The M113K's ME 2.8.1 accepts a torque request on CAN at 50 Hz with a 100 ms watchdog, while the ESP keeps traction cuts and brake state. The patch is assembly, built by a pipeline that refuses what it cannot justify, run inside an emulator of the ECU, and written to 4 of 11 flash sectors. Checked with the key on and the engine off; not yet on the road. measured
Spec
Controller
Bosch ME 2.8.1, M113K 5.4 L supercharged V8
CPU
Infineon C167 (C166 family)
Flash
Am29F400BB, 512 KB, 11 sectors
Base image
stock Bosch code + the existing calibration, unchanged
Added
torque request handler; 10 Hz engine telemetry on CAN
Request rate
50 Hz
Resolution
0.25 N·m
Watchdog
100 ms: no fresh request, back to passive
Kept by the truck
ESP traction cuts and brake state; brake, ESP and liveness gates in the handler
Written
sectors 7-10, 256 KB, 262,144 bytes in 376.5 s over K-line
In the truck since
3 Nov 2026
Checked
key on, engine off: request 2,500 read as +125.00 N·m, valid, then passive
Not yet
no torque request on the road
Flash map
Telemetry the patch adds 10 Hz on CAN, read at idle, key cycle after the flash
Manifold pressure
33 kPa
Injection time, bank 1
about 2.46 ms
Spark
-11.0°
Short-term fuel trim, bank 1
+4.7 %
History
first ECU probing sessions over K-line
first patched image flashed; torque path checked key on, engine off; 10 Hz telemetry on CAN
patches rebuilt from assembly; checks now run the stock code around each patch
current image written, 376.5 s
Faults found, and what catches them now each could have been found on the desk
Fault
Cause
Seen as
Now
Torque path not passive
the patch assumed the ESP's own torque request stays passive
on the truck it was not
handled in the selector; emulator case
Wrong memory read
a data page register was not set when reading the CAN message buffer
read garbage on the truck
register set and restored; emulator case
Frame gone before read
the stock handler cleared the new-data flag first
the patch never saw the frame
a gate passes only full-length frames to the stock handler
Jump out of the call frame
first assembled rewrite returned through a stock routine
routine body ran twice; the stack still balanced
hook contract: enter and leave only by call and return
Checks before a flash all must pass; bytes are build output, never input
Check
Result
What it does
Splice refusals
7 kinds
wrong base hash, manifest mismatch, overlap, outside the image, source/manifest disagree, writing over non-erased code, outside the flashed sectors
Stock routine around the patch
byte-exact
Bosch's CAN routine run in the emulator from the hook to its return; equal to stock except the one frame handled
Telemetry staging
64 KB state preserved
RAM, registers and flags byte for byte across 3 message slots, key on and running
Channel sweep
1,024 values
every byte value of the four telemetry channels
Manifold-pressure input sweep
1,024 values
every 10-bit reading of the MAP sensor's producer
Bit flips
256 of 256 caught
every single-bit flip of the 32-byte region
Mutation tests
0 unexplained survivors
every surviving mutant must be pinned with a reason
Flasher gates
5 + simulated flash
including a connection dropped halfway and recovered
Before the erase
every sector
a checksum pass showed the car's image matched the build's base byte for byte
After the write
sectors 7-10 + 12 ranges
checksums answered for the new image; a wrong sum was refused