Findings: U4 registry entry (WM dispatch mechanism unknown); registry ordering

docs/findings.md

@@ -165,6 +165,7 @@ functions** (import-time analysis alone: 226K/4,355).
 - Regions: code 0xe003b000 (398KB) + 0xe009c400 (473KB mixed);
   data 0x0231dc00 (205KB), 0x0041xxxx pair; 0xf0xxxxxx block (feat 0x80)
   still uncharacterized (U1).
+
 ## Unknowns registry
 
 - **U1 — `feature_set` bit 7 (0x80):** observed only on WM regions at
@@ -176,6 +177,11 @@ functions** (import-time analysis alone: 226K/4,355).
   bytes before/around the string (F2) are uninterpreted.
 - **U3 — WO container:** `mt7981_wo.bin` uses the mtk_wed loader
   (`mtk_wed_mcu.c`), a different format; not yet parsed.
+- **U4 — WM command dispatch mechanism:** no absolute-pointer handler
+  table exists in any WM region (structural scan, F8); GP usage negligible.
+  Candidate mechanisms: FP-relative tables, switch jump tables, runtime
+  registration. Next lever: locate WM's command-receive loop via
+  CCIF/mailbox strings and read its dispatch expression.
 
 ## Related verified facts