 {
 		t.Errorf("intrs should be >= 1, got %d", intrs)
 	}
+	if intrs >= 64 {
+		t.Errorf("intrs should shrink when the runtime area doesn't fit, got %d", intrs)
+	}
+	if rtsoff := util.ReadLE32(data, 0x18); rtsoff != 0x200 {
+		t.Errorf("RTSOFF must never be relocated, got 0x%X", rtsoff)
+	}
 }
 
 func TestXhciClampRTSOFF_ZeroIntrs(t *testing.T) {
 	data := make([]byte, 4096)
 	util.WriteLE32(data, 0x18, 0x00000200)
-	intrs := xhciClampRTSOFF(data, 0x20, 0, 4096)
+	intrs := xhciClampRTSOFF(data, 0, 4096)
 	if intrs < 1 {
 		t.Errorf("zero intrs should clamp to >= 1, got %d", intrs)
 	}
diff --git a/internal/firmware/scrub/quirks.go b/internal/firmware/scrub/quirks.go
index 293ac09..efbaf5c 100644
--- a/internal/firmware/scrub/quirks.go
+++ b/internal/firmware/scrub/quirks.go
@@ -21,6 +21,21 @@ var vendorQuirks = []vendorQuirk{
 		Name:      "Renesas xHCI FW status",
 		Apply:     fixRenesasFirmwareStatus,
 	},
+	// ponytail: KNOWN_ISSUES also names ASMedia (0x1B21, e.g. ASM1042A/ASM3142)
+	// and VIA (0x1106, e.g. VL805/VL806) as xHCI Code-10 offenders, but neither
+	// gets an entry here. Checked upstream drivers/usb/host/xhci-pci.c and
+	// pci-quirks.c: every real quirk for both vendors (XHCI_NO_64BIT_SUPPORT,
+	// XHCI_RESET_ON_RESUME, XHCI_ASMEDIA_MODIFY_FLOWCONTROL, XHCI_LPM_SUPPORT,
+	// XHCI_TRB_OVERFETCH, ...) is a driver-side runtime behavior flag with no
+	// PCI config-space counterpart - unlike Renesas's FW-status bits, there is no
+	// static "mark as done" register to poke. The one thing ASMedia does do in
+	// config space (usb_asmedia_modifyflowcontrol, regs 0xE0/0xF8/0xFC) is a live
+	// read-poll-write mailbox to real silicon that a static overlay write can't
+	// reproduce, and it fixes Ethernet-over-USB flow control, not enumeration -
+	// unrelated to Code 10. VIA VL805's only known FW handshake is an out-of-band
+	// SPI/SoC-mailbox load (Raspberry Pi's rpi_firmware_init_vl805), nothing in
+	// PCI config space either. No grounded register write found for either
+	// vendor - add one here if a real config-space fixup ever surfaces.
 	// add new vendors here
 }
 
diff --git a/internal/firmware/svgen/generator.go b/internal/firmware/svgen/generator.go
index 759e442..ffeb1c1 100644
--- a/internal/firmware/svgen/generator.go
+++ b/internal/firmware/svgen/generator.go
@@ -36,6 +36,12 @@ type SVGeneratorConfig struct {
 	NVMeDoorbellStride uint32             // CAP.DSTRD - doorbell stride (0 = 4B, default)
 	Bar0Size           int
 	ILAInstanceSV      string
+	// ExtraBARPresent flags donor BAR3-6 presence: index 0=BAR3 ... 3=BAR6.
+	// true = donor's real hardware has a populated (nonzero-size) BAR there,
+	// so bar_controller.sv.tmpl presents a real (loopaddr) aperture instead
+	// of pcileech_bar_impl_none. Zero value (all false) preserves the old
+	// always-none behavior.
+	ExtraBARPresent [4]bool
 }
 
 // DonorCapabilities summarizes parsed capabilities from donor config space.
@@ -139,6 +145,12 @@ func GenerateNVMeDMABridgeSV(cfg *SVGeneratorConfig) (string, error) {
 	return renderTemplate("nvme_dma_bridge", cfg)
 }
 
+// GenerateXHCIRingEngineSV renders the xHCI Command/Event ring engine and its
+// DMA bridge (both modules live in the same template file).
+func GenerateXHCIRingEngineSV(cfg *SVGeneratorConfig) (string, error) {
+	return renderTemplate("xhci_ring_engine", cfg)
+}
+
 // GenerateHDARIRBDMASV renders the HDA RIRB DMA bridge module.
 func GenerateHDARIRBDMASV(cfg *SVGeneratorConfig) (string, error) {
 	return renderTemplate("hda_rirb_dma", cfg)
@@ -161,6 +173,7 @@ func svFuncMap() template.FuncMap {
 		"hex04":         func(v uint16) string { return fmt.Sprintf("%04X", v) },
 		"hex02":         func(v uint8) string { return fmt.Sprintf("%02X", v) },
 		"sub":           func(a, b int) int { return a - b },
+		"add":           func(a, b int) int { return a + b },
 		"mul":           func(a, b int) int { return a * b },
 		"alignedOffset": func(off uint32) uint32 { return (off / 4) * 4 },
 		"classBase":     func(cc uint32) uint8 { return uint8((cc >> 16) & 0xFF) },
diff --git a/internal/firmware/svgen/nvme_responder_test.go b/internal/firmware/svgen/nvme_responder_test.go
index 33e46f7..3ffdc48 100644
--- a/internal/firmware/svgen/nvme_responder_test.go
+++ b/internal/firmware/svgen/nvme_responder_test.go
@@ -37,8 +37,10 @@ func TestGenerateNVMeResponderSV_HandlesFormattingIOQueuePath(t *testing.T) {
 		"iosq_base",
 		"iocq_base",
 		"8'h80: begin",
-		"8'h00, 8'h01, 8'h08, 8'h09: begin",
+		"8'h00, 8'h08, 8'h09: begin",
 		"S_EXEC_READ_ZERO",
+		"S_EXEC_WRITE_STORE",
+		"nvme_store[io_store_addr]",
 	} {
 		if !strings.Contains(result, want) {
 			t.Fatalf("NVMe responder should contain %q", want)
diff --git a/internal/firmware/svgen/svgen_test.go b/internal/firmware/svgen/svgen_test.go
index 0e66ec9..bc558aa 100644
--- a/internal/firmware/svgen/svgen_test.go
+++ b/internal/firmware/svgen/svgen_test.go
@@ -1,6 +1,7 @@
 package svgen
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 
@@ -92,6 +93,49 @@ func TestGenerateBarControllerSV(t *testing.T) {
 	}
 }
 
+func TestGenerateBarControllerSV_ExtraBARs(t *testing.T) {
+	cfg := testConfig()
+	cfg.LatencyConfig = DefaultLatencyConfig(cfg.ClassCode)
+	cfg.ExtraBARPresent = [4]bool{true, false, true, false} // BAR3, BAR4, BAR5, BAR6
+	result, err := GenerateBarControllerSV(cfg)
+	if err != nil {
+		t.Fatalf("GenerateBarControllerSV failed: %v", err)
+	}
+	if !strings.Contains(result, "pcileech_bar_impl_loopaddr i_bar3(") {
+		t.Error("populated donor BAR3 should get a real loopaddr aperture")
+	}
+	if !strings.Contains(result, "pcileech_bar_impl_none i_bar4_none(") {
+		t.Error("absent donor BAR4 should stay unimplemented")
+	}
+	if !strings.Contains(result, "pcileech_bar_impl_loopaddr i_bar5(") {
+		t.Error("populated donor BAR5 should get a real loopaddr aperture")
+	}
+	if !strings.Contains(result, "pcileech_bar_impl_none i_bar6_none(") {
+		t.Error("absent donor BAR6 should stay unimplemented")
+	}
+}
+
+func TestGenerateBarControllerSV_NoExtraBARs(t *testing.T) {
+	cfg := testConfig()
+	cfg.LatencyConfig = DefaultLatencyConfig(cfg.ClassCode)
+	// zero-value ExtraBARs: no donor BAR3-6 populated, matches prior behavior.
+	result, err := GenerateBarControllerSV(cfg)
+	if err != nil {
+		t.Fatalf("GenerateBarControllerSV failed: %v", err)
+	}
+	if strings.Contains(result, "pcileech_bar_impl_loopaddr i_bar3(") ||
+		strings.Contains(result, "pcileech_bar_impl_loopaddr i_bar4(") ||
+		strings.Contains(result, "pcileech_bar_impl_loopaddr i_bar5(") ||
+		strings.Contains(result, "pcileech_bar_impl_loopaddr i_bar6(") {
+		t.Error("no donor BAR3-6 populated: should not instantiate any real apertures")
+	}
+	for i := 3; i <= 6; i++ {
+		if !strings.Contains(result, fmt.Sprintf("pcileech_bar_impl_none i_bar%d_none(", i)) {
+			t.Errorf("BAR%d should stay unimplemented when absent from donor", i)
+		}
+	}
+}
+
 func TestGenerateLatencyEmulatorSV(t *testing.T) {
 	cfg := testConfig()
 	cfg.LatencyConfig = DefaultLatencyConfig(cfg.ClassCode)
diff --git a/internal/firmware/svgen/templates/bar_controller.sv.tmpl b/internal/firmware/svgen/templates/bar_controller.sv.tmpl
index d1157b1..1ac9609 100644
--- a/internal/firmware/svgen/templates/bar_controller.sv.tmpl
+++ b/internal/firmware/svgen/templates/bar_controller.sv.tmpl
@@ -306,6 +306,16 @@ module pcileech_tlps128_bar_controller(
     wire [31:0] nvme_reg_csts;
 {{ end }}
 
+{{ if and (eq .DeviceClass "xhci") .BARModel }}
+    // xHCI register wires -- from bar_impl_device to the ring engine
+    wire [31:0] xhci_reg_crcr_lo;
+    wire [31:0] xhci_reg_crcr_hi;
+    wire [31:0] xhci_reg_erstba_lo;
+    wire [31:0] xhci_reg_erstba_hi;
+    wire        xhci_reg_iman_ie;
+    wire        xhci_cmd_complete_pulse;
+{{ end }}
+
 {{ if .BARModel }}
     pcileech_bar_impl_device #(
         .BAR_SIZE       ( {{ .BARModel.Size }} ) // var Bar0Size
@@ -357,6 +367,13 @@ module pcileech_tlps128_bar_controller(
         .msi_trigger     ( hda_msi_trigger               ),
         .rirbintsts      ( hda_rirbintsts                ),
         .crst_falling    ( hda_crst_falling              )
+{{ end }}{{ if and (eq .DeviceClass "xhci") .BARModel }}        ,
+        .xhci_crcr_lo      ( xhci_reg_crcr_lo          ),
+        .xhci_crcr_hi      ( xhci_reg_crcr_hi          ),
+        .xhci_erstba_lo    ( xhci_reg_erstba_lo        ),
+        .xhci_erstba_hi    ( xhci_reg_erstba_hi        ),
+        .xhci_iman_ie      ( xhci_reg_iman_ie          ),
+        .xhci_cmd_complete ( xhci_cmd_complete_pulse   )
 {{ end }}
     );
 
@@ -729,7 +746,119 @@ module pcileech_tlps128_bar_controller(
     assign tlps_rdeng.tready = tlps_out.tready && (dma_yield || !hda_tlp_tx_tvalid);
 {{ end }}{{ end }}
 
-{{ if not (or (and (eq .DeviceClass "nvme") .NVMeIdentify) (and (eq .DeviceClass "audio") .BARModel)) }}
+{{ if and (eq .DeviceClass "xhci") .BARModel }}
+    // ========================================================================
+    // xHCI Command Ring + Event Ring engine + DMA bridge
+    // - ring engine walks the Command Ring and answers with Command
+    //   Completion Events on the (single-segment) Event Ring
+    // - bridge turns those DMA ops into actual PCIe TLPs
+    // ========================================================================
+
+    // catch the Command doorbell (DB0, DBOFF fixed 0x100 per xhci.go)
+    wire xhci_cmd_db_wr = wr_valid && wr_bar[0] && (wr_addr_bar0 == 32'h00000100);
+
+    wire        xhci_dma_rd_req;
+    wire [63:0] xhci_dma_rd_addr;
+    wire [9:0]  xhci_dma_rd_len;
+    wire        xhci_dma_rd_valid;
+    wire [31:0] xhci_dma_rd_data;
+    wire        xhci_dma_rd_done;
+    wire        xhci_dma_wr_req;
+    wire [63:0] xhci_dma_wr_addr;
+    wire [31:0] xhci_dma_wr_data;
+    wire [3:0]  xhci_dma_wr_be;
+    wire        xhci_dma_wr_valid;
+    wire        xhci_dma_wr_done;
+    wire        xhci_msix_trigger;
+
+    wire [127:0] xhci_tlp_tx_tdata;
+    wire [3:0]   xhci_tlp_tx_tkeepdw;
+    wire         xhci_tlp_tx_tvalid;
+    wire         xhci_tlp_tx_tlast;
+    wire [8:0]   xhci_tlp_tx_tuser;
+    wire         xhci_tlp_tx_tready;
+
+    pcileech_xhci_ring_engine i_xhci_ring_engine(
+        .rst                 ( rst                        ),
+        .clk                 ( clk                        ),
+        .crcr_lo             ( xhci_reg_crcr_lo           ),
+        .crcr_hi             ( xhci_reg_crcr_hi           ),
+        .erstba_lo           ( xhci_reg_erstba_lo         ),
+        .erstba_hi           ( xhci_reg_erstba_hi         ),
+        .iman_ie             ( xhci_reg_iman_ie           ),
+        .cmd_doorbell_wr     ( xhci_cmd_db_wr             ),
+        .cmd_complete_pulse  ( xhci_cmd_complete_pulse    ),
+        .msix_trigger        ( xhci_msix_trigger          ),
+        .dma_rd_req          ( xhci_dma_rd_req            ),
+        .dma_rd_addr         ( xhci_dma_rd_addr           ),
+        .dma_rd_len          ( xhci_dma_rd_len            ),
+        .dma_rd_valid        ( xhci_dma_rd_valid          ),
+        .dma_rd_data         ( xhci_dma_rd_data           ),
+        .dma_rd_done         ( xhci_dma_rd_done           ),
+        .dma_wr_req          ( xhci_dma_wr_req            ),
+        .dma_wr_addr         ( xhci_dma_wr_addr           ),
+        .dma_wr_data         ( xhci_dma_wr_data           ),
+        .dma_wr_be           ( xhci_dma_wr_be             ),
+        .dma_wr_valid        ( xhci_dma_wr_valid          ),
+        .dma_wr_done         ( xhci_dma_wr_done           )
+    );
+
+    pcileech_xhci_dma_bridge i_xhci_dma_bridge(
+        .rst                ( rst                           ),
+        .clk                ( clk                           ),
+        .pcie_id            ( pcie_id                       ),
+        .dma_wr_req         ( xhci_dma_wr_req               ),
+        .dma_wr_addr        ( xhci_dma_wr_addr              ),
+        .dma_wr_data        ( xhci_dma_wr_data              ),
+        .dma_wr_be          ( xhci_dma_wr_be                ),
+        .dma_wr_valid       ( xhci_dma_wr_valid             ),
+        .dma_wr_done        ( xhci_dma_wr_done              ),
+        .dma_rd_req         ( xhci_dma_rd_req               ),
+        .dma_rd_addr        ( xhci_dma_rd_addr              ),
+        .dma_rd_len         ( xhci_dma_rd_len               ),
+        .dma_rd_valid       ( xhci_dma_rd_valid             ),
+        .dma_rd_data        ( xhci_dma_rd_data              ),
+        .dma_rd_done        ( xhci_dma_rd_done              ),
+        .tlp_tx_tdata       ( xhci_tlp_tx_tdata             ),
+        .tlp_tx_tkeepdw     ( xhci_tlp_tx_tkeepdw           ),
+        .tlp_tx_tvalid      ( xhci_tlp_tx_tvalid            ),
+        .tlp_tx_tlast       ( xhci_tlp_tx_tlast             ),
+        .tlp_tx_tuser       ( xhci_tlp_tx_tuser             ),
+        .tlp_tx_tready      ( xhci_tlp_tx_tready            ),
+        .tlp_rx_tdata       ( tlps_in.tdata                 ),
+        .tlp_rx_tkeepdw     ( tlps_in.tkeepdw               ),
+        .tlp_rx_tvalid      ( tlps_in.tvalid                ),
+        .tlp_rx_tuser       ( tlps_in.tuser                 )
+    );
+
+    // mux DMA bridge TLPs with rdengine BAR responses onto tlps_out
+    //
+    // fairness: after 8 consecutive DMA TLP words a 1-cycle gap is forced so
+    // BAR read completions cannot be starved by sustained DMA bursts
+    reg [2:0] xhci_dma_burst_cnt;
+    wire xhci_dma_yield = (xhci_dma_burst_cnt == 3'd7);
+    wire xhci_dma_tx    = xhci_tlp_tx_tvalid && tlps_out.tready && !xhci_dma_yield;
+    assign xhci_tlp_tx_tready = tlps_out.tready && !xhci_dma_yield;
+
+    always @(posedge clk) begin
+        if (xhci_dma_yield)
+            xhci_dma_burst_cnt <= 3'd0;
+        else if (xhci_dma_tx && xhci_dma_burst_cnt != 3'd7)
+            xhci_dma_burst_cnt <= xhci_dma_burst_cnt + 3'd1;
+        else if (!xhci_tlp_tx_tvalid)
+            xhci_dma_burst_cnt <= 3'd0;
+    end
+
+    assign tlps_out.tdata    = (xhci_tlp_tx_tvalid && !xhci_dma_yield) ? xhci_tlp_tx_tdata    : tlps_rdeng.tdata;
+    assign tlps_out.tkeepdw  = (xhci_tlp_tx_tvalid && !xhci_dma_yield) ? xhci_tlp_tx_tkeepdw  : tlps_rdeng.tkeepdw;
+    assign tlps_out.tvalid   = (xhci_tlp_tx_tvalid && !xhci_dma_yield) || tlps_rdeng.tvalid;
+    assign tlps_out.tlast    = (xhci_tlp_tx_tvalid && !xhci_dma_yield) ? xhci_tlp_tx_tlast    : tlps_rdeng.tlast;
+    assign tlps_out.tuser    = (xhci_tlp_tx_tvalid && !xhci_dma_yield) ? xhci_tlp_tx_tuser    : tlps_rdeng.tuser;
+    assign tlps_out.has_data = (xhci_tlp_tx_tvalid && !xhci_dma_yield) || tlps_rdeng.has_data;
+    assign tlps_rdeng.tready = tlps_out.tready && (xhci_dma_yield || !xhci_tlp_tx_tvalid);
+{{ end }}
+
+{{ if not (or (and (eq .DeviceClass "nvme") .NVMeIdentify) (and (eq .DeviceClass "audio") .BARModel) (and (eq .DeviceClass "xhci") .BARModel)) }}
     // no DMA bridge: rdengine output goes straight to tlps_out
     assign tlps_out.tdata    = tlps_rdeng.tdata;
     assign tlps_out.tkeepdw  = tlps_rdeng.tkeepdw;
@@ -775,27 +904,41 @@ module pcileech_tlps128_bar_controller(
         .intr_req       ( bar2_intr_req                 )
     );
 
-    // BAR3-6: unimplemented
-    genvar gi;
-    generate
-        for (gi = 3; gi < 7; gi = gi + 1) begin : gen_bar_none
-            pcileech_bar_impl_none i_bar_none(
-                .rst            ( rst                           ),
-                .clk            ( clk                           ),
-                .wr_addr        ( wr_addr                       ),
-                .wr_be          ( wr_be                         ),
-                .wr_data        ( wr_data                       ),
-                .wr_valid       ( wr_valid && wr_bar[gi]        ),
-                .rd_req_ctx     ( rd_req_ctx                    ),
-                .rd_req_addr    ( rd_req_addr                   ),
-                .rd_req_valid   ( rd_req_valid && rd_req_bar[gi]),
-                .rd_rsp_ctx     ( bar_rsp_ctx[gi]               ),
-                .rd_rsp_data    ( bar_rsp_data[gi]              ),
-                .rd_rsp_valid   ( bar_rsp_valid[gi]             )
-            );
-        end
-    endgenerate
+    // BAR3-6: real aperture (loopaddr stub, same as BAR1) for any index the
+    // donor's own BAR layout actually has populated, otherwise unimplemented
+    // (genuinely no BAR there on the real hardware).
+{{ range $i, $present := .ExtraBARPresent }}{{ $idx := add $i 3 }}{{ if $present }}
+    pcileech_bar_impl_loopaddr i_bar{{ $idx }}(
+        .rst            ( rst                              ),
+        .clk            ( clk                              ),
+        .wr_addr        ( wr_addr                          ),
+        .wr_be          ( wr_be                             ),
+        .wr_data        ( wr_data                           ),
+        .wr_valid       ( wr_valid && wr_bar[{{ $idx }}]         ),
+        .rd_req_ctx     ( rd_req_ctx                        ),
+        .rd_req_addr    ( rd_req_addr                       ),
+        .rd_req_valid   ( rd_req_valid && rd_req_bar[{{ $idx }}] ),
+        .rd_rsp_ctx     ( bar_rsp_ctx[{{ $idx }}]                ),
+        .rd_rsp_data    ( bar_rsp_data[{{ $idx }}]               ),
+        .rd_rsp_valid   ( bar_rsp_valid[{{ $idx }}]              )
+    );
+{{ else }}
+    pcileech_bar_impl_none i_bar{{ $idx }}_none(
+        .rst            ( rst                              ),
+        .clk            ( clk                              ),
+        .wr_addr        ( wr_addr                          ),
+        .wr_be          ( wr_be                             ),
+        .wr_data        ( wr_data                           ),
+        .wr_valid       ( wr_valid && wr_bar[{{ $idx }}]         ),
+        .rd_req_ctx     ( rd_req_ctx                        ),
+        .rd_req_addr    ( rd_req_addr                       ),
+        .rd_req_valid   ( rd_req_valid && rd_req_bar[{{ $idx }}] ),
+        .rd_rsp_ctx     ( bar_rsp_ctx[{{ $idx }}]                ),
+        .rd_rsp_data    ( bar_rsp_data[{{ $idx }}]               ),
+        .rd_rsp_valid   ( bar_rsp_valid[{{ $idx }}]              )
+    );
+{{ end }}{{ end }}
 
-    assign intr_req = bar2_intr_req{{ if eq .DeviceClass "audio" }} | hda_intr_req{{ end }}{{ if eq .DeviceClass "nvme" }} | nvme_msix_trigger{{ end }};
+    assign intr_req = bar2_intr_req{{ if eq .DeviceClass "audio" }} | hda_intr_req{{ end }}{{ if eq .DeviceClass "nvme" }} | nvme_msix_trigger{{ end }}{{ if eq .DeviceClass "xhci" }} | xhci_msix_trigger{{ end }};
 {{ .ILAInstanceSV }}
 endmodule
diff --git a/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl b/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl
index 3dccd43..07c4760 100644
--- a/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl
+++ b/internal/firmware/svgen/templates/bar_impl_device.sv.tmpl
@@ -50,6 +50,14 @@ module pcileech_bar_impl_device #(
     output wire [31:0]  nvme_acq_lo,
     output wire [31:0]  nvme_acq_hi,
     output wire [31:0]  nvme_csts
+{{ end }}{{ if eq .DeviceClass "xhci" }}    ,
+    // xHCI register outputs for the ring engine + HW-set IMAN.IP input
+    output wire [31:0]  xhci_crcr_lo,
+    output wire [31:0]  xhci_crcr_hi,
+    output wire [31:0]  xhci_erstba_lo,
+    output wire [31:0]  xhci_erstba_hi,
+    output wire         xhci_iman_ie,
+    input               xhci_cmd_complete
 {{ end }});
 
     localparam [31:0] BAR_ADDR_MASK = BAR_SIZE - 1;
@@ -131,6 +139,7 @@ module pcileech_bar_impl_device #(
             rs_prev        <= 1'b0;
             reg_0x00000020 <= 32'h00000001;  // USBCMD: R/S=1 (running)
             reg_0x00000024 <= 32'h00000000;  // USBSTS: HCH=0 (not halted)
+            reg_0x00000220 <= 32'h00000000;  // IMAN: IP=0, IE=0
         end else begin
             rs_prev <= reg_0x00000020[0]; // USBCMD.R/S
 
@@ -163,8 +172,29 @@ module pcileech_bar_impl_device #(
             if (!reg_0x00000020[0] && rs_prev && !hcrst_pending) begin
                 reg_0x00000024[0] <= 1'b1;  // USBSTS.HCH = 1
             end
+
+            // IMAN (0x220, RTSOFF+0x20 primary interrupter): bit0=IP
+            // (RW1C, HW-set by the ring engine on event post), bit1=IE (RW).
+            // IsFSMDriven because IP needs a HW-set path the generic W1C
+            // block (SW-clear only) can't provide.
+            if (wr_valid && (wr_addr[31:0] & 32'hFFFFFFFC) == 32'h00000220) begin
+                if (wr_be[0]) begin
+                    reg_0x00000220[1] <= wr_data[1];           // IE
+                    if (wr_data[0]) reg_0x00000220[0] <= 1'b0; // IP write-1-to-clear
+                end
+            end
+            if (xhci_cmd_complete)
+                reg_0x00000220[0] <= 1'b1; // IP set by the ring engine
         end
     end
+
+    // xHCI register output wiring — CRCR/ERSTBA are plain RW (not
+    // IsFSMDriven), the ring engine masks alignment/control bits itself.
+    assign xhci_crcr_lo   = reg_0x00000038;
+    assign xhci_crcr_hi   = reg_0x0000003C;
+    assign xhci_erstba_lo = reg_0x00000230;
+    assign xhci_erstba_hi = reg_0x00000234;
+    assign xhci_iman_ie   = reg_0x00000220[1];
 {{ end }}
 {{ if eq .DeviceClass "audio" }}
     // ========================================================================
diff --git a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
index f370435..2510c15 100644
--- a/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
+++ b/internal/firmware/svgen/templates/nvme_admin_responder.sv.tmpl
@@ -14,7 +14,8 @@
 //   0x0A  Get Features  – number of queues, interrupt coalescing
 //   0x0C  AER           – queued silently, never completed (that's legal)
 //   0x80  Format NVM   – accept format requests
-//   IO Q1 Flush/Write/Read/Write Zeroes/Dataset Mgmt – minimal disk emulation
+//   IO Q1 Read/Write     – backed by a small BRAM sector cache (nvme_store)
+//   IO Q1 Flush/Write Zeroes/Dataset Mgmt – accepted, no data movement needed
 
 `timescale 1ns / 1ps
 
@@ -90,6 +91,7 @@ module pcileech_nvme_admin_responder(
     localparam [3:0] S_EXEC_LOGPAGE = 4'hA;
     localparam [3:0] S_SHUTDOWN     = 4'hB;
     localparam [3:0] S_EXEC_READ_ZERO = 4'hC;
+    localparam [3:0] S_EXEC_WRITE_STORE = 4'hD;
 
     reg [3:0]   state;
     reg [3:0]   return_state;       // where to go after DMA wait completes
@@ -144,6 +146,29 @@ module pcileech_nvme_admin_responder(
     reg [10:0]  io_zero_dw_limit;
     reg [12:0]  id_rom_offset;
 
+    // ---- IO backing store: small BRAM sector cache for IO Read/Write --------
+    // ponytail: NVME_STORE_NSECT x NVME_STORE_SECT_DW is a small fixed-size
+    // cache window (2KB), not a full-capacity disk backing store. LBAs beyond
+    // the window wrap (mod NVME_STORE_NSECT) instead of growing unbounded or
+    // corrupting an adjacent sector's data. Addressing scheme and NSECT=4
+    // scale match sim/nvme_store.sv + sim/ahci_engine.sv.
+    localparam NVME_STORE_NSECT   = 4;    // sectors cached
+    localparam NVME_STORE_SECT_DW = 128;  // dwords/sector (512B) - matches the
+                                           // block size io_zero_dw_limit already assumes
+    reg [31:0] nvme_store [0:(NVME_STORE_NSECT*NVME_STORE_SECT_DW)-1];
+    integer    nvme_store_init_idx;
+    initial begin
+        for (nvme_store_init_idx = 0; nvme_store_init_idx < NVME_STORE_NSECT*NVME_STORE_SECT_DW; nvme_store_init_idx = nvme_store_init_idx + 1)
+            nvme_store[nvme_store_init_idx] = 32'h00000000;
+    end
+
+    // current dword's address within the store: sector = starting LBA
+    // (cmd_cdw10, mod NSECT via truncation) + which 512B block of this
+    // multi-block transfer we're on; dw = offset within that block.
+    wire [1:0] io_store_sector = cmd_cdw10[1:0] + data_dw_cnt[10:7];
+    wire [6:0] io_store_dw     = data_dw_cnt[6:0];
+    wire [8:0] io_store_addr   = {io_store_sector, io_store_dw};
+
     // edge detect for CC.EN so we can do a clean shutdown
     reg         cc_en_prev;
 
@@ -274,7 +299,15 @@ module pcileech_nvme_admin_responder(
                                         io_zero_dw_limit <= ({8'h0, cmd_cdw12[2:0]} + 11'd1) << 7;
                                     state <= S_EXEC_READ_ZERO;
                                 end
-                                8'h00, 8'h01, 8'h08, 8'h09: begin
+                                8'h01: begin
+                                    data_dw_cnt <= 11'h0;
+                                    if (cmd_cdw12[15:0] >= 16'd7)
+                                        io_zero_dw_limit <= 11'd1024;
+                                    else
+                                        io_zero_dw_limit <= ({8'h0, cmd_cdw12[2:0]} + 11'd1) << 7;
+                                    state <= S_EXEC_WRITE_STORE;
+                                end
+                                8'h00, 8'h08, 8'h09: begin
                                     cqe[0] <= 32'h0;
                                     cqe[1] <= 32'h0;
                                     cqe[2] <= {cmd_cid, iosq_head};
@@ -537,12 +570,12 @@ module pcileech_nvme_admin_responder(
                         state <= S_WAIT_DMA_WR;
                     end
 
-                    // ---- IO read: return zeroed sectors for an empty disk ----
+                    // ---- IO read: stream sectors back from the BRAM store ----
                     S_EXEC_READ_ZERO: begin
                         dma_wr_req   <= 1'b1;
                         dma_wr_valid <= 1'b1;
                         dma_wr_addr  <= cmd_prp_addr({data_dw_cnt, 2'b00});
-                        dma_wr_data  <= 32'h00000000;
+                        dma_wr_data  <= nvme_store[io_store_addr];
                         dma_wr_be    <= 4'hF;
 
                         if (data_dw_cnt >= io_zero_dw_limit - 11'd1) begin
@@ -554,6 +587,29 @@ module pcileech_nvme_admin_responder(
                         state <= S_WAIT_DMA_WR;
                     end
 
+                    // ---- IO write: pull one DWORD from host into the store ---
+                    S_EXEC_WRITE_STORE: begin
+                        dma_rd_req  <= 1'b1;
+                        dma_rd_addr <= cmd_prp_addr({data_dw_cnt, 2'b00});
+                        dma_rd_len  <= 10'd1;
+                        state       <= S_WAIT_DMA_RD;
+                    end
+
+                    // ---- park here until the host DWORD comes back -----------
+                    S_WAIT_DMA_RD: begin
+                        if (dma_rd_valid)
+                            nvme_store[io_store_addr] <= dma_rd_data;
+
+                        if (dma_rd_done) begin
+                            if (data_dw_cnt >= io_zero_dw_limit - 11'd1) begin
+                                state <= S_WRITE_DATA;
+                            end else begin
+                                data_dw_cnt <= data_dw_cnt + 1'b1;
+                                state       <= S_EXEC_WRITE_STORE;
+                            end
+                        end
+                    end
+
                     // ---- all data has been sent, pack a success CQE ---------
                     S_WRITE_DATA: begin
                         cqe[0] <= 32'h0;
diff --git a/internal/firmware/svgen/templates/xhci_ring_engine.sv.tmpl b/internal/firmware/svgen/templates/xhci_ring_engine.sv.tmpl
new file mode 100644
index 0000000..f7f6c8e
--- /dev/null
+++ b/internal/firmware/svgen/templates/xhci_ring_engine.sv.tmpl
@@ -0,0 +1,539 @@
+//
+// xHCI Command Ring + Event Ring engine
+// {{ hex04 .DeviceIDs.VendorID }}:{{ hex04 .DeviceIDs.DeviceID }}
+//
+// This sits behind the BAR controller and answers whatever xhci.sys throws
+// at the Command Ring during controller init. PORTSC1/PORTSC2 report
+// "powered, no device attached" (see xhci.go's xhciProfile) -- there is no
+// downstream USB device to enumerate, so this emulates the HOST CONTROLLER
+// surviving its own init handshake, not a device's GET_DESCRIPTOR dance.
+// Same philosophy as pcileech_nvme_admin_responder: it doesn't pretend to
+// be a full xHC, it just needs the driver to get past init.
+//
+//   No-Op Command (type 23)          -> Command Completion Event, success
+//   Enable Slot Command (type 9)     -> success, Slot ID = FIXED_SLOT_ID
+//   anything else                    -> success anyway, echoing the TRB's
+//                                        own Slot ID field (bits[31:24] of
+//                                        DW3) so a command never just hangs
+//   Link TRB (type 6)                -> followed (with Toggle Cycle), not
+//                                        treated as a command
+//
+// Proven in sim/xhci_ring_engine.sv + sim/xhci_ring_engine_tb.sv (raw
+// register/memory-bus interface); this module is the same FSM adapted to
+// the DMA-bridge (TLP) convention used by pcileech_nvme_admin_responder +
+// pcileech_nvme_dma_bridge.
+//
+
+`timescale 1ns / 1ps
+
+module pcileech_xhci_ring_engine #(
+    parameter [7:0] FIXED_SLOT_ID = 8'h01
+    // ponytail: single fixed Slot ID -- zero devices attached means at most
+    // one plausible in-flight Enable Slot Command, not a real free-list
+    // across HCSPARAMS1.MaxSlots.
+)(
+    input               rst,
+    input               clk,
+
+    // CRCR / ERSTBA — driver-programmed, plain RW registers read straight
+    // from bar_impl_device (not IsFSMDriven; see barmodel's buildXHCIBARModel).
+    input [31:0]        crcr_lo,
+    input [31:0]        crcr_hi,
+    input [31:0]        erstba_lo,
+    input [31:0]        erstba_hi,
+    input               iman_ie,        // IMAN.IE — gates the interrupt pulse
+
+    // Command doorbell pulse from the BAR write engine (DBOFF fixed 0x100,
+    // doorbell 0 = Command Ring, same detection style as NVMe's SQ/CQ doorbells).
+    input               cmd_doorbell_wr,
+
+    // pulse telling bar_impl_device to set IMAN.IP (bit0) — HW-set, SW W1C.
+    output reg          cmd_complete_pulse,
+    // one-cycle pulse to fire the MSI-X interrupt (routed like NVMe's msix_trigger).
+    output reg          msix_trigger,
+
+    // DMA read — fetch TRBs / the ERST entry from host memory
+    output reg          dma_rd_req,
+    output reg [63:0]   dma_rd_addr,
+    output reg [9:0]    dma_rd_len,
+    input               dma_rd_valid,
+    input [31:0]        dma_rd_data,
+    input               dma_rd_done,
+
+    // DMA write — post Command Completion Events back to the Event Ring
+    output reg          dma_wr_req,
+    output reg [63:0]   dma_wr_addr,
+    output reg [31:0]   dma_wr_data,
+    output reg [3:0]    dma_wr_be,
+    output reg          dma_wr_valid,
+    input               dma_wr_done
+);
+
+    localparam [5:0] TRB_LINK      = 6'd6;
+    localparam [5:0] TRB_ENSLOT    = 6'd9;
+    localparam [5:0] TRB_NOOP      = 6'd23;
+    localparam [5:0] TRB_CMD_EVENT = 6'd33;
+
+    localparam [3:0] S_IDLE        = 4'h0;
+    localparam [3:0] S_FETCH_ISSUE = 4'h1;
+    localparam [3:0] S_FETCH_WAIT  = 4'h2;
+    localparam [3:0] S_DECODE      = 4'h3;
+    localparam [3:0] S_ERST_ISSUE  = 4'h4;
+    localparam [3:0] S_ERST_WAIT   = 4'h5;
+    localparam [3:0] S_EVT_WRITE   = 4'h6;
+    localparam [3:0] S_WAIT_DMA_WR = 4'h7;
+    localparam [3:0] S_POST        = 4'h8;
+
+    reg [3:0]  state;
+    reg [3:0]  return_state;
+    reg [1:0]  dw_idx;
+
+    // command ring consumer state
+    reg        cr_started;
+    reg [63:0] crdp;
+    reg        ccs;
+
+    // event ring producer state
+    reg        erst_valid;
+    reg [63:0] erst_base;
+    reg [15:0] erst_size;
+    reg [15:0] evt_idx;
+    reg        ecs;
+    reg [31:0] erstba_lo_prev, erstba_hi_prev;
+
+    reg [31:0] trb0, trb1, trb2, trb3;
+    reg [63:0] cmd_trb_addr;
+    reg [7:0]  slot_id_out;
+
+    wire [63:0] evt_addr = erst_base + ({48'h0, evt_idx} << 4);
+
+    always @(posedge clk) begin
+        if (rst) begin
+            state <= S_IDLE;
+            dw_idx <= 2'h0;
+            cr_started <= 1'b0; crdp <= 64'h0; ccs <= 1'b1;
+            erst_valid <= 1'b0; erst_base <= 64'h0; erst_size <= 16'h0;
+            evt_idx <= 16'h0; ecs <= 1'b1;
+            erstba_lo_prev <= 32'h0; erstba_hi_prev <= 32'h0;
+            dma_rd_req <= 1'b0; dma_wr_req <= 1'b0; dma_wr_valid <= 1'b0;
+            cmd_complete_pulse <= 1'b0; msix_trigger <= 1'b0;
+        end else begin
+            dma_rd_req <= 1'b0; dma_wr_req <= 1'b0; dma_wr_valid <= 1'b0;
+            cmd_complete_pulse <= 1'b0; msix_trigger <= 1'b0;
+
+            // driver reprogrammed the Event Ring Segment Table -- refetch
+            // the (single) segment descriptor before posting the next event.
+            erstba_lo_prev <= erstba_lo;
+            erstba_hi_prev <= erstba_hi;
+            if ((erstba_lo != erstba_lo_prev) || (erstba_hi != erstba_hi_prev))
+                erst_valid <= 1'b0;
+
+            case (state)
+                // ---- wait for a Command doorbell ring ------------------
+                S_IDLE: if (cmd_doorbell_wr) begin
+                    if (!cr_started) begin
+                        crdp       <= {crcr_hi, crcr_lo[31:6], 6'b0};
+                        ccs        <= crcr_lo[0];
+                        cr_started <= 1'b1;
+                    end
+                    state <= S_FETCH_ISSUE;
+                end
+
+                // ---- pull 16 bytes (one TRB) from the command ring -----
+                S_FETCH_ISSUE: begin
+                    dma_rd_req  <= 1'b1;
+                    dma_rd_addr <= crdp;
+                    dma_rd_len  <= 10'd4;
+                    dw_idx      <= 2'h0;
+                    state       <= S_FETCH_WAIT;
+                end
+                S_FETCH_WAIT: begin
+                    if (dma_rd_valid) begin
+                        case (dw_idx)
+                            2'd0: trb0 <= dma_rd_data;
+                            2'd1: trb1 <= dma_rd_data;
+                            2'd2: trb2 <= dma_rd_data;
+                            2'd3: trb3 <= dma_rd_data;
+                        endcase
+                        dw_idx <= dw_idx + 2'd1;
+                    end
+                    if (dma_rd_done)
+                        state <= S_DECODE;
+                end
+
+                // ---- ring caught up, follow Link, or execute a command -
+                S_DECODE: begin
+                    if (trb3[0] != ccs) begin
+                        // cycle bit doesn't match -- nothing new queued
+                        state <= S_IDLE;
+                    end else if (trb3[15:10] == TRB_LINK) begin
+                        crdp  <= {trb1, trb0} & 64'hFFFFFFFFFFFFFFF0;
+                        if (trb3[1]) ccs <= ~ccs; // Toggle Cycle
+                        state <= S_FETCH_ISSUE;
+                    end else begin
+                        cmd_trb_addr <= crdp;
+                        crdp         <= crdp + 64'd16;
+                        if (trb3[15:10] == TRB_NOOP)
+                            slot_id_out <= 8'h00;
+                        else if (trb3[15:10] == TRB_ENSLOT)
+                            slot_id_out <= FIXED_SLOT_ID;
+                        else
+                            slot_id_out <= trb3[31:24]; // everything else: echo, say yes
+                        state <= erst_valid ? S_EVT_WRITE : S_ERST_ISSUE;
+                        dw_idx <= 2'h0;
+                    end
+                end
+
+                // ---- fetch the (single) Event Ring Segment Table entry -
+                S_ERST_ISSUE: begin
+                    dma_rd_req  <= 1'b1;
+                    dma_rd_addr <= {erstba_hi, erstba_lo};
+                    dma_rd_len  <= 10'd4;
+                    dw_idx      <= 2'h0;
+                    state       <= S_ERST_WAIT;
+                end
+                S_ERST_WAIT: begin
+                    if (dma_rd_valid) begin
+                        case (dw_idx)
+                            2'd0: erst_base[31:0]  <= dma_rd_data;
+                            2'd1: erst_base[63:32] <= dma_rd_data;
+                            2'd2: erst_size        <= dma_rd_data[15:0];
+                            default: ;
+                        endcase
+                        dw_idx <= dw_idx + 2'd1;
+                    end
+                    if (dma_rd_done) begin
+                        erst_valid <= 1'b1;
+                        dw_idx     <= 2'h0;
+                        state      <= S_EVT_WRITE;
+                    end
+                end
+
+                // ---- write the 16-byte Command Completion Event --------
+                S_EVT_WRITE: begin
+                    dma_wr_req   <= 1'b1;
+                    dma_wr_valid <= 1'b1;
+                    dma_wr_be    <= 4'hF;
+                    dma_wr_addr  <= evt_addr + {60'h0, dw_idx, 2'b00};
+                    case (dw_idx)
+                        2'd0: dma_wr_data <= cmd_trb_addr[31:0];
+                        2'd1: dma_wr_data <= cmd_trb_addr[63:32];
+                        2'd2: dma_wr_data <= {8'h01, 24'h0}; // Completion Code = Success
+                        2'd3: dma_wr_data <= {slot_id_out, 8'h00, TRB_CMD_EVENT, 9'h0, ecs};
+                    endcase
+                    if (dw_idx == 2'd3) begin
+                        dw_idx       <= 2'h0;
+                        return_state <= S_POST;
+                    end else begin
+                        dw_idx       <= dw_idx + 2'd1;
+                        return_state <= S_EVT_WRITE;
+                    end
+                    state <= S_WAIT_DMA_WR;
+                end
+
+                // ---- park here until the DMA bridge says "done" --------
+                S_WAIT_DMA_WR: if (dma_wr_done)
+                    state <= return_state;
+
+                // ---- advance the event ring, raise the interrupt, loop -
+                S_POST: begin
+                    cmd_complete_pulse <= 1'b1;
+                    msix_trigger       <= iman_ie;
+                    if (evt_idx + 16'd1 >= erst_size) begin
+                        evt_idx <= 16'h0;
+                        ecs     <= ~ecs;
+                    end else begin
+                        evt_idx <= evt_idx + 16'd1;
+                    end
+                    state <= S_FETCH_ISSUE; // drain loop: check for more queued TRBs
+                end
+
+                default: state <= S_IDLE;
+            endcase
+        end
+    end
+endmodule
+
+//
+// xHCI DMA Bridge
+// {{ hex04 .DeviceIDs.VendorID }}:{{ hex04 .DeviceIDs.DeviceID }}
+//
+// Identical TLP-wrapping logic to pcileech_nvme_dma_bridge (it is genuinely
+// device-agnostic: plain address/data/len in, MWr/MRd TLPs out) -- copied
+// rather than shared because the writer/generator plumbing that emits
+// pcileech_nvme_dma_bridge.sv only does so for NVMe builds today. Renamed
+// so both bridges can coexist if that plumbing is later unified.
+//
+// ponytail: byte-identical to pcileech_nvme_dma_bridge -- known duplicate,
+// share it in a future pass, not now (deduping touches the well-tested NVMe path).
+//
+
+module pcileech_xhci_dma_bridge(
+    input               rst,
+    input               clk,
+
+    input [15:0]        pcie_id,        // our BDF, goes into requester ID
+
+    // write side – from the ring engine
+    input               dma_wr_req,
+    input [63:0]        dma_wr_addr,
+    input [31:0]        dma_wr_data,
+    input [3:0]         dma_wr_be,
+    input               dma_wr_valid,
+    output reg          dma_wr_done,
+
+    // read side – from the ring engine
+    input               dma_rd_req,
+    input [63:0]        dma_rd_addr,
+    input [9:0]         dma_rd_len,
+    output reg          dma_rd_valid,
+    output reg [31:0]   dma_rd_data,
+    output reg          dma_rd_done,
+
+    // outgoing TLP stream – gets muxed with bar controller responses
+    output reg [127:0]  tlp_tx_tdata,
+    output reg [3:0]    tlp_tx_tkeepdw,
+    output reg          tlp_tx_tvalid,
+    output reg          tlp_tx_tlast,
+    output reg [8:0]    tlp_tx_tuser,
+    input               tlp_tx_tready,    // backpressure from tlps_out mux
+
+    // incoming TLP snoop – we peek at this to catch CplD
+    input [127:0]       tlp_rx_tdata,
+    input [3:0]         tlp_rx_tkeepdw,
+    input               tlp_rx_tvalid,
+    input [8:0]         tlp_rx_tuser
+);
+
+    localparam [3:0] B_IDLE        = 4'h0;
+    localparam [3:0] B_WR_TLP      = 4'h1;  // present write beat 1, hold until tready
+    localparam [3:0] B_WR_DONE     = 4'h2;
+    localparam [3:0] B_RD_TLP      = 4'h3;  // present read request, hold until tready
+    localparam [3:0] B_RD_WAIT     = 4'h4;
+    localparam [3:0] B_RD_HDR      = 4'h5;  // first CplD beat: extract 1 payload DW
+    localparam [3:0] B_RD_DRAIN    = 4'h6;  // subsequent beats: extract up to 4 DW each
+    localparam [3:0] B_RD_EMIT     = 4'h7;  // emit buffered DWORDs one at a time
+    localparam [3:0] B_WR_TLP2     = 4'h8;  // 64-bit MWr second beat
+
+    reg [3:0]  bstate;
+
+    reg [9:0]  rd_remaining;        // how many DWORDs we're still expecting
+    reg [7:0]  rd_tag;              // tags start at 0x80 to stay off host tags
+
+    // 64-bit address detection
+    wire wr_is_64bit = |dma_wr_addr[63:32];
+    wire rd_is_64bit = |dma_rd_addr[63:32];
+
+    // CplD receive buffer: hold up to 4 DWORDs from one 128-bit beat
+    reg [31:0] rx_buf [0:3];
+    reg [2:0]  rx_buf_cnt;          // how many DWORDs in buffer (0-4)
+    reg [1:0]  rx_buf_idx;          // current emit index
+
+    always @(posedge clk) begin
+        if (rst) begin
+            bstate          <= B_IDLE;
+            dma_wr_done     <= 1'b0;
+            dma_rd_valid    <= 1'b0;
+            dma_rd_done     <= 1'b0;
+            dma_rd_data     <= 32'h0;
+            tlp_tx_tvalid   <= 1'b0;
+            tlp_tx_tlast    <= 1'b0;
+            rd_remaining    <= 10'h0;
+            rd_tag          <= 8'h80;
+            rx_buf_cnt      <= 3'h0;
+            rx_buf_idx      <= 2'h0;
+        end else begin
+            dma_wr_done   <= 1'b0;
+            dma_rd_valid  <= 1'b0;
+            dma_rd_done   <= 1'b0;
+            tlp_tx_tvalid <= 1'b0;
+            tlp_tx_tlast  <= 1'b0;
+
+            case (bstate)
+
+                // ---- idle: writes take priority --------------------------------
+                // (dma_wr_addr/data/be and dma_rd_addr/len are held stable by the
+                // ring engine until we signal done, so we only need to remember
+                // *which* transfer this is -- B_WR_TLP/B_RD_TLP re-derive the TLP
+                // from those still-live inputs every cycle they're held.)
+                B_IDLE: begin
+                    if (dma_wr_valid) begin
+                        bstate <= B_WR_TLP;
+                    end else if (dma_rd_req) begin
+                        bstate <= B_RD_TLP;
+                    end
+                end
+
+                // ---- present write beat 1: hold until tlps_out mux accepts ----
+                B_WR_TLP: begin
+                    if (wr_is_64bit) begin
+                        // 4DW header MWr: first beat = header only
+                        tlp_tx_tdata[31:0]   <= {
+                            3'b011,             // Fmt = 4DW w/ data
+                            5'b00000,           // Type = MWr
+                            1'b0, 3'b000,
+                            4'b0000,
+                            1'b0, 1'b0,
+                            2'b00, 2'b00,
+                            10'h001
+                        };
+                        tlp_tx_tdata[63:32]  <= {pcie_id, 8'h00, 4'hF, dma_wr_be};
+                        tlp_tx_tdata[95:64]  <= dma_wr_addr[63:32];
+                        tlp_tx_tdata[127:96] <= {dma_wr_addr[31:2], 2'b00};
+
+                        tlp_tx_tkeepdw <= 4'b1111;
+                        tlp_tx_tlast   <= 1'b0;
+                        tlp_tx_tuser   <= {8'h00, 1'b1};
+                        tlp_tx_tvalid  <= 1'b1;
+
+                        if (tlp_tx_tready)
+                            bstate <= B_WR_TLP2;
+                    end else begin
+                        // 3DW header MWr: header + payload in one beat
+                        tlp_tx_tdata[31:0]   <= {
+                            3'b010,             // Fmt = 3DW w/ data
+                            5'b00000,           // Type = MWr
+                            1'b0, 3'b000,
+                            4'b0000,
+                            1'b0, 1'b0,
+                            2'b00, 2'b00,
+                            10'h001
+                        };
+                        tlp_tx_tdata[63:32]  <= {pcie_id, 8'h00, 4'hF, dma_wr_be};
+                        tlp_tx_tdata[95:64]  <= {dma_wr_addr[31:2], 2'b00};
+                        tlp_tx_tdata[127:96] <= dma_wr_data;
+
+                        tlp_tx_tkeepdw <= 4'b1111;
+                        tlp_tx_tlast   <= 1'b1;
+                        tlp_tx_tuser   <= {8'h00, 1'b1};
+                        tlp_tx_tvalid  <= 1'b1;
+
+                        if (tlp_tx_tready)
+                            bstate <= B_WR_DONE;
+                    end
+                end
+
+                // ---- present read request: hold until tlps_out mux accepts ----
+                B_RD_TLP: begin
+                    if (rd_is_64bit) begin
+                        // 4DW header MRd
+                        tlp_tx_tdata[31:0]   <= {
+                            3'b001,             // Fmt = 4DW no data
+                            5'b00000,           // Type = MRd
+                            1'b0, 3'b000,
+                            4'b0000,
+                            1'b0, 1'b0,
+                            2'b00, 2'b00,
+                            dma_rd_len
+                        };
+                        tlp_tx_tdata[63:32]  <= {pcie_id, rd_tag, 4'hF, 4'hF};
+                        tlp_tx_tdata[95:64]  <= dma_rd_addr[63:32];
+                        tlp_tx_tdata[127:96] <= {dma_rd_addr[31:2], 2'b00};
+
+                        tlp_tx_tkeepdw <= 4'b1111;
+                    end else begin
+                        // 3DW header MRd
+                        tlp_tx_tdata[31:0]   <= {
+                            3'b000,             // Fmt = 3DW no data
+                            5'b00000,           // Type = MRd
+                            1'b0, 3'b000,
+                            4'b0000,
+                            1'b0, 1'b0,
+                            2'b00, 2'b00,
+                            dma_rd_len
+                        };
+                        tlp_tx_tdata[63:32]  <= {pcie_id, rd_tag, 4'hF, 4'hF};
+                        tlp_tx_tdata[95:64]  <= {dma_rd_addr[31:2], 2'b00};
+                        tlp_tx_tdata[127:96] <= 32'h0;
+
+                        tlp_tx_tkeepdw <= 4'b0111;
+                    end
+
+                    tlp_tx_tlast   <= 1'b1;
+                    tlp_tx_tuser   <= {8'h00, 1'b1};
+                    tlp_tx_tvalid  <= 1'b1;
+
+                    if (tlp_tx_tready) begin
+                        rd_remaining <= dma_rd_len;
+                        rd_tag       <= rd_tag + 1'b1;
+                        bstate       <= B_RD_WAIT;
+                    end
+                end
+
+                // ---- 64-bit MWr second beat: payload DWORD, hold until ready ---
+                B_WR_TLP2: begin
+                    tlp_tx_tdata[31:0]   <= dma_wr_data;
+                    tlp_tx_tdata[127:32] <= 96'h0;
+                    tlp_tx_tkeepdw <= 4'b0001;
+                    tlp_tx_tlast   <= 1'b1;
+                    tlp_tx_tuser   <= 9'h0;
+                    tlp_tx_tvalid  <= 1'b1;
+                    if (tlp_tx_tready)
+                        bstate <= B_WR_DONE;
+                end
+
+                // ---- write done, signal ring engine -----------------------
+                B_WR_DONE: begin
+                    dma_wr_done <= 1'b1;
+                    bstate      <= B_IDLE;
+                end
+
+                // ---- snoop RX bus for CplD matching our tag -------------------
+                B_RD_WAIT: begin
+                    if (tlp_rx_tvalid && tlp_rx_tuser[0]) begin
+                        // CplD fmt+type = 0100_1010 = 0x4A
+                        if (tlp_rx_tdata[31:24] == 8'h4A) begin
+                            if (tlp_rx_tdata[79:72] == (rd_tag - 8'h01)) begin
+                                // first CplD beat: 3DW header occupies [95:0],
+                                // payload starts at [127:96] = 1 DWORD
+                                rx_buf[0]  <= tlp_rx_tdata[127:96];
+                                rx_buf_cnt <= 3'd1;
+                                rx_buf_idx <= 2'd0;
+                                bstate     <= B_RD_EMIT;
+                            end
+                        end
+                    end
+                end
+
+                // ---- emit buffered DWORDs one per cycle to ring engine ----
+                B_RD_EMIT: begin
+                    dma_rd_data  <= rx_buf[rx_buf_idx];
+                    dma_rd_valid <= 1'b1;
+                    rd_remaining <= rd_remaining - 10'd1;
+
+                    if (rd_remaining <= 10'd1) begin
+                        dma_rd_done <= 1'b1;
+                        bstate      <= B_IDLE;
+                    end else if (rx_buf_cnt == 3'd0 || {1'b0, rx_buf_idx} >= (rx_buf_cnt - 3'd1)) begin
+                        // buffer emptied (or was never filled), need more data from bus
+                        bstate <= B_RD_DRAIN;
+                    end else begin
+                        rx_buf_idx <= rx_buf_idx + 2'd1;
+                    end
+                end
+
+                // ---- subsequent CplD beats: 4 payload DWORDs per beat ---------
+                B_RD_DRAIN: begin
+                    if (tlp_rx_tvalid) begin
+                        rx_buf[0]  <= tlp_rx_tdata[31:0];
+                        rx_buf[1]  <= tlp_rx_tdata[63:32];
+                        rx_buf[2]  <= tlp_rx_tdata[95:64];
+                        rx_buf[3]  <= tlp_rx_tdata[127:96];
+
+                        // figure out how many valid DWORDs in this beat
+                        if (rd_remaining >= 10'd4)
+                            rx_buf_cnt <= 3'd4;
+                        else
+                            rx_buf_cnt <= rd_remaining[2:0];
+
+                        rx_buf_idx <= 2'd0;
+                        bstate     <= B_RD_EMIT;
+                    end
+                end
+
+                default: bstate <= B_IDLE;
+            endcase
+        end
+    end
+
+endmodule
diff --git a/sim/README.md b/sim/README.md
index 55a57e2..980e521 100644
--- a/sim/README.md
+++ b/sim/README.md
@@ -24,6 +24,7 @@ red path is verified (a wrong DUT makes the testbench report `FAIL`).
 | `msix_pba.sv` | MSI-X PBA was a static zero array; pending bits now set on masked requests and deliver on unmask. |
 | `nvme_store.sv` | NVMe IO reads returned zeros and writes were discarded (Event 11); this is the BRAM sector cache the responder writes through. |
 | `ahci_engine.sv` | SATA/AHCI had no command engine — PxCI never cleared, so storahci times out (Code 10 "I/O adapter hardware error"). Implements the slot-0 command FSM: IDENTIFY + READ/WRITE DMA over a sector store, D2H FIS, PxIS/intr, PxCI clear. |
+| `xhci_ring_engine.sv` | xHCI had no Command/Event Ring engine, so usbxhci.sys hangs waiting for command completions. Implements the Command Ring walk (CRCR-latched dequeue pointer, Link TRB following, cycle-bit consumer state) answering No-Op Command (type 23) and Enable Slot Command (type 9) — plus a generic success fallback for anything else — with Command Completion Events (type 33) posted through the single-segment Event Ring (ERST fetch, producer cycle state), IMAN.IP/interrupt. |
 
 ## Integrating into firmware
 
diff --git a/sim/xhci_ring_engine.sv b/sim/xhci_ring_engine.sv
new file mode 100644
index 0000000..7fd9111
--- /dev/null
+++ b/sim/xhci_ring_engine.sv
@@ -0,0 +1,241 @@
+`default_nettype none
+// xHCI Command Ring + Event Ring engine.
+//
+// Emulates the HOST CONTROLLER side of the xHCI init handshake with
+// xhci.sys -- there is no downstream USB device attached (PORTSC CCS=0 on
+// both ports, see xhci.go's xhciProfile), so this does not pretend to
+// enumerate a real device. It only has to:
+//   - latch the Command Ring pointer + cycle state from CRCR on the first
+//     doorbell ring (CRCR is only consumed once, while the ring is stopped)
+//   - walk the ring on each Command doorbell (DB0) write, following Link
+//     TRBs (type 6) and consuming every TRB whose cycle bit matches the
+//     ring's current consumer cycle state, until it catches up (cycle
+//     mismatch = ring drained)
+//   - answer No-Op Command (type 23) and Enable Slot Command (type 9) with
+//     a Command Completion Event (type 33), and fall back to a generic
+//     Success completion (echoing the TRB's own Slot ID field) for anything
+//     else so a command never just hangs the driver
+//   - post events through the one-segment Event Ring described by the ERST
+//     entry at ERSTBA (fetched lazily, invalidated whenever ERSTBA is
+//     rewritten), tracking its own enqueue index + producer cycle state
+//   - set IMAN.IP and pulse an interrupt (gated on IMAN.IE) per completion
+//
+// ponytail: single fixed Slot ID (FIXED_SLOT_ID) for Enable Slot Command --
+// with zero devices attached there is at most one plausible slot in flight,
+// not a real free-list across HCSPARAMS1.MaxSlots. ERDP.EHB and CRCR.CRR
+// are not modeled: neither is polled during a no-device init handshake,
+// only real-hardware backpressure/abort bookkeeping the driver doesn't need
+// to see here.
+module xhci_ring_engine #(
+    parameter [7:0] FIXED_SLOT_ID = 8'h01
+)(
+    input  wire        clk,
+    input  wire        rst_n,
+
+    input  wire        reg_wr,
+    input  wire [11:0]  reg_addr,
+    input  wire [31:0]  reg_wdata,
+    input  wire [11:0]  reg_raddr,
+    output reg  [31:0]  reg_rdata,
+
+    output reg          mem_rd,
+    output reg  [31:0]  mem_addr,
+    input  wire [31:0]  mem_rdata,
+    input  wire         mem_rvalid,
+    output reg          mem_wr,
+    output reg  [31:0]  mem_waddr,
+    output reg  [31:0]  mem_wdata,
+
+    output reg          intr
+);
+    localparam [11:0] A_DB0         = 12'h100; // Command doorbell (DBOFF fixed 0x100)
+    localparam [11:0] A_CRCR_LO     = 12'h038;
+    localparam [11:0] A_CRCR_HI     = 12'h03C;
+    localparam [11:0] A_ERSTBA_LO   = 12'h230; // RTSOFF(0x200) + IR0 ERSTBA (0x30)
+    localparam [11:0] A_ERSTBA_HI   = 12'h234;
+    localparam [11:0] A_IMAN        = 12'h220; // RTSOFF(0x200) + IR0 IMAN (0x00... +0x20 IR0 base)
+
+    localparam [5:0] TRB_LINK       = 6'd6;
+    localparam [5:0] TRB_ENSLOT     = 6'd9;
+    localparam [5:0] TRB_NOOP       = 6'd23;
+    localparam [5:0] TRB_CMD_EVENT  = 6'd33;
+
+    localparam [3:0] S_IDLE   = 4'h0;
+    localparam [3:0] S_FETCH  = 4'h1;
+    localparam [3:0] S_FETCHW = 4'h2;
+    localparam [3:0] S_DECODE = 4'h3;
+    localparam [3:0] S_ERST   = 4'h4;
+    localparam [3:0] S_ERSTW  = 4'h5;
+    localparam [3:0] S_EVT    = 4'h6;
+    localparam [3:0] S_POST   = 4'h7;
+
+    // driver-programmed registers
+    reg [31:0] crcr_lo, crcr_hi;
+    reg [31:0] erstba_lo, erstba_hi;
+    reg [1:0]  iman; // bit0=IP (RW1C, HW-set), bit1=IE (RW)
+
+    // command ring consumer state
+    reg        cr_started;
+    reg [31:0] crdp;    // command ring dequeue pointer (32-bit: sim host address space)
+    reg        ccs;     // consumer cycle state
+
+    // event ring producer state
+    reg        erst_valid;
+    reg [31:0] erst_base;
+    reg [15:0] erst_size;
+    reg [15:0] evt_idx;
+    reg        ecs;     // producer cycle state (starts at 1 per spec)
+
+    reg [3:0]  state;
+    reg [1:0]  cnt;
+    reg [31:0] trb0, trb1, trb2, trb3;
+    reg [31:0] cmd_trb_addr;
+    reg [7:0]  slot_id_out;
+
+    wire [31:0] evt_addr = erst_base + {16'h0, evt_idx, 4'b0};
+
+    always @(*) begin
+        case (reg_raddr)
+            A_CRCR_LO:   reg_rdata = crcr_lo;
+            A_CRCR_HI:   reg_rdata = crcr_hi;
+            A_ERSTBA_LO: reg_rdata = erstba_lo;
+            A_ERSTBA_HI: reg_rdata = erstba_hi;
+            A_IMAN:      reg_rdata = {30'h0, iman};
+            default:     reg_rdata = 32'h0;
+        endcase
+    end
+
+    always @(posedge clk) begin
+        if (!rst_n) begin
+            crcr_lo <= 32'h0; crcr_hi <= 32'h0;
+            erstba_lo <= 32'h0; erstba_hi <= 32'h0;
+            iman <= 2'b00;
+            cr_started <= 1'b0; crdp <= 32'h0; ccs <= 1'b1;
+            erst_valid <= 1'b0; erst_base <= 32'h0; erst_size <= 16'h0;
+            evt_idx <= 16'h0; ecs <= 1'b1;
+            state <= S_IDLE; cnt <= 2'h0;
+            mem_rd <= 1'b0; mem_wr <= 1'b0; intr <= 1'b0;
+        end else begin
+            mem_rd <= 1'b0; mem_wr <= 1'b0; intr <= 1'b0;
+
+            if (reg_wr) case (reg_addr)
+                A_CRCR_LO: if (!cr_started) crcr_lo <= reg_wdata & 32'hFFFFFFC7;
+                A_CRCR_HI: if (!cr_started) crcr_hi <= reg_wdata;
+                A_ERSTBA_LO: begin erstba_lo <= reg_wdata & 32'hFFFFFFF0; erst_valid <= 1'b0; end
+                A_ERSTBA_HI: begin erstba_hi <= reg_wdata; erst_valid <= 1'b0; end
+                A_IMAN: begin
+                    iman[1] <= reg_wdata[1];          // IE, plain RW
+                    if (reg_wdata[0]) iman[0] <= 1'b0; // IP, write-1-to-clear
+                end
+                default: ;
+            endcase
+
+            case (state)
+                // ---- wait for a Command doorbell ring ------------------
+                S_IDLE: if (reg_wr && reg_addr == A_DB0) begin
+                    if (!cr_started) begin
+                        crdp       <= {crcr_lo[31:6], 6'b0};
+                        ccs        <= crcr_lo[0];
+                        cr_started <= 1'b1;
+                    end
+                    cnt   <= 2'h0;
+                    state <= S_FETCH;
+                end
+
+                // ---- pull 16 bytes (one TRB) from the command ring -----
+                S_FETCH: begin
+                    mem_rd  <= 1'b1;
+                    mem_addr <= crdp + {28'h0, cnt, 2'b00};
+                    state   <= S_FETCHW;
+                end
+                S_FETCHW: if (mem_rvalid) begin
+                    case (cnt)
+                        2'd0: trb0 <= mem_rdata;
+                        2'd1: trb1 <= mem_rdata;
+                        2'd2: trb2 <= mem_rdata;
+                        2'd3: trb3 <= mem_rdata;
+                    endcase
+                    if (cnt == 2'd3) begin cnt <= 2'h0; state <= S_DECODE; end
+                    else begin cnt <= cnt + 2'd1; state <= S_FETCH; end
+                end
+
+                // ---- ring caught up, follow Link, or execute a command -
+                S_DECODE: begin
+                    if (trb3[0] != ccs) begin
+                        // cycle bit doesn't match -- nothing new queued
+                        state <= S_IDLE;
+                    end else if (trb3[15:10] == TRB_LINK) begin
+                        crdp  <= trb0 & 32'hFFFFFFF0;
+                        if (trb3[1]) ccs <= ~ccs; // Toggle Cycle
+                        cnt   <= 2'h0;
+                        state <= S_FETCH;
+                    end else begin
+                        cmd_trb_addr <= crdp;
+                        crdp         <= crdp + 32'd16;
+                        if (trb3[15:10] == TRB_NOOP)
+                            slot_id_out <= 8'h00;
+                        else if (trb3[15:10] == TRB_ENSLOT)
+                            slot_id_out <= FIXED_SLOT_ID;
+                        else
+                            slot_id_out <= trb3[31:24]; // everything else: echo, say yes
+                        cnt   <= 2'h0;
+                        state <= erst_valid ? S_EVT : S_ERST;
+                    end
+                end
+
+                // ---- fetch the (single) Event Ring Segment Table entry -
+                S_ERST: begin
+                    mem_rd   <= 1'b1;
+                    mem_addr <= erstba_lo + {28'h0, cnt, 2'b00};
+                    state    <= S_ERSTW;
+                end
+                S_ERSTW: if (mem_rvalid) begin
+                    case (cnt)
+                        2'd0: erst_base <= mem_rdata;
+                        2'd2: erst_size <= mem_rdata[15:0];
+                        default: ;
+                    endcase
+                    if (cnt == 2'd3) begin
+                        erst_valid <= 1'b1;
+                        cnt        <= 2'h0;
+                        state      <= S_EVT;
+                    end else begin
+                        cnt   <= cnt + 2'd1;
+                        state <= S_ERST;
+                    end
+                end
+
+                // ---- write the 16-byte Command Completion Event --------
+                S_EVT: begin
+                    mem_wr   <= 1'b1;
+                    mem_waddr <= evt_addr + {28'h0, cnt, 2'b00};
+                    case (cnt)
+                        2'd0: mem_wdata <= cmd_trb_addr;
+                        2'd1: mem_wdata <= 32'h0;
+                        2'd2: mem_wdata <= {8'h01, 24'h0}; // Completion Code = Success
+                        2'd3: mem_wdata <= {slot_id_out, 8'h00, TRB_CMD_EVENT, 9'h0, ecs};
+                    endcase
+                    if (cnt == 2'd3) begin cnt <= 2'h0; state <= S_POST; end
+                    else cnt <= cnt + 2'd1;
+                end
+
+                // ---- advance the event ring, raise the interrupt, loop -
+                S_POST: begin
+                    iman[0] <= 1'b1; // IP
+                    intr    <= iman[1]; // gated on IE
+                    if (evt_idx + 16'd1 >= erst_size) begin
+                        evt_idx <= 16'h0;
+                        ecs     <= ~ecs;
+                    end else begin
+                        evt_idx <= evt_idx + 16'd1;
+                    end
+                    cnt   <= 2'h0;
+                    state <= S_FETCH; // drain loop: check for more queued TRBs
+                end
+
+                default: state <= S_IDLE;
+            endcase
+        end
+    end
+endmodule
+`default_nettype wire
diff --git a/sim/xhci_ring_engine_tb.sv b/sim/xhci_ring_engine_tb.sv
new file mode 100644
index 0000000..969a24e
--- /dev/null
+++ b/sim/xhci_ring_engine_tb.sv
@@ -0,0 +1,130 @@
+`default_nettype none
+`timescale 1ns/1ps
+module xhci_ring_engine_tb;
+    reg clk=0, rst_n=0;
+    reg        reg_wr=0;
+    reg [11:0] reg_addr=0, reg_raddr=0;
+    reg [31:0] reg_wdata=0;
+    wire [31:0] reg_rdata;
+    wire        mem_rd, mem_wr;
+    wire [31:0] mem_addr, mem_waddr, mem_wdata;
+    reg  [31:0] mem_rdata; reg mem_rvalid;
+    wire        intr;
+    integer errors=0, i;
+
+    xhci_ring_engine dut(.clk(clk),.rst_n(rst_n),
+        .reg_wr(reg_wr),.reg_addr(reg_addr),.reg_wdata(reg_wdata),
+        .reg_raddr(reg_raddr),.reg_rdata(reg_rdata),
+        .mem_rd(mem_rd),.mem_addr(mem_addr),.mem_rdata(mem_rdata),.mem_rvalid(mem_rvalid),
+        .mem_wr(mem_wr),.mem_waddr(mem_waddr),.mem_wdata(mem_wdata),.intr(intr));
+
+    always #5 clk=~clk;
+
+    reg [31:0] hm [0:16383];
+    always @(posedge clk) begin
+        mem_rvalid <= mem_rd;
+        if (mem_rd) mem_rdata <= hm[mem_addr[15:2]];
+        if (mem_wr) hm[mem_waddr[15:2]] <= mem_wdata;
+    end
+
+    reg intr_seen=0;
+    always @(posedge clk) if (intr) intr_seen<=1;
+
+    task wr(input [11:0] a, input [31:0] d);
+        begin @(posedge clk); reg_wr<=1; reg_addr<=a; reg_wdata<=d;
+              @(posedge clk); reg_wr<=0; end
+    endtask
+    task chk(input [255:0] n, input [31:0] g, input [31:0] e);
+        begin if (g!==e) begin $display("FAIL %0s: got %08x exp %08x",n,g,e); errors=errors+1; end
+              else $display("ok   %0s = %08x",n,g); end
+    endtask
+    // ring the command doorbell, wait for the completion interrupt, then
+    // let the FSM's trailing "check for more queued TRBs" drain pass settle
+    // back to idle before handing control back (it keeps walking the ring
+    // for a few cycles after posting the event).
+    task ring_doorbell;
+        begin
+            intr_seen = 0;
+            wr(12'h100, 32'h0);
+            i=0; while (!intr_seen && i<500) begin @(posedge clk); i=i+1; end
+            repeat (20) @(posedge clk);
+        end
+    endtask
+
+    initial begin
+        for (i=0;i<16384;i=i+1) hm[i]=0;
+        @(posedge clk); rst_n<=1;
+
+        // Command Ring base 0x1000, RCS=1
+        wr(12'h038, 32'h00001001);
+        wr(12'h03C, 32'h00000000);
+
+        // Event Ring Segment Table at 0x2000: {base=0x3000, hi=0, size=16}
+        hm['h2000>>2] = 32'h00003000;
+        hm[('h2000>>2)+1] = 32'h00000000;
+        hm[('h2000>>2)+2] = 32'h00000010; // ERSTSZ = 16 TRBs
+        wr(12'h230, 32'h00002000);
+        wr(12'h234, 32'h00000000);
+
+        // enable interrupts
+        wr(12'h220, 32'h00000002); // IMAN.IE=1
+
+        // ---- 1) No-Op Command at 0x1000 (type 23, cycle=1) ----
+        hm['h1000>>2] = 32'h0;
+        hm[('h1000>>2)+1] = 32'h0;
+        hm[('h1000>>2)+2] = 32'h0;
+        hm[('h1000>>2)+3] = 32'h00005C01; // type=23<<10=0x5C00, cycle=1
+
+        ring_doorbell();
+        chk("noop: intr fired", {31'h0, intr_seen}, 32'h1);
+        chk("noop: evt[0] dw0 (trb ptr)", hm['h3000>>2],      32'h00001000);
+        chk("noop: evt[0] dw1",          hm[('h3000>>2)+1],   32'h00000000);
+        chk("noop: evt[0] dw2 (compl)",  hm[('h3000>>2)+2],   32'h01000000);
+        chk("noop: evt[0] dw3 (type/slot/cycle)", hm[('h3000>>2)+3], 32'h00008401);
+
+        reg_raddr<=12'h220; @(posedge clk); #1;
+        chk("noop: IMAN.IP set", reg_rdata, 32'h00000003);
+
+        // driver acks the interrupt (W1C bit0), IE stays set
+        wr(12'h220, 32'h00000003);
+        reg_raddr<=12'h220; @(posedge clk); #1;
+        chk("noop: IMAN.IP cleared", reg_rdata, 32'h00000002);
+
+        // ---- 2) Enable Slot Command at 0x1010 (type 9, cycle=1) ----
+        hm['h1010>>2] = 32'h0;
+        hm[('h1010>>2)+1] = 32'h0;
+        hm[('h1010>>2)+2] = 32'h0;
+        hm[('h1010>>2)+3] = 32'h00002401; // type=9<<10=0x2400, cycle=1
+
+        ring_doorbell();
+        chk("enslot: evt[1] dw0 (trb ptr)", hm[('h3010>>2)],   32'h00001010);
+        chk("enslot: evt[1] dw3 (slot=1)",  hm[('h3010>>2)+3], 32'h01008401);
+
+        // ---- 3) Link TRB (TC=1) back to 0x1000, then a new No-Op with
+        //         cycle=0 (ccs will have toggled) -----------------------
+        hm['h1020>>2] = 32'h00001000; // link target
+        hm[('h1020>>2)+1] = 32'h0;
+        hm[('h1020>>2)+2] = 32'h0;
+        hm[('h1020>>2)+3] = 32'h00001803; // type=6<<10=0x1800, TC=1, cycle=1
+
+        hm['h1000>>2] = 32'h0;
+        hm[('h1000>>2)+1] = 32'h0;
+        hm[('h1000>>2)+2] = 32'h0;
+        hm[('h1000>>2)+3] = 32'h00005C00; // type=23<<10=0x5C00, cycle=0 (post-toggle)
+
+        ring_doorbell();
+        chk("link+noop: evt[2] dw0 (trb ptr)", hm[('h3020>>2)],   32'h00001000);
+        chk("link+noop: evt[2] dw3",           hm[('h3020>>2)+3], 32'h00008401);
+
+        // ---- register readback sanity ----
+        reg_raddr<=12'h038; @(posedge clk); #1;
+        chk("CRCR_LO readback", reg_rdata, 32'h00001001);
+        reg_raddr<=12'h230; @(posedge clk); #1;
+        chk("ERSTBA_LO readback", reg_rdata, 32'h00002000);
+
+        if (errors==0) $display("ALL TESTS PASSED");
+        else $display("%0d FAILURES", errors);
+        $finish;
+    end
+endmodule
+`default_nettype wire