Findings F7: WA MCU_EXT_CMD dispatch table (65-entry @0x10201304), ABI-verified handler alignments, structural scan method

docs/findings.md

@@ -125,6 +125,30 @@ Strings self-identify WA's role — host command handling and TX bookkeeping
 Next: match `MCU_EXT_CMD_*` enum ids (mt76 headers) to `cmdEventParserCmd`
 dispatch — the ABI anchor map (P1-C/D).
 
+## F7 — WA EXT_CMD dispatch table located (2026-08-20)
+
+Method: string xrefs fail on this code (GP-relative data addressing;
+decompiler shows `unaff_gp + imm`) — dispatch found structurally instead:
+`tools/scan_tables.py` scans for consecutive LE pointers into ILM
+(0x10200000–0x10233370).
+
+- **65-entry table @ ILM+0x1304 (vaddr 0x10201304)** = `MCU_EXT_CMD`
+  dispatch, indexed by command id. Two default stubs: 0x10200278
+  (unhandled) / 0x10200270 (reserved). Verified alignments with mt76 enum:
+  [0x07] PM_STATE_CTRL→0x10201934, [0x08] CHANNEL_SWITCH→0x10201910,
+  [0x11] SET_TX_POWER_CTRL→0x1020164c, [0x25] STA_REC_UPDATE→0x10201530,
+  [0x26] BSS_INFO_UPDATE→0x1020155c, [0x2a] DEV_INFO_UPDATE→0x102015c4,
+  [0x32] WTBL_UPDATE→0x10201688, [0x49] BCN_OFFLOAD→0x10201674.
+- ~30 non-default handlers → immediately nameable; ~15 non-default entries
+  at ids beyond mt76's public enum (MTK-internal commands — discovery list).
+- Additional tables: 36-entry @ILM+0x330 (sparse; likely basic
+  MCU_CMD/mailbox dispatch), 16-entry @ILM+0x8248.
+- Coverage prerequisite: forced linear disassembly (`ForceDisasmPost.py`)
+  28,540 → 125,621 instructions — default analysis leaves most firmware
+  code undisassembled (no entry graph reaches it).
+
+Next: same scan on WM; handler-by-handler decompile + naming pass.
+
 ## Unknowns registry
 
 - **U1 — `feature_set` bit 7 (0x80):** observed only on WM regions at