fix(detect): ignore all-zero 0x398 stub so HW4 trims aren't mislabelled Legacy

On HW4 Juniper/Giga the gateway forwards an empty GTW_carConfig (0x398) onto
Bus 6 — only the mux byte moves. Reading byte0 das_hw=0 from that stub
classified the car as Legacy and routed it through the 0x3EE path before 0x3FD
upgraded it to HW3. Treat an all-zero 0x398 payload as Unknown in both the
shared core and the ESP32 so detection falls through to live markers (0x39B on
Vehicle CAN). Host test added (236 assertions).

Also document in HARDWARE.md that 0x370 EPAS3P is absent from Vehicle CAN on
HW4-modern (jewelrylin + DrStrangeglovebox dual-CAN captures), mirroring the
0x3C2-not-on-Bus-6 case.

Refs #100 #110

Author: hypery11

HARDWARE.md

@@ -225,6 +225,19 @@ And these "Vehicle CAN" signals are also writable on bus 6:
 > one device: Bus 6 for `0x3FD` / `0x370` / `0x3F8` / TLSSC, and Vehicle CAN
 > direct for `0x3C2`. Slated as a v2.16 platformio variant.
 
+> [!IMPORTANT]
+> **On HW4-modern, `0x370` EPAS3P_sysStatus is the mirror case of `0x3C2`: it is
+> absent from Vehicle CAN (X179 pin 9/10/11).** Dual-CAN captures on two cars —
+> @jewelrylin's Juniper RWD (0 / 20,760 frames over 60 s on pin 9/10) and
+> @DrStrangeglovebox's MYP Giga Berlin (0 / 2,653 on pin 10/11) — confirm `0x370`
+> only appears on **Bus 6 (pin 13/14)** as the gateway-forwarded copy. The EPAS
+> module does **not** receive `0x370` on Vehicle CAN on these trims, so relocating
+> the nag echo from Bus 6 to Vehicle CAN does **not** reach EPAS — it is not a
+> viable nag-killer pivot for HW4-modern. The only remaining X179 location that
+> could carry the EPAS-side frame is **Chassis Bus 3 (pin 18/19)**; until a
+> Listen-Only capture there confirms it, the 14.x HW4 nag path stays open. See
+> [#100](https://github.com/hypery11/flipper-tesla-fsd/issues/100).
+
 **One bus, one connection, reads and writes almost everything.**
 
 This is how the 非凡指揮官 (Feifan Commander, 69K+ sales in China)

esp32/.firmware/fsd_handler.cpp

@@ -100,6 +100,20 @@ bool fsd_ap_first_allows(const FSDState *state, uint32_t now_ms) {
 
 TeslaHWVersion fsd_detect_hw_version(const CanFrame *frame) {
     if (frame->id != CAN_ID_GTW_CAR_CONFIG) return TeslaHW_Unknown;
+    // Some HW4 trims (Juniper/Giga) forward an all-zero 0x398 stub on the
+    // gateway copy that reaches Bus 6 — only the mux byte ever moves. An empty
+    // GTW_carConfig carries no real das_hw; reading it as 0 would mislabel the
+    // car as Legacy and route it through the 0x3EE path. The real HW4 marker
+    // lives on Vehicle CAN (0x39B). Treat an all-zero payload as Unknown so
+    // detection falls through to the live markers instead of a stub.
+    bool all_zero = true;
+    for (uint8_t i = 0; i < frame->dlc && i < CAN_FRAME_MAX_DATA_LEN; i++) {
+        if (frame->data[i] != 0u) {
+            all_zero = false;
+            break;
+        }
+    }
+    if (all_zero) return TeslaHW_Unknown;
     // DAS_HWversion field: bits 7:6 of byte 0  (das_hw)
     uint8_t das_hw = (frame->data[SIG_GTW_DAS_HW_BYTE] >> SIG_GTW_DAS_HW_SHIFT) &
                      SIG_GTW_DAS_HW_MASK;

fsd_logic/fsd_handler.c

@@ -92,6 +92,20 @@ bool fsd_is_selected_in_ui(const CANFRAME* frame, bool force_fsd) {
 
 TeslaHWVersion fsd_detect_hw_version(const CANFRAME* frame) {
     if(frame->canId != CAN_ID_GTW_CAR_CONFIG) return TeslaHW_Unknown;
+    // Some HW4 trims (Juniper/Giga) forward an all-zero 0x398 stub on the
+    // gateway copy that reaches Bus 6 — only the mux byte ever moves. An empty
+    // GTW_carConfig carries no real das_hw; reading it as 0 would mislabel the
+    // car as Legacy and route it through the 0x3EE path. The real HW4 marker
+    // lives on Vehicle CAN (0x39B). Treat an all-zero payload as Unknown so
+    // detection falls through to the live markers instead of a stub.
+    bool all_zero = true;
+    for(uint8_t i = 0; i < frame->data_lenght && i < 8u; i++) {
+        if(frame->buffer[i] != 0u) {
+            all_zero = false;
+            break;
+        }
+    }
+    if(all_zero) return TeslaHW_Unknown;
     uint8_t das_hw = (frame->buffer[0] >> 6) & 0x03;
     switch(das_hw) {
     case 0:

test/test_fsd_core.c

@@ -98,10 +98,24 @@ static void test_detect_hw(void) {
     CHECK(fsd_detect_hw_version(&f) == TeslaHW_HW3, "das_hw=2 -> HW3");
     f.buffer[0] = 0xC0; // 0b11 = 3
     CHECK(fsd_detect_hw_version(&f) == TeslaHW_HW4, "das_hw=3 -> HW4");
+    // Real Legacy car: das_hw=0/1 but GTW_carConfig is populated (VIN/options),
+    // so a non-zero config byte distinguishes it from the all-zero stub below.
+    f.buffer[3] = 0x55; // some real config payload
     f.buffer[0] = 0x00; // 0
-    CHECK(fsd_detect_hw_version(&f) == TeslaHW_Legacy, "das_hw=0 -> Legacy");
+    CHECK(fsd_detect_hw_version(&f) == TeslaHW_Legacy, "das_hw=0 + payload -> Legacy");
     f.buffer[0] = 0x40; // 1
-    CHECK(fsd_detect_hw_version(&f) == TeslaHW_Legacy, "das_hw=1 -> Legacy");
+    CHECK(fsd_detect_hw_version(&f) == TeslaHW_Legacy, "das_hw=1 + payload -> Legacy");
+    // All-zero 0x398 stub (HW4 Juniper/Giga gateway copy on Bus 6): must NOT be
+    // read as das_hw=0 -> Legacy; fall through to live markers instead.
+    zero(&f);
+    f.canId = CAN_ID_GTW_CAR_CONFIG;
+    f.data_lenght = 8;
+    CHECK(fsd_detect_hw_version(&f) == TeslaHW_Unknown, "all-zero 0x398 stub -> Unknown");
+    // Guard boundary: a populated frame with das_hw=0 (byte0 low bits set, e.g.
+    // a real config/mux value) is NOT all-zero, so it still classifies Legacy —
+    // the guard must only fire on a fully empty payload, never over-fire.
+    f.buffer[0] = 0x05; // byte0 nonzero, das_hw bits (7:6) = 0
+    CHECK(fsd_detect_hw_version(&f) == TeslaHW_Legacy, "das_hw=0 populated -> Legacy (guard no over-fire)");
     f.canId = 0x123; // wrong id
     CHECK(fsd_detect_hw_version(&f) == TeslaHW_Unknown, "wrong id -> Unknown");
 }