[RyanTheTide]

M2 SIO bring-up: publish protocol-9 control state first, size the DMA arrays by entry count

On the M2 (T8112) the SIO co-processor occasionally crashed during bring-up, about 2 boots in 119, with an SError right after "SIO protocol v9". In all four saved crash histories the firmware had acknowledged STARTED and eleven SETUP messages, and the one unacknowledged request was parameter 0x23, the shim table length.

This change:

• publishes the protocol-9 control state (panic buffer, map ranges, tunables, shims, device types) before the performance state and the DMA arrays, still waiting for each ACK and stopping at the first failure. Other protocol versions are unchanged.
• treats parameters 2 and 0x0c as entry counts, which they are, and allocates 0xaaa 12-byte segment entries and 0x1b80 16-byte response entries. Before, the buffers were sized in bytes while the firmware was told the same numbers as entry counts, so the firmware could write past them.
• keeps the published buffers until an acknowledged firmware shutdown.

Tested

• KUnit (arm64 16K) 15/15 for apple-sio, host tests 158/158, full fleet build of the branch (7.3.0-aurora-siofix).
• M2, 30 warm boots on that kernel: SIO probed every boot, 0 co-processor crashes, journalctl -b -p 3 empty every boot, both audio cards present, speakerguardd active. No audio was played.
• At the old rate (about 1.7%) 30 clean boots is not yet proof that the crash is gone; it shows no regression. The rate will keep being counted on the ref Mac fleet boots after this lands.
• M2 bisect earlier tonight: 0 crashes in 20 boots on aura main, so the bootloader is not the trigger.

🤖 Generated with Claude Code