feat: v0.108.0 — enforce TC18 Table 30's Row-2 evt[2:0] rule for I2C/UART/ISELED/MDIO

.fusa-reqs.json

@@ -3325,11 +3325,12 @@
     {
       "id": "REQ-I2C-012",
       "title": "rcp_ep_i2c_decode_transfer_request() rejects a malformed or misaddressed frame and accepts both directions",
-      "text": "rcp_ep_i2c_decode_transfer_request() shall return RCP_EP_I2C_ERR_SHORT_FRAME for a frame too short for the ACF_ABB fixed header or its declared payload length, RCP_EP_I2C_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame, and RCP_EP_I2C_ERR_WRONG_BUS when byte_bus_id != expected_bus_id. It shall accept BOTH op senses -- an I2C transfer is half duplex and either-directional, so neither is malformed -- and report which via *out_direction.",
+      "text": "rcp_ep_i2c_decode_transfer_request() shall return RCP_EP_I2C_ERR_SHORT_FRAME for a frame too short for the ACF_ABB fixed header or its declared payload length, RCP_EP_I2C_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame, RCP_EP_I2C_ERR_WRONG_BUS when byte_bus_id != expected_bus_id, and RCP_EP_I2C_ERR_BAD_EVT when evt[2:0] is not 0b000 -- TC18 §13.5 Table 30's only legal value for a plain request in I2C's endpoint-type row; every other value shall be rejected with error code UNSUPPORTED_CMD at the dispatch layer. It shall accept BOTH op senses -- an I2C transfer is half duplex and either-directional, so neither is malformed -- and report which via *out_direction.",
       "standard": "iso26262",
       "level": "ASIL-B",
       "asil": "ASIL-B",
-      "scope": "tc18"
+      "scope": "tc18",
+      "tc18": "§13.5 Table 30, TC18.txt L3666-3710"
     },
     {
       "id": "REQ-I2C-013",
@@ -3558,12 +3559,13 @@
     },
     {
       "id": "REQ-UART-020",
-      "title": "rcp_ep_uart_decode_write_request() rejects a malformed, misaddressed, or misdirected frame",
-      "text": "rcp_ep_uart_decode_write_request() shall return RCP_EP_UART_ERR_SHORT_FRAME for a frame too short for the ACF_ABB fixed header or its declared payload length, RCP_EP_UART_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame, RCP_EP_UART_ERR_WRONG_BUS when byte_bus_id != expected_bus_id, and RCP_EP_UART_ERR_WRONG_OP when op is not RCP_ACF_OP_WRITE.",
+      "title": "rcp_ep_uart_decode_write_request() rejects a malformed, misaddressed, misdirected, or wrong-evt frame",
+      "text": "rcp_ep_uart_decode_write_request() shall return RCP_EP_UART_ERR_SHORT_FRAME for a frame too short for the ACF_ABB fixed header or its declared payload length, RCP_EP_UART_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame, RCP_EP_UART_ERR_WRONG_BUS when byte_bus_id != expected_bus_id, RCP_EP_UART_ERR_WRONG_OP when op is not RCP_ACF_OP_WRITE, and RCP_EP_UART_ERR_BAD_EVT when evt[2:0] is not 0b000 -- TC18 §13.5 Table 30's only legal value for a plain request in UART's endpoint-type row; every other value shall be rejected with error code UNSUPPORTED_CMD at the dispatch layer.",
       "standard": "iso26262",
       "level": "ASIL-B",
       "asil": "ASIL-B",
-      "scope": "tc18"
+      "scope": "tc18",
+      "tc18": "§13.5 Table 30, TC18.txt L3666-3710"
     },
     {
       "id": "REQ-UART-021",
@@ -3604,11 +3606,12 @@
     {
       "id": "REQ-UART-025",
       "title": "rcp_ep_uart_decode_read_request() rejects a payload-bearing read request with RCP_EP_UART_ERR_UNKNOWN_CMD",
-      "text": "rcp_ep_uart_decode_read_request() shall return RCP_EP_UART_ERR_UNKNOWN_CMD, rather than RCP_EP_UART_OK, when an otherwise well-formed read request carries a non-empty payload -- the deliberate asymmetry against GPIO/PWM_OUT request types documented in ep_uart.h.",
+      "text": "rcp_ep_uart_decode_read_request() shall return RCP_EP_UART_ERR_UNKNOWN_CMD, rather than RCP_EP_UART_OK, when an otherwise well-formed read request carries a non-empty payload -- the deliberate asymmetry against GPIO/PWM_OUT request types documented in ep_uart.h. It shall also return RCP_EP_UART_ERR_BAD_EVT when evt[2:0] is not 0b000 -- TC18 §13.5 Table 30's only legal value for a plain request in UART's endpoint-type row; every other value shall be rejected with error code UNSUPPORTED_CMD at the dispatch layer.",
       "standard": "iso26262",
       "level": "ASIL-B",
       "asil": "ASIL-B",
-      "scope": "tc18"
+      "scope": "tc18",
+      "tc18": "§13.5 Table 30, TC18.txt L3666-3710"
     },
     {
       "id": "REQ-UART-026",
@@ -6019,11 +6022,12 @@
     {
       "id": "REQ-ISELED-022",
       "title": "rcp_ep_iseled_decode_command_request() validates and decodes an ACF-level command request",
-      "text": "rcp_ep_iseled_decode_command_request() shall return RCP_EP_ISELED_ERR_SHORT_FRAME for a frame shorter than the ACF_ABB header or its declared payload, RCP_EP_ISELED_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame, RCP_EP_ISELED_ERR_WRONG_BUS for a mismatched byte_bus_id, RCP_EP_ISELED_ERR_WRONG_OP for an op other than RCP_ACF_OP_WRITE, and otherwise RCP_EP_ISELED_OK with the plain payload and transaction number populated.",
+      "text": "rcp_ep_iseled_decode_command_request() shall return RCP_EP_ISELED_ERR_SHORT_FRAME for a frame shorter than the ACF_ABB header or its declared payload, RCP_EP_ISELED_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame, RCP_EP_ISELED_ERR_WRONG_BUS for a mismatched byte_bus_id, RCP_EP_ISELED_ERR_WRONG_OP for an op other than RCP_ACF_OP_WRITE, RCP_EP_ISELED_ERR_BAD_EVT when evt[2:0] is not 0b000 (TC18 §13.5 Table 30's only legal value for a plain request in ISELED's endpoint-type row; every other value shall be rejected with error code UNSUPPORTED_CMD at the dispatch layer), and otherwise RCP_EP_ISELED_OK with the plain payload and transaction number populated.",
       "standard": "iso26262",
       "level": "ASIL-B",
       "asil": "ASIL-B",
-      "scope": "tc18"
+      "scope": "tc18",
+      "tc18": "§13.5 Table 30, TC18.txt L3666-3710"
     },
     {
       "id": "REQ-ISELED-023",
@@ -6154,11 +6158,12 @@
     {
       "id": "REQ-MDIO-013",
       "title": "rcp_ep_mdio_decode_read_request() validates and decodes an ACF-level MDIO read request",
-      "text": "rcp_ep_mdio_decode_read_request() shall return RCP_EP_MDIO_ERR_SHORT_FRAME for a frame shorter than the ACF_ABB header, its declared payload, or the 7-byte request prefix; RCP_EP_MDIO_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame; RCP_EP_MDIO_ERR_WRONG_BUS for a mismatched byte_bus_id; RCP_EP_MDIO_ERR_WRONG_OP for an op other than RCP_ACF_OP_READ; RCP_EP_MDIO_ERR_BAD_ADDR when the decoded address fails rcp_ep_mdio_addr_valid(); RCP_EP_MDIO_ERR_BAD_WORD_COUNT when the decoded word_count is 0 or exceeds RCP_EP_MDIO_MAX_BURST_WORDS; and otherwise RCP_EP_MDIO_OK with the address, word count, and transaction number populated.",
+      "text": "rcp_ep_mdio_decode_read_request() shall return RCP_EP_MDIO_ERR_SHORT_FRAME for a frame shorter than the ACF_ABB header, its declared payload, or the 7-byte request prefix; RCP_EP_MDIO_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame; RCP_EP_MDIO_ERR_WRONG_BUS for a mismatched byte_bus_id; RCP_EP_MDIO_ERR_WRONG_OP for an op other than RCP_ACF_OP_READ; RCP_EP_MDIO_ERR_BAD_EVT when evt[2:0] is not 0b000 (TC18 §13.5 Table 30's only legal value for a plain request in MDIO's endpoint-type row; every other value shall be rejected with error code UNSUPPORTED_CMD at the dispatch layer); RCP_EP_MDIO_ERR_BAD_ADDR when the decoded address fails rcp_ep_mdio_addr_valid(); RCP_EP_MDIO_ERR_BAD_WORD_COUNT when the decoded word_count is 0 or exceeds RCP_EP_MDIO_MAX_BURST_WORDS; and otherwise RCP_EP_MDIO_OK with the address, word count, and transaction number populated.",
       "standard": "iso26262",
       "level": "ASIL-B",
       "asil": "ASIL-B",
-      "scope": "tc18"
+      "scope": "tc18",
+      "tc18": "§13.5 Table 30, TC18.txt L3666-3710"
     },
     {
       "id": "REQ-MDIO-014",
@@ -6190,11 +6195,12 @@
     {
       "id": "REQ-MDIO-017",
       "title": "rcp_ep_mdio_decode_write_request() validates and decodes an ACF-level MDIO write request",
-      "text": "rcp_ep_mdio_decode_write_request() shall return RCP_EP_MDIO_ERR_SHORT_FRAME for a frame shorter than the ACF_ABB header, its declared payload, or the 5-byte address prefix; RCP_EP_MDIO_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame; RCP_EP_MDIO_ERR_WRONG_BUS for a mismatched byte_bus_id; RCP_EP_MDIO_ERR_WRONG_OP for an op other than RCP_ACF_OP_WRITE; RCP_EP_MDIO_ERR_BAD_ADDR when the decoded address fails rcp_ep_mdio_addr_valid(); RCP_EP_MDIO_ERR_BAD_WORD_COUNT when the trailing words region's byte length is odd, is 0, or represents more than RCP_EP_MDIO_MAX_BURST_WORDS words; and otherwise RCP_EP_MDIO_OK with the address, packed word bytes, word count, and transaction number populated.",
+      "text": "rcp_ep_mdio_decode_write_request() shall return RCP_EP_MDIO_ERR_SHORT_FRAME for a frame shorter than the ACF_ABB header, its declared payload, or the 5-byte address prefix; RCP_EP_MDIO_ERR_BAD_MSG_TYPE for a non-ACF_ABB frame; RCP_EP_MDIO_ERR_WRONG_BUS for a mismatched byte_bus_id; RCP_EP_MDIO_ERR_WRONG_OP for an op other than RCP_ACF_OP_WRITE; RCP_EP_MDIO_ERR_BAD_EVT when evt[2:0] is not 0b000 (TC18 §13.5 Table 30's only legal value for a plain request in MDIO's endpoint-type row; every other value shall be rejected with error code UNSUPPORTED_CMD at the dispatch layer); RCP_EP_MDIO_ERR_BAD_ADDR when the decoded address fails rcp_ep_mdio_addr_valid(); RCP_EP_MDIO_ERR_BAD_WORD_COUNT when the trailing words region's byte length is odd, is 0, or represents more than RCP_EP_MDIO_MAX_BURST_WORDS words; and otherwise RCP_EP_MDIO_OK with the address, packed word bytes, word count, and transaction number populated.",
       "standard": "iso26262",
       "level": "ASIL-B",
       "asil": "ASIL-B",
-      "scope": "tc18"
+      "scope": "tc18",
+      "tc18": "§13.5 Table 30, TC18.txt L3666-3710"
     },
     {
       "id": "REQ-MDIO-018",

.fusa.json

@@ -2,7 +2,7 @@
   "configVersion": "1.0",
   "project": {
     "name": "c-RCP",
-    "version": "0.107.0"
+    "version": "0.108.0"
   },
   "standard": "iso26262",
   "strict": false,

CMakeLists.txt

@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.16)
 
 project(c-rcp
-    VERSION 0.107.0
+    VERSION 0.108.0
     DESCRIPTION "OPEN Alliance TC18 Remote Control Protocol (C)"
     HOMEPAGE_URL "https://github.com/SoundMatt/c-RCP"
     LANGUAGES C

include/rcp/ep_i2c.h

@@ -261,6 +261,11 @@ typedef enum {
      * this module: both op senses are valid on an I2C transfer (see the
      * file header), so there is no longer a "wrong" one to reject. */
     RCP_EP_I2C_ERR_WRONG_OP     = 4,
+    /* evt[2:0] is not 0b000, TC18 §13.5 Table 30's only legal value for a
+     * plain (non-configuration) request in I2C's endpoint-type row --
+     * caller shall respond with error code UNSUPPORTED_CMD (see
+     * rcp_acf_evt_row2_is_plain()). */
+    RCP_EP_I2C_ERR_BAD_EVT      = 5,
 } rcp_ep_i2c_errc_t;
 
 /* Human-readable message for an rcp_ep_i2c_errc_t value. Never returns NULL. */
@@ -299,8 +304,10 @@ rcp_bytes_t rcp_ep_i2c_encode_transfer_request(rcp_byte_bus_id_t byte_bus_id,
  * Fails with RCP_EP_I2C_ERR_SHORT_FRAME if b is shorter than the ACF_ABB
  * fixed header or its declared payload length; RCP_EP_I2C_ERR_BAD_MSG_TYPE
  * if b is not an ACF_ABB message; RCP_EP_I2C_ERR_WRONG_BUS if its
- * byte_bus_id != expected_bus_id. Both op senses are accepted -- see the
- * file header -- and reported via *out_direction.
+ * byte_bus_id != expected_bus_id; RCP_EP_I2C_ERR_BAD_EVT if its evt[2:0]
+ * is not 0b000 (rcp_acf_evt_row2_is_plain(), TC18 §13.5 Table 30 -- the
+ * caller shall respond with error code UNSUPPORTED_CMD). Both op senses
+ * are accepted -- see the file header -- and reported via *out_direction.
  *
  * On RCP_EP_I2C_OK, *out_direction, *out_read_size (the requested
  * read_size for RCP_EP_I2C_DIR_READ, 0 for RCP_EP_I2C_DIR_WRITE, whose

include/rcp/ep_iseled.h

@@ -369,6 +369,11 @@ typedef enum {
     RCP_EP_ISELED_ERR_CRC_MISMATCH    = 6,
     RCP_EP_ISELED_ERR_ODD_SYMBOL_COUNT = 7,
     RCP_EP_ISELED_ERR_ALLOC           = 8,
+    /* evt[2:0] is not 0b000, TC18 §13.5 Table 30's only legal value for a
+     * plain (non-configuration) request in ISELED's endpoint-type row --
+     * caller shall respond with error code UNSUPPORTED_CMD (see
+     * rcp_acf_evt_row2_is_plain()). */
+    RCP_EP_ISELED_ERR_BAD_EVT         = 9,
 } rcp_ep_iseled_errc_t;
 
 /* Human-readable message for an rcp_ep_iseled_errc_t value. Never returns NULL. */
@@ -410,7 +415,10 @@ rcp_bytes_t rcp_ep_iseled_encode_command_request(rcp_byte_bus_id_t byte_bus_id,
  * the ACF_ABB fixed header or its declared payload length;
  * RCP_EP_ISELED_ERR_BAD_MSG_TYPE if b is not an ACF_ABB message;
  * RCP_EP_ISELED_ERR_WRONG_BUS if its byte_bus_id != expected_bus_id;
- * RCP_EP_ISELED_ERR_WRONG_OP if its op is not RCP_ACF_OP_WRITE. On
+ * RCP_EP_ISELED_ERR_WRONG_OP if its op is not RCP_ACF_OP_WRITE;
+ * RCP_EP_ISELED_ERR_BAD_EVT if its evt[2:0] is not 0b000
+ * (rcp_acf_evt_row2_is_plain(), TC18 §13.5 Table 30 -- the caller shall
+ * respond with error code UNSUPPORTED_CMD). On
  * RCP_EP_ISELED_OK, *out_transaction_num is populated, and *out_tx_data /
  * *out_tx_len are set to a *borrowed* view into b (not copied) of the raw
  * plain content. */

include/rcp/ep_mdio.h

@@ -357,6 +357,11 @@ typedef enum {
     RCP_EP_MDIO_ERR_BAD_ADDR        = 5,
     RCP_EP_MDIO_ERR_BAD_WORD_COUNT  = 6,
     RCP_EP_MDIO_ERR_ALLOC           = 7,
+    /* evt[2:0] is not 0b000, TC18 §13.5 Table 30's only legal value for a
+     * plain (non-configuration) request in MDIO's endpoint-type row --
+     * caller shall respond with error code UNSUPPORTED_CMD (see
+     * rcp_acf_evt_row2_is_plain()). */
+    RCP_EP_MDIO_ERR_BAD_EVT         = 8,
 } rcp_ep_mdio_errc_t;
 
 /* Human-readable message for an rcp_ep_mdio_errc_t value. Never returns NULL. */
@@ -382,7 +387,10 @@ rcp_bytes_t rcp_ep_mdio_encode_read_request(rcp_byte_bus_id_t byte_bus_id,
  * RCP_EP_MDIO_ERR_WRONG_OP if its op is not RCP_ACF_OP_READ;
  * RCP_EP_MDIO_ERR_BAD_ADDR if the decoded address fails
  * rcp_ep_mdio_addr_valid(); RCP_EP_MDIO_ERR_BAD_WORD_COUNT if the decoded
- * word_count is 0 or exceeds RCP_EP_MDIO_MAX_BURST_WORDS. On
+ * word_count is 0 or exceeds RCP_EP_MDIO_MAX_BURST_WORDS;
+ * RCP_EP_MDIO_ERR_BAD_EVT if its evt[2:0] is not 0b000
+ * (rcp_acf_evt_row2_is_plain(), TC18 §13.5 Table 30 -- the caller shall
+ * respond with error code UNSUPPORTED_CMD). On
  * RCP_EP_MDIO_OK, *out_addr, *out_word_count, and *out_transaction_num
  * are populated. */
 rcp_ep_mdio_errc_t rcp_ep_mdio_decode_read_request(const uint8_t *b, size_t len,
@@ -448,7 +456,10 @@ rcp_bytes_t rcp_ep_mdio_encode_write_request(rcp_byte_bus_id_t byte_bus_id,
  * RCP_EP_MDIO_ERR_BAD_ADDR if the decoded address fails
  * rcp_ep_mdio_addr_valid(); RCP_EP_MDIO_ERR_BAD_WORD_COUNT if the words
  * region's own byte length is odd, is 0, or represents more than
- * RCP_EP_MDIO_MAX_BURST_WORDS words. On RCP_EP_MDIO_OK, *out_addr and
+ * RCP_EP_MDIO_MAX_BURST_WORDS words; RCP_EP_MDIO_ERR_BAD_EVT if its
+ * evt[2:0] is not 0b000 (rcp_acf_evt_row2_is_plain(), TC18 §13.5
+ * Table 30 -- the caller shall respond with error code UNSUPPORTED_CMD).
+ * On RCP_EP_MDIO_OK, *out_addr and
  * *out_transaction_num are populated, and *out_words_data /
  * *out_word_count are set to a *borrowed* view into b (not copied) of the
  * packed word bytes following the address prefix. */

include/rcp/ep_uart.h

@@ -297,6 +297,11 @@ typedef enum {
     RCP_EP_UART_ERR_WRONG_OP     = 4,
     RCP_EP_UART_ERR_UNKNOWN_CMD  = 5, /* payload-bearing read request -- see
                                           the file header */
+    /* evt[2:0] is not 0b000, TC18 §13.5 Table 30's only legal value for a
+     * plain (non-configuration) request in UART's endpoint-type row --
+     * caller shall respond with error code UNSUPPORTED_CMD (see
+     * rcp_acf_evt_row2_is_plain()). */
+    RCP_EP_UART_ERR_BAD_EVT      = 6,
 } rcp_ep_uart_errc_t;
 
 /* Human-readable message for an rcp_ep_uart_errc_t value. Never returns NULL. */
@@ -319,7 +324,10 @@ rcp_bytes_t rcp_ep_uart_encode_write_request(rcp_byte_bus_id_t byte_bus_id,
  * fixed header or its declared payload length; RCP_EP_UART_ERR_BAD_MSG_TYPE
  * if b is not an ACF_ABB message; RCP_EP_UART_ERR_WRONG_BUS if its
  * byte_bus_id != expected_bus_id; RCP_EP_UART_ERR_WRONG_OP if its op is not
- * RCP_ACF_OP_WRITE. On RCP_EP_UART_OK, *out_transaction_num is populated,
+ * RCP_ACF_OP_WRITE; RCP_EP_UART_ERR_BAD_EVT if its evt[2:0] is not 0b000
+ * (rcp_acf_evt_row2_is_plain(), TC18 §13.5 Table 30 -- the caller shall
+ * respond with error code UNSUPPORTED_CMD). On RCP_EP_UART_OK,
+ * *out_transaction_num is populated,
  * and *out_tx_data / *out_tx_len are set to a *borrowed* view into b (not
  * copied -- see the file header) of the raw outgoing payload. */
 rcp_ep_uart_errc_t rcp_ep_uart_decode_write_request(const uint8_t *b, size_t len,
@@ -376,7 +384,10 @@ rcp_bytes_t rcp_ep_uart_encode_read_request(rcp_byte_bus_id_t byte_bus_id, uint8
  * RCP_EP_UART_ERR_WRONG_BUS if its byte_bus_id != expected_bus_id;
  * RCP_EP_UART_ERR_WRONG_OP if its op is not RCP_ACF_OP_READ;
  * RCP_EP_UART_ERR_UNKNOWN_CMD if it carries any payload at all -- the
- * deliberate asymmetry documented in the file header. On RCP_EP_UART_OK,
+ * deliberate asymmetry documented in the file header; RCP_EP_UART_ERR_BAD_EVT
+ * if its evt[2:0] is not 0b000 (rcp_acf_evt_row2_is_plain(), TC18 §13.5
+ * Table 30 -- the caller shall respond with error code UNSUPPORTED_CMD).
+ * On RCP_EP_UART_OK,
  * *out_read_size and *out_transaction_num are populated. */
 rcp_ep_uart_errc_t rcp_ep_uart_decode_read_request(const uint8_t *b, size_t len,
                                                     rcp_byte_bus_id_t expected_bus_id,

include/rcp/version.h

@@ -6,6 +6,6 @@
 #ifndef RCP_VERSION_H
 #define RCP_VERSION_H
 
-#define RCP_VERSION "0.107.0"
+#define RCP_VERSION "0.108.0"
 
 #endif /* RCP_VERSION_H */

src/ep_i2c.c

@@ -81,6 +81,7 @@ const char *rcp_ep_i2c_strerror(rcp_ep_i2c_errc_t e)
     case RCP_EP_I2C_ERR_BAD_MSG_TYPE: return "rcp/ep_i2c: unexpected ACF message type";
     case RCP_EP_I2C_ERR_WRONG_BUS:    return "rcp/ep_i2c: wrong byte_bus_id";
     case RCP_EP_I2C_ERR_WRONG_OP:     return "rcp/ep_i2c: wrong ACF op";
+    case RCP_EP_I2C_ERR_BAD_EVT:      return "rcp/ep_i2c: evt[2:0] is not 0b000";
     default:                          return "rcp/ep_i2c: unknown error";
     }
 }
@@ -136,6 +137,7 @@ rcp_ep_i2c_errc_t rcp_ep_i2c_decode_transfer_request(const uint8_t *b, size_t le
     if (acf_rc != RCP_ACF_OK) return RCP_EP_I2C_ERR_BAD_MSG_TYPE;
 
     if (hdr.byte_bus_id != expected_bus_id) return RCP_EP_I2C_ERR_WRONG_BUS;
+    if (!rcp_acf_evt_row2_is_plain(hdr.evt)) return RCP_EP_I2C_ERR_BAD_EVT;
 
     /* Both op senses are valid on an I2C transfer request -- see the file
      * header. The direction is reported, not rejected. */

src/ep_iseled.c

@@ -200,6 +200,7 @@ const char *rcp_ep_iseled_strerror(rcp_ep_iseled_errc_t e)
     case RCP_EP_ISELED_ERR_ODD_SYMBOL_COUNT:
         return "rcp/ep_iseled: odd symbol count -- every octet frames to two symbols";
     case RCP_EP_ISELED_ERR_ALLOC:           return "rcp/ep_iseled: allocation failure";
+    case RCP_EP_ISELED_ERR_BAD_EVT:         return "rcp/ep_iseled: evt[2:0] is not 0b000";
     default:                                return "rcp/ep_iseled: unknown error";
     }
 }
@@ -296,6 +297,7 @@ rcp_ep_iseled_errc_t rcp_ep_iseled_decode_command_request(const uint8_t *b, size
 
     if (hdr.byte_bus_id != expected_bus_id) return RCP_EP_ISELED_ERR_WRONG_BUS;
     if (hdr.op != RCP_ACF_OP_WRITE) return RCP_EP_ISELED_ERR_WRONG_OP;
+    if (!rcp_acf_evt_row2_is_plain(hdr.evt)) return RCP_EP_ISELED_ERR_BAD_EVT;
 
     /* payload is round-tripped verbatim, byte for byte -- see the file
      * header; this endpoint's own bit-framing happens only when it