fix: login cursor ghost after double save-bg + integrity GOT immunity (DSK-E70 workaround)

- login: remove duplicate cursor_save_bg after draw_login_card (ghost residue)
- login: hidden visibility on __text_*/__expected_hash -> lea rip, len calc no longer depends on GOT slot
- login: dsk_e70_layout_guard keeps .text out of the DSK write-zero minefield (whitelisted, see STATUS.md)
- patch_login_hash: hash first PT_LOAD filesz (matches loader/runtime range) + e_shstrndx section names
- STATUS.md: register DSK-E70 (unresolved ibuf-tail write-zero, root cause open)

CODE/login/main.c

@@ -14,11 +14,14 @@
 
 #include "../UTSM/include/utsm/dsk.h"
 
-/* 防篡改：linker 导出的 .text 段范围与预期哈希存储位置 */
-extern const u8 __text_start[];
-extern const u8 __text_end[];
-extern const u8 __expected_hash[];
-extern const u8 __expected_hash_end[];
+/* 防篡改：linker 导出的 .text 段范围与预期哈希存储位置。
+ * hidden 可见性强制 PIE 下用 lea rip 取址（基址无关），禁止走 GOT——
+ * GOT slot 若被 DSK 侧后续 IO 破坏（BUG：ibuf+0x1EAE10 被清零），
+ * len 将计算成天文数字导致 integrity 误报 LOGIN-E01。 */
+extern const u8 __text_start[] __attribute__((visibility("hidden")));
+extern const u8 __text_end[] __attribute__((visibility("hidden")));
+extern const u8 __expected_hash[] __attribute__((visibility("hidden")));
+extern const u8 __expected_hash_end[] __attribute__((visibility("hidden")));
 
 typedef signed char        i8;
 typedef unsigned char      u8;
@@ -777,6 +780,20 @@ static void login_mouse_init(void) {
 }
 
 __attribute__((visibility("default")))
+/* [DSK-E70 布局雷区规避 · 白名单登记]
+ * DSK 加载链路存在未定位的写零破坏：跳转 login 后 image 尾部
+ * （ibuf+0x1EAE10 附近，≥ 数百字节）被清零。.text ≤ ~16.5KB 时
+ * 雷区覆盖 .got/.bss 关键数据，导致 len 计算错误 → LOGIN-E01 误报；
+ * .text ≥ ~17KB 时雷区落在 .rodata/logo 数据上无害。
+ * 此填充把 .text 显式推入安全布局。根因修复登记 docs/STATUS.md DSK-E70，
+ * 修复后应删除本函数。 */
+__attribute__((noinline, used)) static void dsk_e70_layout_guard(void) {
+    /* 1024B nop 序列，编译器不可消除 */
+    __asm__ volatile(
+        ".rept 341\n\tnop\n\tnop\n\tnop\n\t.endr\n"
+        ::: "memory");
+}
+
 void dsk_entry(const dsk_boot_context *ctx) {
     __asm__ volatile("cli");  /* prevent IRQ1 (ps2kbd) from racing with our polling */
     logl("[login] boot");
@@ -862,13 +879,10 @@ void dsk_entry(const dsk_boot_context *ctx) {
     pass[0] = 0;
     int plen = 0;
 
-    /* Draw initial UI */
+    /* Draw initial UI（draw_login_card 内部已含光标 save+draw，
+     * 此处不得重复 save——否则会把光标像素当背景存入，移动后留残影） */
     draw_login_card(fb, card_x, card_y, pass, 1, msg, msg_color, fg);
 
-    /* 初始鼠标光标 */
-    cursor_save_bg(fb, g_mouse_x, g_mouse_y);
-    cursor_draw(fb, g_mouse_x, g_mouse_y);
-
     /* Input loop */
     int shift = 0;
     int release = 0;

CODE/login/patch_login_hash.ps1

@@ -6,7 +6,7 @@ if (-not (Test-Path $ElfPath)) { Write-Error ("not found: " + $ElfPath); exit 1
 
 $bytes = [System.IO.File]::ReadAllBytes($ElfPath)
 
-# ELF64 header: e_shoff @ 0x28 (u64), e_shentsize @ 0x3A (u16), e_shnum @ 0x3C (u16)
+# ELF64 header: e_shoff @ 0x28 (u64), e_shentsize @ 0x3A (u16), e_shnum @ 0x3C (u16), e_shstrndx @ 0x3E (u16)
 function U64([byte[]]$b, [int]$o) { [UInt64]$b[$o] -bor ([UInt64]$b[$o+1] -shl 8) -bor ([UInt64]$b[$o+2] -shl 16) -bor ([UInt64]$b[$o+3] -shl 24) -bor ([UInt64]$b[$o+4] -shl 32) -bor ([UInt64]$b[$o+5] -shl 40) -bor ([UInt64]$b[$o+6] -shl 48) -bor ([UInt64]$b[$o+7] -shl 56) }
 function U16([byte[]]$b, [int]$o) { [UInt32]$b[$o] -bor ([UInt32]$b[$o+1] -shl 8) }
 function U32([byte[]]$b, [int]$o) { [UInt32]$b[$o] -bor ([UInt32]$b[$o+1] -shl 8) -bor ([UInt32]$b[$o+2] -shl 16) -bor ([UInt32]$b[$o+3] -shl 24) }
@@ -14,16 +14,30 @@ function U32([byte[]]$b, [int]$o) { [UInt32]$b[$o] -bor ([UInt32]$b[$o+1] -shl 8
 $shoff = U64 $bytes 0x28
 $shentsize = U16 $bytes 0x3A
 $shnum = U16 $bytes 0x3C
+$shstrndx = U16 $bytes 0x3E
 
 $textOff = 0; $textSize = 0; $hashOff = 0
-$shstr = $null
-for ($i = 0; $i -lt $shnum; $i++) {
-    $sh = $shoff + $i * $shentsize
-    $shType = U32 $bytes ($sh + 4)
-    $shOffset = U64 $bytes ($sh + 24)
-    $shSize = U64 $bytes ($sh + 32)
-    if ($shType -eq 3 -and -not $shstr) { $shstr = $bytes[[int]$shOffset..[int]($shOffset+$shSize-1)] }
+# e_shstrndx points at .shstrtab directly — picking the first SHT_STRTAB is wrong
+# when .dynsym/.strtab exist (they come before .shstrtab and would garble names)
+$shstrHdr = $shoff + $shstrndx * $shentsize
+$shstrOff = U64 $bytes ($shstrHdr + 24)
+$shstrSize = U64 $bytes ($shstrHdr + 32)
+$shstr = $bytes[[int]$shstrOff..[int]($shstrOff+$shstrSize-1)]
+
+# Hash range = first PT_LOAD segment (offset/filesz). This matches exactly what
+# the DSK loader copies into memory and what the runtime hashes via
+# __text_start..__text_end (the output section may include tail padding that
+# the .text section header's sh_size does not cover — hashing sh_size caused
+# LOGIN-E01 integrity FAIL whenever lld emitted padding after .text).
+$phoff = U64 $bytes 0x20
+$phentsize = U16 $bytes 0x36
+$phnum = U16 $bytes 0x38
+for ($i = 0; $i -lt $phnum; $i++) {
+    $ph = $phoff + $i * $phentsize
+    $pType = U32 $bytes $ph
+    if ($pType -eq 1) { $textOff = U64 $bytes ($ph + 8); $textSize = U64 $bytes ($ph + 32); break }
 }
+if ($textOff -eq 0) { Write-Error 'PT_LOAD text segment not found'; exit 1 }
 
 function Get-SectName([byte[]]$strtab, [int]$idx) {
     $end = $idx
@@ -38,11 +52,10 @@ for ($i = 0; $i -lt $shnum; $i++) {
     $shOffset = U64 $bytes ($sh + 24)
     $shSize = U64 $bytes ($sh + 32)
     $nm = Get-SectName $shstr $nameIdx
-    if ($nm -eq '.text' -and $shType -eq 1) { $textOff = $shOffset; $textSize = $shSize }
     if ($nm -eq '.hashseg') { $hashOff = $shOffset }
 }
 
-if ($textOff -eq 0 -or $hashOff -eq 0) { Write-Error 'section .text/.hashseg not found'; exit 1 }
+if ($textOff -eq 0 -or $hashOff -eq 0) { Write-Error 'PT_LOAD text/.hashseg not found'; exit 1 }
 
 $sha = [System.Security.Cryptography.SHA256]::Create()
 $textBytes = New-Object byte[] $textSize