Aldi

Added date/time signal from Ioniq 6 can

.github/workflows/fleet_safety.yaml

@@ -0,0 +1,56 @@
+name: Fleet controller safety
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'opendbc_repo/**'
+      - 'selfdrive/car/**'
+      - 'starpilot/car/**'
+      - 'starpilot/controls/**'
+      - 'cereal/**'
+      - '.github/workflows/fleet_safety.yaml'
+
+permissions:
+  contents: read
+
+jobs:
+  harness:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install -r selfdrive/car/tests/fleet_requirements.txt
+      - name: Audit accounting and runner failures
+        run: >-
+          python -m pytest --noconftest -o addopts='' -q
+          selfdrive/car/tests/test_fleet_safety_core.py
+          selfdrive/car/tests/test_fleet_safety_runner.py
+          opendbc_repo/opendbc/safety/tests/safety_replay/test_replay_drive.py
+  recorded_fleet:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [0, 1, 2, 3, 4, 5, 6, 7]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install -r selfdrive/car/tests/fleet_requirements.txt
+      - name: Current controllers against freshly compiled release safety
+        run: >-
+          python -m selfdrive.car.tests.fleet_safety --all --release
+          --shard-count 8 --shard-index ${{ matrix.shard }}
+          --out selfdrive/car/tests/fleet_results/ci
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: fleet-safety-${{ matrix.shard }}
+          path: |
+            selfdrive/car/tests/fleet_results/ci/**/*.json
+            selfdrive/car/tests/fleet_results/ci/**/*.log

cereal/custom.capnp

@@ -237,6 +237,8 @@ struct StarPilotPlan @0xf98d843bfd7004a3 {
   cscLearnedLatAccel @40 :Float32;  # learned comfort at the current curvature, before margin
   cscBindingDistance @41 :Float32;  # distance to the horizon point setting the target, m
   approachStopLength @42 :Float32;  # pre-commit distance to a detected stop, m; 0 when off
+  slcPresentedSpeedLimitSource @43 :Text;  # source of the shown accepted or pending posted limit
+  slcIsLimitingMaxSet @44 :Bool;  # SLC target is below the configured Max Set
 }
 
 struct StarPilotRadarState @0xb86e6369214c01c8 {

common/params_keys.h

@@ -198,7 +198,7 @@ inline static std::unordered_map<std::string, ParamKeyAttributes> keys = {
     {"AggressiveJerkSpeedDecrease", {PERSISTENT, FLOAT, "50.0", "50.0", 3}},
     {"AlertVolumeControl", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
     {"AllowImpossibleAcceleration", {PERSISTENT, BOOL, "0", "0", 3}},
-    {"AlwaysOnLateral", {PERSISTENT, BOOL, "1", "0", 0, SETTINGS_SIMPLE}},
+    {"AlwaysOnLateral", {PERSISTENT, BOOL, "0", "0", 0, SETTINGS_SIMPLE}},
     {"AlwaysOnLateralLKAS", {PERSISTENT, BOOL, "1", "0", 2}},
     {"ApiCache_DriveStats", {PERSISTENT, JSON, "{}", "{}"}},
     {"AutomaticallyDownloadModels", {PERSISTENT, BOOL, "1", "0", 1}},
@@ -702,6 +702,7 @@ inline static std::unordered_map<std::string, ParamKeyAttributes> keys = {
     {"StandbyMode", {PERSISTENT, BOOL, "0", "0", 1, SETTINGS_SIMPLE}},
     {"StandbyWakeButton", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
     {"StandbyButtonPressTime", {CLEAR_ON_MANAGER_START | DONT_LOG, INT, "0", "0"}},
+    {"ScreenOffToggleCounter", {CLEAR_ON_MANAGER_START | DONT_LOG, INT, "0", "0"}},
     {"StandbyWakeEngage", {PERSISTENT, BOOL, "1", "1", 2, SETTINGS_SIMPLE}},
     {"StandbyWakeDisengage", {PERSISTENT, BOOL, "1", "1", 2, SETTINGS_SIMPLE}},
     {"StandbyWakeInfoAlert", {PERSISTENT, BOOL, "1", "1", 2, SETTINGS_SIMPLE}},
@@ -740,8 +741,10 @@ inline static std::unordered_map<std::string, ParamKeyAttributes> keys = {
     {"SubaruSNG", {PERSISTENT, BOOL, "1", "0", 2, SETTINGS_SIMPLE}},
     {"SubaruSNGManualParkingBrake", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
     {"SubaruStopStartOff", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
+    {"SubaruAvhStartup", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
     {"SubaruRedneckCruise", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
     {"TacoTune", {PERSISTENT, BOOL, "0", "0", 2}},
+    {"TeslaAOLDisengageOnBrake", {PERSISTENT, BOOL, "0", "0", 0, SETTINGS_SIMPLE}},
     {"TeslaCoopSteering", {PERSISTENT, BOOL, "0", "0", 2, SETTINGS_SIMPLE}},
     {"TestAlert", {CLEAR_ON_MANAGER_START, STRING, "", ""}},
     {"TetheringEnabled", {PERSISTENT, INT, "0", "0", 0}},

docs/FLEET_SAFETY_RESULTS_20260921.md

@@ -0,0 +1,86 @@
+# Fleet offline audit — September 21, 2026
+
+This is a first-pass fault and coverage inventory, not fleet driving clearance.
+No hardware was accessed and no controller or safety policy was changed by this
+audit. Other work was concurrently modifying the checkout; per-case source and
+library hashes identify the tested implementations.
+
+The full debug-library run visited all 345 platforms. It evaluated both recorded
+and AOL-main scenarios for 287 registered routes, plus 108 missing-route entries:
+
+| Result | Cases |
+|---|---:|
+| Pass within the stated scope | 103 |
+| Failed checks, requiring triage | 123 |
+| Missing coverage | 288 |
+| Could not evaluate | 168 |
+| Total | 682 |
+
+These are case counts, not numbers of unsafe cars. Missing coverage includes all
+108 platforms without routes and segments without active transitions. Evaluation
+errors include unavailable recordings and identities that do not match the
+registered platform after the existing fingerprint migration. Old logs must be
+normalized explicitly, not quietly substituted for another car.
+
+Full local evidence is under
+`selfdrive/car/tests/fleet_results/full_fleet/results.json`, with per-shard build,
+case and worker logs. Generated evidence is ignored by Git.
+
+The follow-up full release-library run also completed 682 cases: **102 pass,
+153 failed, 289 uncovered, 138 evaluation errors**. Evidence is under
+`selfdrive/car/tests/fleet_results/release_fleet_checked/results.json`.
+The two batches had different download availability and ran against a changing
+working tree; their count difference is not an isolated debug-versus-release
+experiment. Both correctly exit nonzero. The release batch is not fleet clearance.
+
+## Confirmed distinctions from failure triage
+
+**Hyundai Custin — controller/safety capability mismatch.** The registered
+segment `0bbe367c98fa1538/2023-09-16--00-16-49/2` contains 600 camera-bus
+messages at 0x53e, all eight bytes, none six. `CarInterfaceBase.get_starpilot_params`
+in `opendbc_repo/opendbc/car/interfaces.py` enables HAS_LKAS12 by address alone.
+Hyundai `CarState.update` and `CarController.update` then produce six-byte LKAS12
+replacements. In `opendbc_repo/opendbc/safety/modes/hyundai.h`,
+`hyundai_rx_all_hook` only enables replacement after receiving a six-byte camera
+message, and `hyundai_tx_hook` correctly rejects the unsolicited replacement.
+Both scenarios reject 5,799 such packets. A fresh-library probe also reproduced
+the six-byte/eight-byte distinction. Repair requires a controller capability and
+parser regression test; do not broaden the safety allowlist to hide the mismatch.
+
+**Honda Civic Bosch — incompatible historical control requests.** All 5,997
+recorded requests in the inspected 2020 fixture have enabled/latActive/longActive
+false but resume true; all 6,000 cruise-state CAN messages are disabled. Current
+controller output is RES_ACCEL at 0x296, which current safety correctly blocks.
+The AOL probe suppresses resume and passes. Investigate historical command/schema
+semantics before calling this a current steering defect.
+
+**Ford Escape — mid-segment initialization artifact.** The first cruise-enabled
+0x165 enables controls, but the immediately following 0x202 reaches
+`speed_mismatch_check` before safety has nonzero speed history. Controls are
+revoked; cruise stays enabled for the entire segment so `pcm_cruise_check` sees
+no new rising edge. Relay health remains good. This reproduces with both recorded
+and default alternative experience. A two-second scoring warmup does not repair
+the latch. This needs recorded preroll/initialization coverage, not force-setting
+`controls_allowed` or changing vehicle safety.
+
+## Tesla and AOL scope
+
+In the full debug-library run, the Model 3 route and the second Model Y route
+passed both scenarios. The first Model Y route lacked a lateral transition;
+its AOL case also lacked requested steering under AOL-only safety permission.
+Model X was uncovered as a current dashcam-only configuration. The Model S HW1
+and Pre-AP entries have no registered routes. None of these findings reproduces
+or disproves the exact hackathon oscillation without its trace.
+
+The separate actual StarPilotCard synthetic-input suite passed 964 checks with
+72 explicit active-sequence gaps. All 345 disabled configurations were checked;
+309 platforms completed both active modes. These tests check state-machine gates
+and stable sequences, not the entire selfdrived-to-Panda feedback loop.
+
+The test-harness regressions pass 34 tests. They cover pre-hook AOL authorization,
+strict configuration/bus routing, rejected active packets, expected negative
+checks, empty activity, worker crashes, stale reports and build failures.
+
+See `FLEET_SAFETY_TESTING.md` for commands, CI scope and limitations. The workflow
+has been added locally but not published or run on GitHub, and branch protection
+has not been changed. The full fleet is not green.

docs/FLEET_SAFETY_TESTING.md

@@ -0,0 +1,112 @@
+# Offline fleet controller and safety checks
+
+The runner in `selfdrive/car/tests/fleet_safety.py` enumerates every platform in
+the current checkout and uses `opendbc.car.tests.routes`. It runs current
+CarInterface/CarState/CarController code against recorded CAN and actuator
+requests, then checks each newly generated CAN packet with freshly compiled
+current safety hooks. It never connects to a Panda or starts vehicle processes.
+
+Run from the repository root with the repository Python environment:
+
+```sh
+python -m selfdrive.car.tests.fleet_safety --inventory
+python -m selfdrive.car.tests.fleet_safety --platform TESLA_MODEL_Y --release
+python -m selfdrive.car.tests.fleet_safety --all --release
+```
+
+An isolated dependency set is in `selfdrive/car/tests/fleet_requirements.txt`.
+The runner needs a C compiler. It does not use a previously staged libsafety.
+Without `--release`, the safety library enables ALLOW_DEBUG, like the existing
+safety unit tests. Release checks are needed as well: a debug-only hook must not
+be mistaken for an available production configuration. Release host builds retain
+unused-variable warnings without treating that specific diagnostic as an error.
+
+For parallel runs, use separate output directories:
+
+```sh
+python -m selfdrive.car.tests.fleet_safety --all --release \
+  --shard-count 8 --shard-index 0 --out selfdrive/car/tests/fleet_results/shard_0
+```
+
+Run indices 0 through 7. Each has its own library copies, worker processes,
+parameter namespace, logs and results. `--local-log` allows a local rlog for one
+explicitly selected platform. Route IDs and old fingerprint aliases must match;
+the harness does not silently treat another vehicle's log as that platform.
+
+## What is checked
+
+- Recorded commands under the current default feature configuration.
+- A separate AOL MAIN-availability controller/safety probe, using recorded
+  actuator values with longitudinal requests and cruise button requests off.
+- Actual per-Panda safety model, CP/FPCP safety-param OR, alternative-experience
+  OR, and strict four-bus routing, matching production configuration assembly.
+- Incoming CAN, current CarState validity and safety receive health.
+- Every emitted TX, including inactive-state packets; unexpected rejection fails.
+- Pre-hook normal/AOL/longitudinal permissions, so a rejection that revokes
+  authorization cannot disappear from the failure accounting.
+- Active requests, accepted active TX, engagement transitions, and AOL-only
+  safety authorization coverage. Sparse commands and absent transitions cannot
+  qualify as complete coverage.
+
+There is a two-second unscored fixture startup interval. Controller and safety
+history still receive messages during it. The harness does not force safety
+authorization or clear a relay fault to manufacture a passing result.
+
+## Results are deliberately strict
+
+`pass` means the case satisfied these specific checks and coverage requirements.
+`failed` means a hook/health check failed and needs investigation. `uncovered`
+means the scenario was not demonstrated, including missing routes, dashcam-only
+interfaces and segments without transitions. `error` means the case could not be
+evaluated, such as download failure or mismatched fixture identity. Anything
+other than pass makes the command exit nonzero. Existing `non_tested_cars`
+exemptions remain visible coverage gaps.
+
+Reports include frame counters, bounded rejected packet evidence, source hashes,
+effective safety configurations and build provenance. Worker results carry a
+unique execution ID; a crash, stale result or inconsistent exit code cannot be
+reused as a pass. JSON and logs live under the ignored `fleet_results` directory.
+
+The AOL probe is **not** a complete simulation of StarPilotCard, selfdrived,
+controls mismatch handling or a vehicle ECU. Recorded commands may also reflect
+historical settings different from current defaults. A blocked historical resume
+request is not automatically a steering bug. Investigate each failure before
+changing code. Do not widen safety permissions to make tests green.
+
+## Continuous integration and remaining coverage
+
+`starpilot/controls/tests/test_fleet_aol.py` separately exercises the actual
+StarPilotCard state machine with isolated synthetic inputs for every platform.
+It tests feature-off behavior, steady engagement, AOL-only operation, brake
+pause, native/StarPilot immediate-disable alerts, calibration and gear gates.
+It uses empty firmware/fingerprint fixtures, so optional vehicle configurations
+are not covered by these sequences. Run it with a compatible built host runtime:
+
+```sh
+python -m pytest --noconftest -o addopts='' -q starpilot/controls/tests/test_fleet_aol.py
+```
+
+The first run passed 964 checks and explicitly skipped 72 active sequences:
+309 platforms exercised both active modes; 36 platforms had two gaps each
+(30 dashcam-only, one notCar, four Volvo policy exclusions, one Pre-AP external
+authorization dependency). All 345 feature-off checks passed. A separate
+Pre-AP authorization input boundary test is synthetic, not proof of actual
+Panda authorization. These tests were run against the current working tree,
+including concurrent Pre-AP changes; they do not certify an earlier commit.
+The lightweight CI workflow below does not build the native runtime required
+by this separate state-machine suite.
+
+`.github/workflows/fleet_safety.yaml` adds harness tests and eight release-mode
+recorded-route shards on relevant pull requests and manual runs. Missing coverage
+is not converted to a skip or allowed failure. The current fleet is not green;
+this workflow will expose that fact. It has not been executed on GitHub from this
+local task. Requiring it for merge also needs repository branch protection; a
+workflow file alone does not change repository settings.
+
+As of the first September 21 inventory there are 345 platforms, 287 registered
+routes across 237 platforms, and 108 platforms with no registered route. A route
+entry does not guarantee valid, downloadable logs or all necessary maneuvers.
+Every optional harness, longitudinal mode, safety parameter, firmware generation
+and AOL configuration still needs explicit coverage. Offline checks reduce
+blind spots; they do not certify every physical vehicle or reproduce an incident
+whose CAN trace was not retained.

launch_env.sh

@@ -21,11 +21,11 @@ fi
 export QCOM_PRIORITY=12
 
 if [ -z "$AGNOS_VERSION" ]; then
-  export AGNOS_VERSION="19.6.20"
+  export AGNOS_VERSION="19.8.1"
 fi
 
 if [ -z "$AGNOS_ACCEPTED_VERSIONS" ]; then
-  export AGNOS_ACCEPTED_VERSIONS="$AGNOS_VERSION"
+  export AGNOS_ACCEPTED_VERSIONS="19.8.1 19.8.2"
 fi
 
 export STAGING_ROOT="/data/safe_staging"

opendbc_repo/opendbc/car/ford/carcontroller.py

@@ -4,7 +4,7 @@ from opendbc.can import CANPacker
 from opendbc.car import ACCELERATION_DUE_TO_GRAVITY, Bus, DT_CTRL, structs
 from opendbc.car.lateral import ISO_LATERAL_ACCEL, apply_std_steer_angle_limits
 from opendbc.car.ford import fordcan
-from opendbc.car.ford.values import CarControllerParams, FordFlags
+from opendbc.car.ford.values import CAR, CarControllerParams, FordFlags
 from opendbc.car.interfaces import CarControllerBase, V_CRUISE_MAX
 # This Ford extension boundary substantially adapts BluePilot bp-7.0 work. See the root CREDITS.md
 # (including Alan Polk's d0aac605f and db2bdff05) and THIRD_PARTY_NOTICES.md.
@@ -64,7 +64,9 @@ def apply_ford_curvature_limits(apply_curvature, apply_curvature_last, current_c
   return apply_curvature
 
 
-def apply_creep_compensation(accel: float, v_ego: float) -> float:
+def apply_creep_compensation(accel: float, v_ego: float, car_fingerprint: str, *, standstill: bool, stopping: bool) -> float:
+  if car_fingerprint == CAR.FORD_MUSTANG_MACH_E_MK1 and not (standstill and stopping):
+    return accel
   creep_accel = np.interp(v_ego, [1., 3.], [0.6, 0.])
   creep_accel = np.interp(accel, [0., 0.2], [creep_accel, 0.])
   accel -= creep_accel
@@ -165,7 +167,7 @@ class CarController(CarControllerBase):
           can_sends.append(starpilot_fordcan.create_lat_ctl2_msg(
             self.packer, self.CAN, 1 if lateral.active else 0,
             lateral.ramp_type, lateral.precision_type,
-            -lateral.curvature, -lateral.curvature_rate, counter))
+            -lateral.curvature, -lateral.curvature_rate, counter, -lateral.path_angle))
         else:
           can_sends.append(starpilot_fordcan.create_lat_ctl_msg(
             self.packer, self.CAN, lateral.active,
@@ -181,12 +183,11 @@ class CarController(CarControllerBase):
     if self.CP.openpilotLongitudinalControl and (self.frame % CarControllerParams.ACC_CONTROL_STEP) == 0:
       accel = actuators.accel
       gas = accel
+      stopping = actuators.longControlState == LongCtrlState.stopping
 
       if CC.longActive:
-        # Compensate for engine creep at low speed.
-        # Either the ABS does not account for engine creep, or the correction is very slow
-        # TODO: verify this applies to EV/hybrid
-        accel = apply_creep_compensation(accel, CS.out.vEgo)
+        accel = apply_creep_compensation(accel, CS.out.vEgo, self.CP.carFingerprint,
+                                         standstill=CS.out.standstill, stopping=stopping)
 
         # The stock system has been seen rate limiting the brake accel to 5 m/s^3,
         # however even 3.5 m/s^3 causes some overshoot with a step response.
@@ -210,7 +211,6 @@ class CarController(CarControllerBase):
       elif accel_pitch_compensated < 0.0:
         self.brake_request = True
 
-      stopping = CC.actuators.longControlState == LongCtrlState.stopping
       # TODO: look into using the actuators packet to send the desired speed
       can_sends.append(fordcan.create_acc_msg(self.packer, self.CAN, CC.longActive, gas, accel, stopping, self.brake_request, v_ego_kph=V_CRUISE_MAX))
 

opendbc_repo/opendbc/car/ford/interface.py

@@ -8,7 +8,7 @@ from opendbc.car.ford.carcontroller import CarController
 from opendbc.car.ford.carstate import CarState
 from opendbc.car.ford.fordcan import CanBus
 from opendbc.car.ford.radar_interface import RadarInterface
-from opendbc.car.ford.values import CarControllerParams, DBC, Ecu, FordFlags, RADAR, FordSafetyFlags
+from opendbc.car.ford.values import CAR, CarControllerParams, DBC, Ecu, FordFlags, RADAR, FordSafetyFlags
 from opendbc.car.interfaces import CarInterfaceBase
 
 TransmissionType = structs.CarParams.TransmissionType
@@ -63,6 +63,8 @@ class CarInterface(CarInterfaceBase):
 
     if ret.flags & FordFlags.CANFD:
       ret.safetyConfigs[-1].safetyParam |= FordSafetyFlags.CANFD.value
+      if candidate == CAR.FORD_MUSTANG_MACH_E_MK1:
+        ret.safetyConfigs[-1].safetyParam |= FordSafetyFlags.MACH_E_CURVATURE.value
 
       # TRON (SecOC) platforms are not supported
       # LateralMotionControl2, ACCDATA are 16 bytes on these platforms

opendbc_repo/opendbc/car/ford/tests/test_ford.py

@@ -9,7 +9,7 @@ import pytest
 from opendbc.car import Bus, gen_empty_fingerprint
 from opendbc.can import CANPacker
 from opendbc.car.ford import fordcan
-from opendbc.car.ford.carcontroller import FordStockCruiseButton
+from opendbc.car.ford.carcontroller import FordStockCruiseButton, apply_creep_compensation
 from opendbc.car.gps import FORD_MACH_E_GPS_MESSAGES, get_car_gps_config, parse_ford_can_gps
 from opendbc.car.structs import CarParams
 from opendbc.car.fw_versions import build_fw_dict
@@ -38,6 +38,17 @@ def test_stock_cruise_button_ignores_press_with_cruise_master_off():
   assert button.update(True, cruise_available=False, cruise_enabled=False) == (False, False)
 
 
+def test_mach_e_does_not_apply_engine_creep_compensation():
+  for accel in (-1.0, -0.1, 0.0, 0.1):
+    assert apply_creep_compensation(accel, 0.5, CAR.FORD_MUSTANG_MACH_E_MK1,
+                                     standstill=False, stopping=False) == accel
+
+  assert apply_creep_compensation(0.0, 0.0, CAR.FORD_MUSTANG_MACH_E_MK1,
+                                   standstill=True, stopping=True) == -0.6
+  assert apply_creep_compensation(0.0, 0.5, CAR.FORD_F_150_MK14,
+                                   standstill=False, stopping=False) == -0.6
+
+
 ECU_ADDRESSES = {
   Ecu.eps: 0x730,          # Power Steering Control Module (PSCM)
   Ecu.abs: 0x760,          # Anti-Lock Brake System (ABS)
@@ -192,10 +203,12 @@ def test_mach_e_longitudinal_toggle_controls_stock_acc_selection():
   assert not stock.openpilotLongitudinalControl
   assert stock.pcmCruise
   assert not (stock.safetyConfigs[-1].safetyParam & FordSafetyFlags.LONG_CONTROL)
+  assert stock.safetyConfigs[-1].safetyParam & FordSafetyFlags.MACH_E_CURVATURE
 
   assert enhanced.alphaLongitudinalAvailable
   assert enhanced.openpilotLongitudinalControl
   assert enhanced.safetyConfigs[-1].safetyParam & FordSafetyFlags.LONG_CONTROL
+  assert enhanced.safetyConfigs[-1].safetyParam & FordSafetyFlags.MACH_E_CURVATURE
 
 
 def test_mach_e_can_gps_decode():

opendbc_repo/opendbc/car/ford/values.py

@@ -50,6 +50,7 @@ class FordSafetyFlags(IntFlag):
   LONG_CONTROL = 1
   CANFD = 2
   LKA_STEERING = 4
+  MACH_E_CURVATURE = 8
 
 
 class FordFlags(IntFlag):

opendbc_repo/opendbc/car/gm/carcontroller.py

@@ -1197,7 +1197,7 @@ class CarController(CarControllerBase):
           # cannot linger after a disengage or main-off event.
           if should_send_bolt_acc_pedal_friction:
             can_sends.append(gmcan.create_friction_brake_command(
-              self.packer_ch, friction_brake_bus, experiment_brake, idx, bolt_acc_pedal_friction_main_on,
+              self.packer_ch, friction_brake_bus, experiment_brake, idx, bolt_acc_pedal_friction_main_on and CC.longActive,
               near_stop, at_full_stop, self.CP))
         if self.CP.carFingerprint not in CC_ONLY_CAR:
           friction_brake_bus = get_friction_brake_bus(self.CP)

opendbc_repo/opendbc/car/hyundai/carcontroller.py

@@ -42,9 +42,11 @@ IONIQ_6_RESPONSE_MULTIPLIER = 1.2
 IONIQ_6_CANFD_SCC_ACCEL_STEP = (6.0 / 50.0) * IONIQ_6_RESPONSE_MULTIPLIER
 IONIQ_6_CANFD_SCC_DECEL_STEP = (15.0 / 50.0) * IONIQ_6_RESPONSE_MULTIPLIER
 EV9_CANFD_SCC_DECEL_STEP = 10.0 / 50.0
-RAY_PEDAL_COMMAND_CAP = 0.35  # Ray firmware voltage scaling is route-derived; validate before raising.
-RAY_PEDAL_RATE_UP = 0.012     # per 25 Hz command (0.30 normalized pedal per second)
+RAY_PEDAL_COMMAND_CAP = 0.55
+RAY_PEDAL_RATE_UP = 0.02
 RAY_PEDAL_RATE_DOWN = 0.06
+RAY_PEDAL_OVERSPEED_CUTOFF = 0.5
+RAY_PEDAL_TAPER_BELOW_TARGET = 0.75
 GENESIS_G90_STOP_HOLD_SPEED_BP = [0.0, 0.03, 0.08, 0.16, 0.3, 0.5, 0.8, 1.2, 2.0, 3.0]
 GENESIS_G90_STOP_HOLD_ACCEL_V = [-0.10, -0.10, -0.12, -0.18, -0.30, -0.50, -0.75, -1.00, -1.40, -1.80]
 GENESIS_G90_STOP_HOLD_RELAX_SPEED_BP = [0.0, 0.08, 0.16, 0.3, 0.5, 0.8, 1.2, 2.0, 3.0]
@@ -441,12 +443,6 @@ def suppress_redundant_gv70_brake_cancel(CP, brake_pressed: bool, lat_active: bo
   )
 
 
-def clear_ioniq_6_torque_when_request_inactive(CP, apply_torque: int, apply_steer_req: bool) -> int:
-  if CP.carFingerprint == CAR.HYUNDAI_IONIQ_6 and not apply_steer_req:
-    return 0
-  return apply_torque
-
-
 class CarController(CarControllerBase):
   def __init__(self, dbc_names, CP):
     super().__init__(dbc_names, CP)
@@ -642,8 +638,6 @@ class CarController(CarControllerBase):
       if not CC.latActive:
         apply_torque = 0
 
-      apply_torque = clear_ioniq_6_torque_when_request_inactive(self.CP, apply_torque, apply_steer_req)
-
       # Hold torque with induced temporary fault when cutting the actuation bit
       # FIXME: we don't use this with CAN FD?
       torque_fault = CC.latActive and not apply_steer_req
@@ -776,7 +770,8 @@ class CarController(CarControllerBase):
     lead_data = self._can_lead_data.update(lead_distance, lead_rel_speed, lead_visible)
 
     # HUD messages
-    sys_warning, sys_state, left_lane_warning, right_lane_warning = process_hud_alert(CC.enabled, self.car_fingerprint,
+    stinger_hud_enabled = CC.enabled or (self.CP.carFingerprint == CAR.KIA_STINGER_2022 and CC.latActive)
+    sys_warning, sys_state, left_lane_warning, right_lane_warning = process_hud_alert(stinger_hud_enabled, self.car_fingerprint,
                                                                                       hud_control)
 
     if blended_hda2:
@@ -817,12 +812,12 @@ class CarController(CarControllerBase):
 
     # Button messages
     if not self.long_active_ecu:
-      if self.cancel_counter > CANCEL_BUTTON_DELAY_FRAMES:
-        can_sends.append(hyundaican.create_clu11(self.packer, self.frame, CS.clu11, Buttons.CANCEL, self.CP))
-      elif self._ray_pedal and CC.longActive and CS.out.cruiseState.enabled:
-        if (self.frame - self.last_button_frame) * DT_CTRL > 0.1:
+      if self._ray_pedal and CC.enabled and CS.out.cruiseState.enabled:
+        if (self.frame - self.last_button_frame) * DT_CTRL > 0.04:
           can_sends.append(hyundaican.create_clu11(self.packer, self.frame, CS.clu11, Buttons.CANCEL, self.CP))
           self.last_button_frame = self.frame
+      elif self.cancel_counter > CANCEL_BUTTON_DELAY_FRAMES:
+        can_sends.append(hyundaican.create_clu11(self.packer, self.frame, CS.clu11, Buttons.CANCEL, self.CP))
       elif CC.cruiseControl.resume and not self._ray_pedal:
         # send resume at a max freq of 10Hz
         if (self.frame - self.last_button_frame) * DT_CTRL > 0.1:
@@ -837,14 +832,29 @@ class CarController(CarControllerBase):
     if self._ray_pedal and self.frame % 4 == 0:
       pedal_ready = CS.ray_pedal_valid and CS.ray_pedal_state == 0
       pedal_active = (CC.longActive and pedal_ready and not CC.cruiseControl.override and
-                      not CS.out.gasPressed and not CS.out.brakePressed and
-                      not CS.out.cruiseState.enabled and CS.out.vEgo >= self.CP.minEnableSpeed)
+                      not CS.out.gasPressed and not CS.out.brakePressed)
       if pedal_active:
-        target = float(np.clip(accel / CarControllerParams.ACCEL_MAX * RAY_PEDAL_COMMAND_CAP,
-                               0.0, RAY_PEDAL_COMMAND_CAP))
-        self._ray_pedal_gas_last = rate_limit(
-          target, self._ray_pedal_gas_last, -RAY_PEDAL_RATE_DOWN, RAY_PEDAL_RATE_UP,
-        )
+        set_speed = hud_control.setSpeed
+        if not np.isfinite(set_speed) or set_speed < 1.0:
+          self._ray_pedal_gas_last = 0.0
+        else:
+          speed_error = set_speed - CS.out.vEgo
+          if speed_error <= -RAY_PEDAL_OVERSPEED_CUTOFF:
+            self._ray_pedal_gas_last = 0.0
+          else:
+            pedal_offset = float(np.interp(CS.out.vEgo, [0., 2., 4., 8., 12., 20.],
+                                           [0.08, 0.13, 0.20, 0.32, 0.42, 0.48]))
+            pedal_gain = 2.0 if accel < 0.0 else 0.22
+            target = float(np.clip(pedal_offset + accel * pedal_gain, 0.0, RAY_PEDAL_COMMAND_CAP))
+            if speed_error < 0.0:
+              target *= float(np.clip(0.65 * (1.0 + speed_error / RAY_PEDAL_OVERSPEED_CUTOFF), 0.0, 1.0))
+            elif speed_error < RAY_PEDAL_TAPER_BELOW_TARGET:
+              target *= 0.65 + 0.35 * speed_error / RAY_PEDAL_TAPER_BELOW_TARGET
+            if target <= 0.001:
+              self._ray_pedal_gas_last = 0.0
+            else:
+              next_gas = rate_limit(target, self._ray_pedal_gas_last, -RAY_PEDAL_RATE_DOWN, RAY_PEDAL_RATE_UP)
+              self._ray_pedal_gas_last = min(next_gas, target)
       else:
         self._ray_pedal_gas_last = 0.0
       can_sends.append(create_gas_interceptor_command(

opendbc_repo/opendbc/car/hyundai/fingerprints.py

@@ -1556,6 +1556,7 @@ FW_VERSIONS = {
   },
   CAR.HYUNDAI_STARIA_4TH_GEN: {
     (Ecu.fwdCamera, 0x7c4, None): [
+      b'\xf1\x00US4 MFC  AT AUS RHD 1.00 1.04 99211-CG000 210819',
       b'\xf1\x00US4 MFC  AT KOR LHD 1.00 1.06 99211-CG000 230524',
     ],
     (Ecu.fwdRadar, 0x7d0, None): [

opendbc_repo/opendbc/car/hyundai/hyundaicanfd.py

@@ -12,7 +12,7 @@ _adrv_0x51_templates: dict[CAR, bytes] = {}
 
 
 def cache_adrv_0x51_template(car_fingerprint: CAR, dat: bytes | None) -> None:
-  if car_fingerprint != CAR.KIA_EV6:
+  if car_fingerprint not in (CAR.KIA_EV6, CAR.GENESIS_GV70_ELECTRIFIED_1ST_GEN):
     return
 
   if dat is None:
@@ -26,7 +26,6 @@ def create_adrv_0x51(packer, CAN, frame: int, car_fingerprint: CAR | None = None
   if template is None:
     return packer.make_can_msg("ADRV_0x51", CAN.ACAN, {})
 
-  # EV6 MRR30 tracks stop when the ADAS takeover replaces this platform payload with zeros.
   dat = bytearray(template)
   dat[2] = (template[2] + frame + 1) & 0xFF
   dat[3] = (dat[3] & ~0x1) | int(drive_gear)

opendbc_repo/opendbc/car/hyundai/interface.py

@@ -201,6 +201,8 @@ class CarInterface(CarInterfaceBase):
       if ret.flags & HyundaiFlags.CANFD_ANGLE_STEERING:
         ret.steerControlType = structs.CarParams.SteerControlType.angle
         ret.safetyConfigs[-1].safetyParam |= HyundaiSafetyFlags.CANFD_ANGLE_STEERING.value
+        if candidate == CAR.KIA_SPORTAGE_HEV_2026:
+          ret.safetyConfigs[-1].safetyParam |= HyundaiStarPilotSafetyFlags.CANFD_NO_STOCK_LKA.value
       if candidate == CAR.HYUNDAI_IONIQ_6:
         # Keep lateral active through stops: zeroing torque at standstill dropped the
         # stop-turn hold and forced a rate-limit re-ramp from zero on every pull-away
@@ -313,7 +315,7 @@ class CarInterface(CarInterfaceBase):
       ret.pcmCruise = False
       ret.radarUnavailable = True
       ret.autoResumeSng = False
-      ret.minEnableSpeed = 5.0  # pedal-only: no commanded friction brake/standstill hold
+      ret.minEnableSpeed = -1.0
       ret.safetyConfigs[-1].safetyParam |= HyundaiSafetyFlags.LONG.value
 
     # Car specific configuration overrides
@@ -331,8 +333,8 @@ class CarInterface(CarInterfaceBase):
 
     if candidate == CAR.HYUNDAI_ELANTRA_2021:
       ret.longitudinalActuatorDelay = 0.22
-      ret.stopAccel = -0.85
-      ret.stoppingDecelRate = 0.35
+      ret.stopAccel = -1.1
+      ret.stoppingDecelRate = 0.55
 
     if candidate == CAR.HYUNDAI_ELANTRA_HEV_2024:
       ret.longitudinalActuatorDelay = 0.22
@@ -393,7 +395,7 @@ class CarInterface(CarInterfaceBase):
 
       if not skip_disable_ecu:
         disable_can_recv = can_recv
-        if CP.carFingerprint == CAR.KIA_EV6 and can_recv is not None:
+        if CP.carFingerprint in (CAR.KIA_EV6, CAR.GENESIS_GV70_ELECTRIFIED_1ST_GEN) and can_recv is not None:
           hyundaicanfd.cache_adrv_0x51_template(CP.carFingerprint, None)
           base_can_recv = can_recv
           adrv_bus = CanBus(CP).ACAN

opendbc_repo/opendbc/car/hyundai/tests/test_hyundai.py

@@ -20,8 +20,7 @@ from opendbc.car.hyundai.carcontroller import CarController, CANCEL_BUTTON_DELAY
                                              should_track_stop_accel_directly_for_car, \
                                              preserve_stock_canfd_lfa_status, \
                                              preserve_stock_canfd_lkas_status, \
-                                             suppress_redundant_gv70_brake_cancel, \
-                                             clear_ioniq_6_torque_when_request_inactive
+                                             suppress_redundant_gv70_brake_cancel
 from opendbc.car.hyundai.carstate import CarState, decode_canfd_camera_lead, decode_ioniq_6_blindspot_radar_state, \
                                              get_canfd_cruise_available
 from opendbc.car.hyundai.interface import CarInterface, KIA_EV9_ACCEL_MAX, get_communication_control_request
@@ -553,6 +552,13 @@ class TestHyundaiFingerprint:
     CP = CarInterface.get_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], False, False, False, None)
     assert CP.flags & HyundaiFlags.SEND_LFA
 
+  @pytest.mark.parametrize("candidate", list(CAR))
+  def test_no_stock_lka_safety_flag_is_sportage_only(self, candidate):
+    CP = CarInterface.get_params(candidate, gen_empty_fingerprint(), [], False, False, False, None)
+    if CP.flags & HyundaiFlags.CANFD:
+      assert bool(CP.safetyConfigs[-1].safetyParam & HyundaiStarPilotSafetyFlags.CANFD_NO_STOCK_LKA) == \
+        (candidate == CAR.KIA_SPORTAGE_HEV_2026)
+
   def test_smart_mdps_allows_low_speed_steering(self):
     candidate = CAR.HYUNDAI_IONIQ_EV_LTD
 
@@ -680,14 +686,7 @@ class TestHyundaiFingerprint:
     assert not (CP.flags & HyundaiFlags.CANFD_LKA_STEERING)
     assert bool(CP.flags & HyundaiFlags.CANFD_CAMERA_SCC)
 
-  def test_ioniq_6_clears_torque_with_inactive_safety_request(self):
-    ioniq_6_cp = SimpleNamespace(carFingerprint=CAR.HYUNDAI_IONIQ_6)
-    other_cp = SimpleNamespace(carFingerprint=CAR.KIA_EV6)
-
-    assert clear_ioniq_6_torque_when_request_inactive(ioniq_6_cp, -409, False) == 0
-    assert clear_ioniq_6_torque_when_request_inactive(ioniq_6_cp, -409, True) == -409
-    assert clear_ioniq_6_torque_when_request_inactive(other_cp, -409, False) == -409
-
+  def test_palisade_2023_uses_can_canfd_blended_layout(self):
     palisade_2023 = CarInterface.get_params(CAR.HYUNDAI_PALISADE_2023, gen_empty_fingerprint(), [], True, False, False, None)
     assert palisade_2023.flags & HyundaiFlags.CAN_CANFD_BLENDED
     assert DBC[palisade_2023.carFingerprint][Bus.pt] == "hyundai_palisade_2023_generated"
@@ -1087,6 +1086,31 @@ class TestHyundaiFingerprint:
 
     assert not (FPCP.flags & HyundaiStarPilotFlags.HAS_LKAS12)
 
+  @pytest.mark.parametrize("length, expected", ((6, True), (8, False)))
+  def test_stinger_only_replaces_six_byte_lkas12(self, length, expected):
+    fingerprint = gen_empty_fingerprint()
+    fingerprint[2][0x53E] = length
+    CP = CarInterface.get_params(CAR.KIA_STINGER_2022, fingerprint, [], True, False, False, None)
+    FPCP = CarInterface.get_starpilot_params(CAR.KIA_STINGER_2022, fingerprint, [], CP, get_test_toggles())
+
+    assert bool(FPCP.flags & HyundaiStarPilotFlags.HAS_LKAS12) is expected
+
+  @pytest.mark.parametrize("alpha_long, main_aol, expected", (
+    (True, True, True), (True, False, True), (False, True, False),
+  ))
+  def test_stinger_aol_latches_lkas_after_long_engagement(self, alpha_long, main_aol, expected):
+    toggles = get_test_toggles()
+    toggles.always_on_lateral_main = main_aol
+    fingerprint = gen_empty_fingerprint()
+    CP = CarInterface.get_params(CAR.KIA_STINGER_2022, fingerprint, [], alpha_long, False, False, toggles)
+    FPCP = CarInterface.get_starpilot_params(CAR.KIA_STINGER_2022, fingerprint, [], CP, toggles)
+
+    assert bool(FPCP.safetyConfigs[-1].safetyParam & HyundaiStarPilotSafetyFlags.AOL_LKAS_ON_ENGAGE) is expected
+
+    sonata_cp = CarInterface.get_params(CAR.HYUNDAI_SONATA, fingerprint, [], alpha_long, False, False, toggles)
+    sonata_fpcp = CarInterface.get_starpilot_params(CAR.HYUNDAI_SONATA, fingerprint, [], sonata_cp, toggles)
+    assert not (sonata_fpcp.safetyConfigs[-1].safetyParam & HyundaiStarPilotSafetyFlags.AOL_LKAS_ON_ENGAGE)
+
   def test_ray_ev_does_not_treat_eight_byte_485_as_lfa(self):
     fingerprint = gen_empty_fingerprint()
     fingerprint[2][0x485] = 8
@@ -1292,6 +1316,103 @@ class TestHyundaiFingerprint:
     assert canfd_alt_buttons_cp.flags & HyundaiFlags.CANFD_ALT_BUTTONS
     assert not canfd_alt_buttons_fpcp.redneckCruiseAvailable
 
+  def test_sportage_hev_hda2_redneck_uses_stock_scc(self, monkeypatch):
+    class FakeParams:
+      def __init__(self, *args, **kwargs):
+        pass
+
+      @staticmethod
+      def get_bool(key):
+        return key == "RedneckCruise"
+
+    monkeypatch.setattr("opendbc.car.interfaces.Params", FakeParams)
+    toggles = get_test_toggles()
+    fingerprint = gen_empty_fingerprint()
+    can_bus = CanBus(None, fingerprint, True)
+    fingerprint[can_bus.CAM][0x110] = 32
+    fingerprint[can_bus.ECAN][0x1CF] = 8
+
+    CP = CarInterface.get_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], False, False, False, toggles)
+    FPCP = CarInterface.get_starpilot_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], CP, toggles)
+
+    assert CP.flags & HyundaiFlags.CANFD_LKA_STEERING
+    assert FPCP.redneckCruiseAvailable
+    assert not FPCP.pcmCruiseSpeed
+    assert CP.pcmCruise
+    assert not CP.openpilotLongitudinalControl
+    assert not CP.safetyConfigs[-1].safetyParam & HyundaiSafetyFlags.LONG
+    controller = CarInterface(CP, FPCP).CC
+    assert not controller.long_active_ecu
+
+    controller.frame = 30
+    CS = SimpleNamespace(redneck_send_button=1, buttons_counter=5)
+    msgs = controller._create_canfd_redneck_button_messages(CS)
+    assert len(msgs) == 20
+    assert all(msg[0] == 0x1CF and msg[2] == can_bus.ECAN for msg in msgs)
+    assert all(msg[1][2] & 0x7 == Buttons.RES_ACCEL for msg in msgs)
+
+    controller.frame = 60
+    CS.redneck_send_button = 2
+    msgs = controller._create_canfd_redneck_button_messages(CS)
+    assert len(msgs) == 20
+    assert all(msg[1][2] & 0x7 == Buttons.SET_DECEL for msg in msgs)
+
+    monkeypatch.setattr(FakeParams, "get_bool", staticmethod(lambda key: False))
+    CP = CarInterface.get_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], False, False, False, toggles)
+    FPCP = CarInterface.get_starpilot_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], CP, toggles)
+    assert FPCP.redneckCruiseAvailable
+    assert FPCP.pcmCruiseSpeed
+    assert CP.pcmCruise
+    assert not CP.openpilotLongitudinalControl
+
+  def test_sportage_redneck_rejects_unverified_button_layouts(self, monkeypatch):
+    class FakeParams:
+      def __init__(self, *args, **kwargs):
+        pass
+
+      @staticmethod
+      def get_bool(key):
+        return key == "RedneckCruise"
+
+    monkeypatch.setattr("opendbc.car.interfaces.Params", FakeParams)
+    toggles = get_test_toggles()
+    for button_address, button_bus, button_length, lka_steering in (
+      (0x1AA, 1, 16, True),
+      (0x1CF, 0, 8, True),
+      (0x1CF, 0, 8, False),
+      (0x1CF, 1, 16, True),
+    ):
+      fingerprint = gen_empty_fingerprint()
+      can_bus = CanBus(None, fingerprint, lka_steering)
+      if lka_steering:
+        fingerprint[can_bus.CAM][0x110] = 32
+      fingerprint[button_bus][button_address] = button_length
+
+      CP = CarInterface.get_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], False, False, False, toggles)
+      FPCP = CarInterface.get_starpilot_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], CP, toggles)
+      assert not FPCP.redneckCruiseAvailable
+      assert FPCP.pcmCruiseSpeed
+      assert CP.pcmCruise
+      assert not CP.openpilotLongitudinalControl
+
+    fingerprint = gen_empty_fingerprint()
+    can_bus = CanBus(None, fingerprint, True)
+    fingerprint[can_bus.CAM][0x110] = 32
+    fingerprint[can_bus.ECAN][0x1CF] = 8
+    fingerprint[can_bus.ECAN][0x1AA] = 16
+    CP = CarInterface.get_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], False, False, False, toggles)
+    FPCP = CarInterface.get_starpilot_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], CP, toggles)
+    assert not FPCP.redneckCruiseAvailable
+
+    fingerprint = gen_empty_fingerprint()
+    can_bus = CanBus(None, fingerprint, True)
+    fingerprint[can_bus.CAM][0x110] = 32
+    fingerprint[can_bus.ECAN][0x1CF] = 8
+    CP = CarInterface.get_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], False, False, False, toggles)
+    CP.openpilotLongitudinalControl = True
+    FPCP = CarInterface.get_starpilot_params(CAR.KIA_SPORTAGE_HEV_2026, fingerprint, [], CP, toggles)
+    assert not FPCP.redneckCruiseAvailable
+
   def test_hyundai_non_scc_without_redneck_keeps_stock_longitudinal_mode(self, monkeypatch):
     class FakeParams:
       def __init__(self, *args, **kwargs):
@@ -1631,8 +1752,8 @@ class TestHyundaiFingerprint:
     CP = CarInterface.get_params(CAR.HYUNDAI_ELANTRA_2021, gen_empty_fingerprint(), [], True, False, False, toggles)
 
     assert CP.longitudinalActuatorDelay == pytest.approx(0.22)
-    assert CP.stopAccel == pytest.approx(-0.85)
-    assert CP.stoppingDecelRate == pytest.approx(0.35)
+    assert CP.stopAccel == pytest.approx(-1.1)
+    assert CP.stoppingDecelRate == pytest.approx(0.55)
 
   def test_elantra_hev_2024_longitudinal_delay_matches_observed_response(self):
     toggles = get_test_toggles()
@@ -1675,6 +1796,20 @@ class TestHyundaiFingerprint:
     assert exact
     assert matches == {candidate}
 
+  def test_staria_2023_australian_route_fw_exact_matches(self):
+    route_fw = {
+      (Ecu.fwdCamera, 0x7c4): b'\xf1\x00US4 MFC  AT AUS RHD 1.00 1.04 99211-CG000 210819',
+      (Ecu.fwdRadar, 0x7d0): b'\xf1\x00US4_ RDR -----      1.00 1.00 99110-CG000         ',
+    }
+    car_fw = [
+      CarParams.CarFw(ecu=ecu, fwVersion=version, address=address, subAddress=0, brand="hyundai")
+      for (ecu, address), version in route_fw.items()
+    ]
+
+    exact, matches = match_fw_to_car(car_fw, "KMFYFX71MPU095311", allow_fuzzy=False, log=False)
+    assert exact
+    assert matches == {CAR.HYUNDAI_STARIA_4TH_GEN}
+
   def test_kona_ev_non_scc_has_no_dedicated_fw_coverage(self):
     assert CAR.HYUNDAI_KONA_EV_NON_SCC not in FW_VERSIONS
 

opendbc_repo/opendbc/car/hyundai/tests/test_ray_pedal.py

@@ -32,7 +32,7 @@ def test_ray_pedal_fingerprint_isolation(candidate, fingerprint, has_pedal):
   if has_pedal:
     assert not CP.pcmCruise
     assert CP.safetyConfigs[-1].safetyParam == 0x9405
-    assert CP.minEnableSpeed == 5.0
+    assert CP.minEnableSpeed == -1.0
     assert not CP.autoResumeSng
     FPCP = CarInterface.get_starpilot_params(candidate, fingerprint, [], CP, SimpleNamespace())
     assert FPCP.canUsePedal
@@ -128,13 +128,14 @@ def test_ray_without_pedal_keeps_native_gas_detection():
   assert ret.gasPressed
 
 
-def test_ray_controller_heartbeats_and_only_actuates_when_ready():
+@pytest.mark.parametrize("speed", [0.0, 0.1, 1.0, 4.9, 5.0, 12.0])
+def test_ray_controller_heartbeats_and_only_actuates_when_ready(speed):
   CP = CarInterface.get_params(CAR.KIA_RAY_EV, ray_fingerprint(), [], False, False, False, None)
   controller = CarController(DBC[CP.carFingerprint], CP)
   parser = CANParser(DBC[CP.carFingerprint][Bus.pt], [("LKAS11", 0), ("CLU11", 0)], 0)
   CS = SimpleNamespace(
     lkas11=parser.vl["LKAS11"], clu11=parser.vl["CLU11"],
-    out=SimpleNamespace(vEgo=12.0, gasPressed=False, brakePressed=False,
+    out=SimpleNamespace(vEgo=speed, gasPressed=False, brakePressed=False,
                         cruiseState=SimpleNamespace(enabled=False)),
     ray_pedal_valid=True, ray_pedal_state=5, is_metric=True,
   )
@@ -144,6 +145,7 @@ def test_ray_controller_heartbeats_and_only_actuates_when_ready():
   )
   hud = SimpleNamespace(
     visualAlert=CarControl.HUDControl.VisualAlert.none,
+    setSpeed=20.0,
     leftLaneVisible=True, rightLaneVisible=True,
     leftLaneDepart=False, rightLaneDepart=False,
   )
@@ -166,5 +168,124 @@ def test_ray_controller_heartbeats_and_only_actuates_when_ready():
   controller.frame = 16
   messages = controller.create_can_msgs(True, 0, False, 0.0, 2.0, False,
                                         hud, actuators, CS, CC, 2, 0)
-  assert next(dat for addr, dat, bus in messages if addr == 0x200 and bus == 0)[:4] == bytes(4)
-  assert any(addr == 0x4F1 and bus == 0 for addr, _, bus in messages)  # cancel stock CC
+  assert next(dat for addr, dat, bus in messages if addr == 0x200 and bus == 0)[4] & 0x80
+  assert any(addr == 0x4F1 and bus == 0 and dat[0] & 7 == 4 for addr, dat, bus in messages)
+
+  CS.out.cruiseState.enabled = False
+  CS.out.brakePressed = True
+  assert pedal_msg(2.0, 20)[:4] == bytes(4)
+  CS.out.brakePressed = False
+  assert pedal_msg(2.0, 24)[4] & 0x80
+  assert controller._ray_pedal_gas_last == pytest.approx(0.02)
+  assert pedal_msg(2.0, 28)[4] & 0x80
+  assert controller._ray_pedal_gas_last == pytest.approx(0.04)
+  CS.out.brakePressed = True
+  assert pedal_msg(2.0, 32)[:4] == bytes(4)
+  assert controller._ray_pedal_gas_last == 0.0
+  CS.out.brakePressed = False
+  assert pedal_msg(2.0, 36)[4] & 0x80
+  assert controller._ray_pedal_gas_last == pytest.approx(0.02)
+
+  CC.longActive = False
+  assert pedal_msg(2.0, 40)[:4] == bytes(4)
+  CC.longActive = True
+  CC.cruiseControl.override = True
+  assert pedal_msg(2.0, 44)[:4] == bytes(4)
+  CC.cruiseControl.override = False
+  CS.ray_pedal_valid = False
+  assert pedal_msg(2.0, 48)[:4] == bytes(4)
+  CS.ray_pedal_valid = True
+  for fault in range(1, 6):
+    CS.ray_pedal_state = fault
+    assert pedal_msg(2.0, 48 + 4 * fault)[:4] == bytes(4)
+
+  CS.ray_pedal_state = 0
+  CS.out.vEgo = 10.0
+  assert pedal_msg(0.0, 72)[4] & 0x80
+  assert pedal_msg(-1.0, 76)[:4] == bytes(4)
+
+  CS.out.vEgo = 12.0
+  for frame in range(80, 80 + 4 * 40, 4):
+    pedal_msg(1.5, frame)
+  assert controller._ray_pedal_gas_last == pytest.approx(0.55)
+  for frame in range(240, 240 + 4 * 12, 4):
+    dat = pedal_msg(-1.5, frame)
+  assert dat[:4] == bytes(4)
+
+  for frame in range(288, 288 + 4 * 40, 4):
+    pedal_msg(1.5, frame)
+  assert controller._ray_pedal_gas_last == pytest.approx(0.55)
+  hud.setSpeed = 12.0
+  pedal_msg(1.5, 448)
+  assert controller._ray_pedal_gas_last == pytest.approx(0.55 * 0.65)
+  hud.setSpeed = 11.8
+  dat = pedal_msg(1.5, 452)
+  assert controller._ray_pedal_gas_last == pytest.approx(0.55 * 0.65 * 0.6)
+  assert dat[4] & 0x80
+  hud.setSpeed = 11.4
+  assert pedal_msg(1.5, 456)[:4] == bytes(4)
+  hud.setSpeed = float('nan')
+  assert pedal_msg(1.5, 460)[:4] == bytes(4)
+  hud.setSpeed = 20.0
+  assert pedal_msg(-0.3, 464)[:4] == bytes(4)
+  CS.out.vEgo = 15.0
+  hud.setSpeed = 53.0 / 3.6
+  pedal_msg(-0.16, 468)
+  assert controller._ray_pedal_gas_last < 0.1
+  CS.out.vEgo = 12.0
+  hud.setSpeed = 8.0 / 3.6
+  assert pedal_msg(-0.3, 472)[:4] == bytes(4)
+  hud.setSpeed = 145.0 / 3.6
+  assert pedal_msg(1.5, 476)[4] & 0x80
+  assert controller._ray_pedal_gas_last == pytest.approx(0.02)
+  assert pedal_msg(1.5, 480)[4] & 0x80
+  assert controller._ray_pedal_gas_last == pytest.approx(0.04)
+  assert pedal_msg(-0.3, 484)[:4] == bytes(4)
+
+
+@pytest.mark.parametrize("candidate", [CAR.KIA_RAY_EV, CAR.HYUNDAI_KONA_EV_NON_SCC])
+def test_ray_stock_cruise_cancellation_survives_accelerator_override(candidate):
+  CP = CarInterface.get_params(candidate, ray_fingerprint(), [], False, False, False, None)
+  controller = CarController(DBC[CP.carFingerprint], CP)
+  parser = CANParser(DBC[CP.carFingerprint][Bus.pt], [("LKAS11", 0), ("CLU11", 0)], 0)
+  CS = SimpleNamespace(
+    lkas11=parser.vl["LKAS11"], clu11=parser.vl["CLU11"],
+    out=SimpleNamespace(vEgo=12.0, gasPressed=True, brakePressed=False,
+                        cruiseState=SimpleNamespace(enabled=True)),
+    ray_pedal_valid=True, ray_pedal_state=0, is_metric=True,
+  )
+  CC = SimpleNamespace(
+    enabled=True, longActive=False, latActive=True,
+    cruiseControl=SimpleNamespace(cancel=False, resume=False, override=True),
+  )
+  hud = SimpleNamespace(
+    visualAlert=CarControl.HUDControl.VisualAlert.none,
+    setSpeed=20.0,
+    leftLaneVisible=True, rightLaneVisible=True, leftLaneDepart=False, rightLaneDepart=False,
+  )
+  actuators = SimpleNamespace(longControlState=CarControl.Actuators.LongControlState.off)
+  controller._create_can_redneck_button_messages = lambda _: []
+
+  def messages(frame):
+    controller.frame = frame
+    return controller.create_can_msgs(True, 0, False, 0.0, 2.0, False,
+                                      hud, actuators, CS, CC, 2, 0)
+
+  def cancel_frames(msgs):
+    return [dat for addr, dat, bus in msgs if addr == 0x4F1 and bus == 0 and dat[0] & 7 == 4]
+
+  msgs = messages(20)
+  assert bool(cancel_frames(msgs)) is (candidate == CAR.KIA_RAY_EV)
+  if candidate == CAR.KIA_RAY_EV:
+    pedal = next(dat for addr, dat, bus in msgs if addr == 0x200 and bus == 0)
+    assert pedal[:4] == bytes(4)
+    assert not (pedal[4] & 0x80)
+    assert not cancel_frames(messages(24))  # retain the existing cancellation rate limit
+    assert cancel_frames(messages(25))
+    assert cancel_frames(messages(32))
+
+  CS.out.cruiseState.enabled = False
+  assert not cancel_frames(messages(44))
+  CS.out.cruiseState.enabled = True
+  CC.enabled = False
+  assert not cancel_frames(messages(56))  # AOL alone must not cancel native cruise

opendbc_repo/opendbc/car/hyundai/values.py

@@ -117,6 +117,7 @@ class HyundaiSafetyFlags(IntFlag):
 
 
 class HyundaiStarPilotSafetyFlags(IntFlag):
+  CANFD_NO_STOCK_LKA = 4096  # CAN-FD only; classic CAN uses this bit for NON_SCC.
   AOL_MAIN_LKAS_ON_ENGAGE = 128
   AOL_MAIN_LKAS_SYNC = 32
   HAS_LDA_BUTTON = 1024

opendbc_repo/opendbc/car/interfaces.py

@@ -244,15 +244,28 @@ class CarInterfaceBase(ABC):
           if 0x1FA in fingerprint[CAN.ECAN]:
             fp_ret.flags |= HyundaiStarPilotFlags.SPEED_LIMIT_AVAILABLE.value
 
-        if candidate != HYUNDAI.KIA_RAY_EV and not (CP.flags & HyundaiFlags.CANFD) and 0x53E in fingerprint[2]:
+        if candidate != HYUNDAI.KIA_RAY_EV and not (CP.flags & HyundaiFlags.CANFD) and 0x53E in fingerprint[2] and \
+            (candidate != HYUNDAI.KIA_STINGER_2022 or fingerprint[2][0x53E] == 6):
           fp_ret.flags |= HyundaiStarPilotFlags.HAS_LKAS12.value
 
-        fp_ret.redneckCruiseAvailable = (bool(CP.flags & HyundaiFlags.NON_SCC) and
-                                         not bool(CP.flags & HyundaiFlags.CANFD_ALT_BUTTONS) and
-                                         not (candidate == HYUNDAI.KIA_RAY_EV and CP.enableGasInterceptorDEPRECATED))
+        sportage_stock_scc_buttons = (
+          candidate == HYUNDAI.KIA_SPORTAGE_HEV_2026 and
+          not CP.openpilotLongitudinalControl and
+          bool(CP.flags & HyundaiFlags.CANFD_LKA_STEERING) and
+          not bool(CP.flags & HyundaiFlags.CANFD_ALT_BUTTONS) and
+          fingerprint[CAN.ECAN].get(0x1CF) == 8 and
+          0x1AA not in fingerprint[CAN.ECAN]
+        )
+        fp_ret.redneckCruiseAvailable = (
+          (bool(CP.flags & HyundaiFlags.NON_SCC) and
+           not bool(CP.flags & HyundaiFlags.CANFD_ALT_BUTTONS) and
+           not (candidate == HYUNDAI.KIA_RAY_EV and CP.enableGasInterceptorDEPRECATED)) or
+          sportage_stock_scc_buttons
+        )
         if fp_ret.redneckCruiseAvailable and params.get_bool("RedneckCruise"):
           fp_ret.pcmCruiseSpeed = False
-          CP.openpilotLongitudinalControl = True
+          if CP.flags & HyundaiFlags.NON_SCC:
+            CP.openpilotLongitudinalControl = True
 
         if candidate == HYUNDAI.HYUNDAI_ELANTRA_HEV_2024 and CP.openpilotLongitudinalControl:
           fp_ret.flags |= HyundaiStarPilotFlags.MAIN_CRUISE_STATE_TRACKING.value
@@ -275,6 +288,9 @@ class CarInterfaceBase(ABC):
           if candidate == HYUNDAI.HYUNDAI_SONATA_HYBRID:
             fp_ret.safetyConfigs[-1].safetyParam |= HyundaiStarPilotSafetyFlags.AOL_LKAS_ON_ENGAGE.value
 
+        if candidate == HYUNDAI.KIA_STINGER_2022 and CP.openpilotLongitudinalControl:
+          fp_ret.safetyConfigs[-1].safetyParam |= HyundaiStarPilotSafetyFlags.AOL_LKAS_ON_ENGAGE.value
+
         # The refresh Elantra's safety mapping comes from the resolved Galaxy
         # toggle above, not from this legacy persisted-parameter fallback.
         if candidate != HYUNDAI.HYUNDAI_ELANTRA_HEV_2024 and \

opendbc_repo/opendbc/car/subaru/avh.py

@@ -0,0 +1,95 @@
+"""One bounded Legacy AVH ON request; 0x32B is status, never a TX command."""
+
+AVH_REQUEST = 0x6BB
+AVH_STATUS = 0x32B
+INPUTS = (AVH_REQUEST, AVH_STATUS, 0x40, 0x48, 0x13A, 0x174)
+
+
+def checksum(address, data):
+  return ((address & 0xFF) + (address >> 8) + sum(data[1:])) & 0xFF
+
+
+def avh_request(template, step):
+  if len(template) != 8 or checksum(AVH_REQUEST, template) != template[0] or template[2] & 3 or step not in (1, 2):
+    raise ValueError("Invalid AVH template or counter step")
+  data = bytearray(template)
+  data[1] = (data[1] & 0xF0) | ((data[1] + step) & 0xF)
+  data[2] |= 2
+  data[0] = checksum(AVH_REQUEST, data)
+  return AVH_REQUEST, bytes(data), 1
+
+
+class AvhStartup:
+  def __init__(self):
+    self.started = None
+    self.last_time = None
+    self.stable_since = None
+    self.frames = {}
+    self.done = False
+    self.followup = None
+
+  def update(self, now, frames, enabled, can_valid, controls_active):
+    if self.started is None:
+      self.started = now
+    if self.last_time is not None and now < self.last_time:
+      self.done = True
+    self.last_time = now
+    if self.done:
+      return []
+    if now - self.started > 30 or controls_active:
+      self.done = True
+      return []
+
+    for address, (timestamp, data) in frames.items():
+      if address not in INPUTS or timestamp <= 0:
+        continue
+      previous = self.frames.get(address)
+      if previous and timestamp == previous[0]:
+        continue
+      if len(data) != 8 or checksum(address, data) != data[0] or timestamp > now or (previous and timestamp < previous[0]):
+        self.done = True
+        return []
+      if (address == AVH_REQUEST and data[2] & 3) or (address == AVH_STATUS and data[5] & 0x20) or \
+         (address == 0x48 and data[3] != 4) or (address == 0x40 and data[4]) or \
+         (address == 0x13A and any((int.from_bytes(data, 'little') >> bit) & 0x1FFF for bit in (12, 25, 38, 51))):
+        self.done = True
+        return []
+      if previous and (data[1] & 15) == (previous[1][1] & 15):
+        continue  # duplicate counters cannot refresh freshness
+      # Controller snapshots can skip 50/100 Hz samples between updates. Panda
+      # checks their full counter stream; require consecutive head-unit frames here.
+      sequential = bool(previous and (address not in (AVH_REQUEST, AVH_STATUS) or
+                                     (data[1] & 15) == ((previous[1][1] + 1) & 15)))
+      self.frames[address] = (timestamp, data, sequential)
+
+    fresh = all(a in self.frames and self.frames[a][2] and
+                0 <= now - self.frames[a][0] <= (1.5 if a == AVH_REQUEST else 0.3) for a in INPUTS)
+    if not enabled or not can_valid or not fresh:
+      self.stable_since = None
+      if self.followup is not None:
+        self.done = True
+      return []
+    throttle = self.frames[0x40][1]
+    rpm = int.from_bytes(throttle[2:4], 'little') & 0x1FFF
+    if rpm < 400 or not self.frames[0x174][1][2] & 8:
+      self.stable_since = None
+      if self.followup is not None:
+        self.done = True
+      return []
+    if self.stable_since is None:
+      self.stable_since = now
+    if self.followup is not None:
+      sent, timestamp, template = self.followup
+      if now - sent > 0.075 or self.frames[AVH_REQUEST][0] != timestamp:
+        self.done = True
+      elif now - sent >= 0.05:
+        self.done = True
+        return [avh_request(template, 2)]
+      return []
+    if now - self.started < 10 or now - self.stable_since < 3:
+      return []
+    timestamp, template, _ = self.frames[AVH_REQUEST]
+    if now - timestamp > 0.010:
+      return []
+    self.followup = (now, timestamp, template)
+    return [avh_request(template, 1)]

opendbc_repo/opendbc/car/subaru/carcontroller.py

@@ -4,6 +4,7 @@ from opendbc.car import Bus, DT_CTRL, make_tester_present_msg, structs
 from opendbc.car.lateral import apply_driver_steer_torque_limits, apply_std_steer_angle_limits, apply_steer_angle_limits_vm, common_fault_avoidance
 from opendbc.car.interfaces import CarControllerBase
 from opendbc.car.subaru import subarucan
+from opendbc.car.subaru.avh import AvhStartup
 from opendbc.car.subaru.values import CAR, DBC, GLOBAL_ES_ADDR, SUBARU_STOP_START_CARS, CanBus, CarControllerParams, SubaruFlags
 from opendbc.car.vehicle_model import VehicleModel
 
@@ -45,6 +46,7 @@ class CarController(CarControllerBase):
     self.angle_override_confirm_frames = 0
     self.angle_lkas_active = False
     self.angle_handoff_active = False
+    self.ascent_angle_initialized = False
     self.ascent_aol_arm_frames = 0
 
     self.cruise_button_prev = 0
@@ -69,6 +71,7 @@ class CarController(CarControllerBase):
     self.stop_start_counter = 0
     self.stop_start_acknowledged = False
     self.last_redneck_button_frame = 0
+    self.avh_startup = AvhStartup()
 
   def _stop_start_off_request(self, CC, CS, starpilot_toggles):
     """Send one bounded Subaru Stop/Start OFF request after ignition.
@@ -202,6 +205,10 @@ class CarController(CarControllerBase):
       return subarucan.create_steering_control_angle(self.packer, apply_steer, lkas_active, self.angle_bus)
 
     if self.CP.carFingerprint in (CAR.SUBARU_ASCENT_2023, CAR.SUBARU_OUTBACK_2023):
+      if self.CP.carFingerprint == CAR.SUBARU_ASCENT_2023 and not self.ascent_angle_initialized:
+        self.apply_steer_last = CS.out.steeringAngleDeg
+        self.ascent_angle_initialized = True
+
       mads_only = CC.latActive and not CC.enabled
       mads_only_ok = CS.out.vEgoRaw > _ANGLE_MADS_MIN_SPEED and \
         abs(CS.out.steeringAngleDeg) < _ANGLE_MADS_MAX_STEER_ANGLE
@@ -215,12 +222,13 @@ class CarController(CarControllerBase):
           self.ascent_aol_arm_frames = _ASCENT_AOL_ARM_FRAMES if lkas_available else 0
 
       if self.CP.carFingerprint == CAR.SUBARU_OUTBACK_2023:
-        manual_handoff = False
+        manual_handoff = not self.angle_lkas_active and \
+          abs(getattr(CS.out, "steeringRateDeg", 0.0)) > _ANGLE_REENGAGE_MAX_STEER_RATE
       else:
         manual_handoff = self._angle_manual_handoff(CS, lkas_available)
       lkas_active = lkas_available and not manual_handoff
 
-      if lkas_active and not self.angle_lkas_active:
+      if lkas_active and not self.angle_lkas_active and self.CP.carFingerprint != CAR.SUBARU_ASCENT_2023:
         self.apply_steer_last = CS.out.steeringAngleDeg
 
       apply_steer = apply_std_steer_angle_limits(
@@ -307,6 +315,13 @@ class CarController(CarControllerBase):
     if stop_start_msg is not None:
       can_sends.append(stop_start_msg)
 
+    if self.CP.carFingerprint == CAR.SUBARU_LEGACY_2025:
+      can_sends.extend(self.avh_startup.update(
+        now_nanos / 1e9, getattr(CS, "avh_frames", {}),
+        getattr(starpilot_toggles, "subaru_avh_on", False), getattr(CS.out, "canValid", False),
+        CC.enabled or CC.latActive or CC.longActive,
+      ))
+
     # *** steering ***
     if (self.frame % self.p.STEER_STEP) == 0:
       if self.CP.flags & SubaruFlags.LKAS_ANGLE:

opendbc_repo/opendbc/car/subaru/carstate.py

@@ -4,8 +4,9 @@ from opendbc.can import CANDefine, CANParser
 from opendbc.car import Bus, create_button_events, structs
 from opendbc.car.common.conversions import Conversions as CV
 from opendbc.car.interfaces import CarStateBase
-from opendbc.car.subaru.values import DBC, CanBus, SUBARU_REDNECK_CRUISE_CARS, SUBARU_STOP_START_CARS, SubaruFlags
+from opendbc.car.subaru.values import CAR, DBC, CanBus, SUBARU_REDNECK_CRUISE_CARS, SUBARU_STOP_START_CARS, SubaruFlags
 from opendbc.car import CanSignalRateCalculator
+from opendbc.car.subaru.avh import INPUTS as AVH_INPUTS
 
 ButtonType = structs.CarState.ButtonEvent.Type
 
@@ -26,6 +27,7 @@ class CarState(CarStateBase):
     self.dashlights_msg = {}
     self.dashlights_dat = b""
     self.stop_start_state = 0
+    self.avh_frames = {}
     self.cruise_buttons_msg = {}
     self.cruise_buttons = {button: 0 for button in SUBARU_CRUISE_BUTTONS}
 
@@ -37,6 +39,9 @@ class CarState(CarStateBase):
     cp_angle = cp_main if self.CP.flags & SubaruFlags.D_PLATFORM else cp
     ret = structs.CarState()
 
+    if self.CP.carFingerprint == CAR.SUBARU_LEGACY_2025:
+      self.avh_frames = {a: (cp_alt.ts_nanos[a]["CHECKSUM"] / 1e9, cp_alt.vl_raw[a]) for a in AVH_INPUTS}
+
     if self.CP.carFingerprint in SUBARU_STOP_START_CARS:
       stop_start_cp = cp_alt if self.CP.flags & SubaruFlags.GLOBAL_GEN2 else cp
       self.dashlights_msg = copy.copy(stop_start_cp.vl["Dashlights"])
@@ -177,11 +182,15 @@ class CarState(CarStateBase):
 
   @staticmethod
   def get_can_parsers(CP):
+    avh_messages = [(a, 0) for a in (0x6BB, 0x32B, 0x40, 0x48)] if CP.carFingerprint == CAR.SUBARU_LEGACY_2025 else []
     parsers = {
       Bus.pt: CANParser(DBC[CP.carFingerprint][Bus.pt], [], CanBus.main_for_cp(CP)),
       Bus.cam: CANParser(DBC[CP.carFingerprint][Bus.pt], [], CanBus.camera),
-      Bus.alt: CANParser(DBC[CP.carFingerprint][Bus.pt], [], CanBus.alt_for_cp(CP))
+      Bus.alt: CANParser(DBC[CP.carFingerprint][Bus.pt], avh_messages, CanBus.alt_for_cp(CP))
     }
     if CP.flags & SubaruFlags.D_PLATFORM:
       parsers[Bus.main] = CANParser(DBC[CP.carFingerprint][Bus.pt], [], CanBus.main)
+    if CP.carFingerprint == CAR.SUBARU_LEGACY_2025:
+      for address in AVH_INPUTS:
+        parsers[Bus.alt].vl[address]
     return parsers

opendbc_repo/opendbc/car/subaru/interface.py

@@ -42,6 +42,8 @@ class CarInterface(CarInterfaceBase):
         ret.safetyConfigs[0].safetyParam |= SubaruSafetyFlags.D_PLATFORM_CAMERA.value
       if candidate in SUBARU_STOP_START_CARS:
         ret.safetyConfigs[0].safetyParam |= SubaruSafetyFlags.STOP_START_BUTTON.value
+      if candidate == CAR.SUBARU_LEGACY_2025:
+        ret.safetyConfigs[0].safetyParam |= SubaruSafetyFlags.AVH_STARTUP.value
       if candidate in (CAR.SUBARU_LEGACY_2025, CAR.SUBARU_ASCENT_2023, CAR.SUBARU_OUTBACK_2023):
         ret.safetyConfigs[0].safetyParam |= SubaruSafetyFlags.FIXED_ANGLE_LIMITS.value
 

opendbc_repo/opendbc/car/subaru/tests/test_avh.py

@@ -0,0 +1,112 @@
+from types import SimpleNamespace
+
+import pytest
+
+from opendbc.car.subaru.avh import AVH_REQUEST, AVH_STATUS, INPUTS, AvhStartup, avh_request, checksum
+from opendbc.car.subaru.carcontroller import CarController
+from opendbc.car.subaru.interface import CarInterface
+from opendbc.car.subaru.values import CAR, SubaruSafetyFlags
+from opendbc.car import Bus
+
+
+def sample(address, counter):
+  data = bytearray(8)
+  data[1] = counter & 15
+  if address == AVH_REQUEST:
+    data[3], data[5], data[6] = 1, 0x80, 0x0E  # captured Legacy payload, not Outback constants
+  elif address == 0x40:
+    data[2:4] = (800).to_bytes(2, 'little')
+  elif address == 0x48:
+    data[3] = 4
+  elif address == 0x174:
+    data[2] = 8
+  data[0] = checksum(address, data)
+  return bytes(data)
+
+
+def prepare(fast_counter_step=1):
+  policy = AvhStartup()
+  frames = {}
+  for tick in range(101):
+    now = 100 + tick / 10
+    for address in INPUTS:
+      if address != AVH_REQUEST or tick % 10 == 0:
+        counter = tick // 10 if address == AVH_REQUEST else tick * (1 if address == AVH_STATUS else fast_counter_step)
+        frames[address] = (now, sample(address, counter))
+    sent = policy.update(now, frames, True, True, False)
+    if tick < 100:
+      assert sent == []
+  assert sent == [avh_request(frames[AVH_REQUEST][1], 1)]
+  return policy, frames
+
+
+def test_captured_legacy_press_bytes():
+  template = bytes.fromhex('5b0b000100800e00')
+  assert avh_request(template, 1) == (0x6BB, bytes.fromhex('5e0c020100800e00'), 1)
+  assert avh_request(template, 2) == (0x6BB, bytes.fromhex('5f0d020100800e00'), 1)
+  wrap = sample(AVH_REQUEST, 15)
+  assert avh_request(wrap, 1)[1][1] == 0
+  assert avh_request(wrap, 2)[1][1] == 1
+
+
+def test_two_frames_only_and_no_retry():
+  policy, frames = prepare()
+  assert policy.update(110.04, frames, True, True, False) == []
+  assert policy.update(110.06, frames, True, True, False) == [avh_request(frames[AVH_REQUEST][1], 2)]
+  assert policy.update(110.07, frames, True, True, False) == []
+  assert policy.update(111, frames, True, True, False) == []
+
+
+def test_controller_snapshots_may_skip_fast_can_samples():
+  policy, frames = prepare(fast_counter_step=2)
+  assert policy.update(110.06, frames, True, True, False) == [avh_request(frames[AVH_REQUEST][1], 2)]
+
+
+@pytest.mark.parametrize('reason', ['late', 'new_template', 'manual', 'ack', 'moving', 'gas', 'gear', 'invalid', 'disabled', 'engaged', 'stale'])
+def test_followup_aborts_permanently(reason):
+  policy, frames = prepare()
+  address, offset, value = {
+    'manual': (AVH_REQUEST, 2, 1), 'ack': (AVH_STATUS, 5, 32),
+    'moving': (0x13A, 2, 1), 'gas': (0x40, 4, 1), 'gear': (0x48, 3, 3),
+    'new_template': (AVH_REQUEST, 1, 11),
+  }.get(reason, (None, None, None))
+  if address is not None:
+    data = bytearray(frames[address][1])
+    data[1] = (data[1] + 1) & 15
+    data[offset] = value
+    data[0] = checksum(address, data)
+    frames[address] = (110.05, bytes(data))
+  if reason == 'stale':
+    frames[0x40] = (109, frames[0x40][1])
+  now = 110.08 if reason == 'late' else 110.06
+  assert policy.update(now, frames, reason != 'disabled', reason != 'invalid', reason == 'engaged') == []
+  assert policy.done
+  assert policy.update(111, frames, True, True, False) == []
+
+
+def test_only_legacy_has_avh_safety_permission():
+  for car in CAR:
+    cp = CarInterface.get_non_essential_params(car)
+    assert bool(cp.safetyConfigs[0].safetyParam & SubaruSafetyFlags.AVH_STARTUP) == (car == CAR.SUBARU_LEGACY_2025)
+
+
+def test_existing_required_messages_keep_alive_checks():
+  cp = CarInterface.get_non_essential_params(CAR.SUBARU_LEGACY_2025)
+  parser = CarInterface.CarState.get_can_parsers(cp)[Bus.alt]
+  assert not parser.message_states[0x13A].ignore_alive
+  assert not parser.message_states[0x174].ignore_alive
+  assert parser.message_states[AVH_REQUEST].ignore_alive
+  assert parser.message_states[AVH_STATUS].ignore_alive
+
+
+def test_controller_sends_only_when_opted_in():
+  cp = CarInterface.get_non_essential_params(CAR.SUBARU_LEGACY_2025)
+  controller = CarController({}, cp)
+  cc = SimpleNamespace(enabled=False, latActive=False, longActive=False,
+                       actuators=SimpleNamespace(as_builder=lambda: SimpleNamespace(steeringAngleDeg=0)),
+                       hudControl=SimpleNamespace(leadVisible=False), cruiseControl=SimpleNamespace(cancel=False))
+  cs = SimpleNamespace(out=SimpleNamespace(canValid=True), avh_frames={})
+  toggles = SimpleNamespace(subaru_stop_start_off=False, subaru_avh_on=False, subaru_sng=False)
+  controller.frame = 1
+  _, sent = controller.update(cc, cs, 100_000_000_000, toggles)
+  assert not any(m[0] in (AVH_REQUEST, AVH_STATUS) for m in sent)

opendbc_repo/opendbc/car/subaru/tests/test_subaru.py

@@ -682,6 +682,28 @@ def test_ascent_angle_controller_reengages_immediately_after_manual_steering_sto
   assert CS.out.steeringAngleDeg < parser.vl["ES_LKAS_ANGLE"]["LKAS_Output"] < CC.actuators.steeringAngleDeg
 
 
+def test_ascent_reentry_rate_uses_last_transmitted_angle():
+  CP = CarInterface.get_non_essential_params(CAR.SUBARU_ASCENT_2023)
+  controller = CarController({}, CP)
+  controller.angle_handoff_active = True
+  CC = SimpleNamespace(enabled=True, latActive=True, actuators=SimpleNamespace(steeringAngleDeg=-1.45))
+  CS = SimpleNamespace(out=SimpleNamespace(
+    vEgoRaw=30.3, steeringAngleDeg=0.78, steeringRateDeg=-1.5, steeringTorque=56.0,
+    gearShifter=structs.CarState.GearShifter.drive, standstill=False,
+  ))
+  parser = CANParser(DBC[CP.carFingerprint][Bus.pt], [("ES_LKAS_ANGLE", 0)], CanBus.main)
+
+  parser.update([(1, [controller.lateral_angle(CC, CS)])])
+  assert parser.vl["ES_LKAS_ANGLE"]["LKAS_Request"] == 0
+  assert parser.vl["ES_LKAS_ANGLE"]["LKAS_Output"] == pytest.approx(0.78)
+
+  CS.out.steeringAngleDeg = 0.74
+  CS.out.steeringRateDeg = -1.99
+  parser.update([(2, [controller.lateral_angle(CC, CS)])])
+  assert parser.vl["ES_LKAS_ANGLE"]["LKAS_Request"] == 1
+  assert parser.vl["ES_LKAS_ANGLE"]["LKAS_Output"] == pytest.approx(0.53, abs=0.01)
+
+
 def test_ascent_angle_controller_waits_for_parking_lot_safety_envelope():
   CP = CarInterface.get_non_essential_params(CAR.SUBARU_ASCENT_2023)
   controller = CarController({}, CP)
@@ -806,7 +828,7 @@ def test_outback_manual_steering_keeps_cooperative_angle_request():
   CS = SimpleNamespace(out=SimpleNamespace(
     vEgoRaw=0.9,
     steeringAngleDeg=-57.0,
-    steeringRateDeg=-45.0,
+    steeringRateDeg=0.0,
     steeringTorque=0.0,
     steeringPressed=True,
     gearShifter=structs.CarState.GearShifter.drive,
@@ -815,6 +837,7 @@ def test_outback_manual_steering_keeps_cooperative_angle_request():
   parser = CANParser(DBC[CP.carFingerprint][Bus.pt], [("ES_LKAS_ANGLE", 0)], CanBus.main)
 
   for frame, steering_torque in enumerate((-79.0, -81.0, -170.0, -250.0, -250.0, 79.0, 81.0, 170.0, 250.0, 250.0), start=1):
+    CS.out.steeringRateDeg = 0.0 if frame == 1 else -45.0
     CS.out.steeringTorque = steering_torque
     CS.out.steeringPressed = abs(steering_torque) > 80.0
     msg = controller.lateral_angle(CC, CS)
@@ -825,6 +848,27 @@ def test_outback_manual_steering_keeps_cooperative_angle_request():
     assert controller._lkas_status_active(CC)
 
 
+def test_outback_waits_for_manual_turn_to_settle_before_reentry():
+  CP = CarInterface.get_non_essential_params(CAR.SUBARU_OUTBACK_2023)
+  controller = CarController({}, CP)
+  CC = SimpleNamespace(enabled=False, latActive=True, actuators=SimpleNamespace(steeringAngleDeg=-80.0))
+  CS = SimpleNamespace(out=SimpleNamespace(
+    vEgoRaw=7.3, steeringAngleDeg=-121.47, steeringRateDeg=126.5,
+    gearShifter=structs.CarState.GearShifter.drive, standstill=False,
+  ))
+  parser = CANParser(DBC[CP.carFingerprint][Bus.pt], [("ES_LKAS_ANGLE", 0)], CanBus.main)
+  for frame, (angle, rate, active) in enumerate([
+    (-121.47, 126.5, False), (-117.96, 122.5, False), (-88.65, 112.0, False),
+    (-0.24, 0.0, True),
+  ], start=1):
+    CS.out.steeringAngleDeg = angle
+    CS.out.steeringRateDeg = rate
+    parser.update([(frame, [controller.lateral_angle(CC, CS)])])
+    assert bool(parser.vl["ES_LKAS_ANGLE"]["LKAS_Request"]) == active
+    if not active:
+      assert parser.vl["ES_LKAS_ANGLE"]["LKAS_Output"] == pytest.approx(angle, abs=0.01)
+
+
 def test_ascent_hud_waits_for_angle_request():
   CP = CarInterface.get_non_essential_params(CAR.SUBARU_ASCENT_2023)
   controller = CarController({}, CP)

opendbc_repo/opendbc/car/subaru/values.py

@@ -90,6 +90,7 @@ class SubaruSafetyFlags(IntFlag):
   FIXED_ANGLE_LIMITS = 128
   STOP_START_BUTTON = 256
   REDNECK_CRUISE = 512
+  AVH_STARTUP = 1024
   LEGACY_2025_ANGLE_LIMITS = FIXED_ANGLE_LIMITS
 
 

opendbc_repo/opendbc/car/tesla/carcontroller.py

@@ -153,7 +153,7 @@ class CarController(CarControllerBase):
   def _update_preap(self, CC, CS):
     actuators = CC.actuators
     can_sends = []
-    lat_active = CC.latActive and CS.hands_on_level < 3
+    lat_active = CC.latActive and CS.hands_on_level < 3 and getattr(CS, "preap_lateral_authorized", False)
 
     if CC.cruiseControl.cancel and CS.cruiseEnabled:
       CS.cruiseEnabled = False
@@ -169,8 +169,10 @@ class CarController(CarControllerBase):
         CS.engagement.pedal_speed_kph = 0.0
 
     if self.frame % 2 == 0:
+      requested_angle = float(np.clip(actuators.steeringAngleDeg,
+                                       CS.out.steeringAngleDeg - 20., CS.out.steeringAngleDeg + 20.))
       self.apply_angle_last = apply_steer_angle_limits_vm(
-        actuators.steeringAngleDeg, self.apply_angle_last, CS.out.vEgoRaw, CS.out.steeringAngleDeg,
+        requested_angle, self.apply_angle_last, CS.out.vEgoRaw, CS.out.steeringAngleDeg,
         lat_active, CarControllerParams, self.VM,
       )
       cntr = (self.frame // 2) % 16

opendbc_repo/opendbc/car/tesla/preap/engagement.py

@@ -13,6 +13,8 @@ class PreAPEngagement:
     self.enableDoublePull = double_pull_enabled
     self.double_pull_window_ms = double_pull_window_ms
     self.cruiseEnabled = False
+    self.lateralEnabled = False
+    self.lateralRearmRequired = False
     self.enableLongControl = False
     self.enableJustCC = False
     self.pending_enable = False
@@ -28,6 +30,8 @@ class PreAPEngagement:
 
   def handle_steering_disengage(self, steering_disengage: bool) -> None:
     if steering_disengage and not self.prev_steering_disengage:
+      self.lateralEnabled = False
+      self.lateralRearmRequired = True
       self.cruiseEnabled = False
       self.enableLongControl = False
       self.enableJustCC = False
@@ -45,6 +49,8 @@ class PreAPEngagement:
     button_events: list[structs.CarState.ButtonEvent] = []
 
     if cruise_buttons == CruiseButtons.MAIN and prev_cruise_buttons != CruiseButtons.MAIN:
+      self.lateralEnabled = True
+      self.lateralRearmRequired = False
       if self.enableDoublePull:
         self._handle_double_pull(curr_time_ms, v_ego, speed_units, use_pedal, pedal_long_allowed, long_control_allowed, di_cruise_state)
       else:
@@ -75,6 +81,8 @@ class PreAPEngagement:
   def check_can_engage(self, door_open: bool, gear_shifter, seatbelt_unlatched: bool) -> bool:
     can_engage = not door_open and gear_shifter == structs.CarState.GearShifter.drive and not seatbelt_unlatched
     if not can_engage:
+      self.lateralEnabled = False
+      self.lateralRearmRequired = True
       self.cruiseEnabled = False
       self.enableLongControl = False
       self.enableJustCC = False
@@ -118,6 +126,8 @@ class PreAPEngagement:
                 ((curr_time_ms - self.preap_last_cc_spoof_ms) < SPOOF_ECHO_WINDOW_MS)
       be.type = ButtonType.unknown if is_echo else ButtonType.cancel
       if not is_echo:
+        self.lateralEnabled = False
+        self.lateralRearmRequired = True
         self.cruiseEnabled = False
         self.enableLongControl = False
         self.enableJustCC = False
@@ -145,4 +155,3 @@ class PreAPEngagement:
   def _capture_target_speed(v_ego: float, speed_units: str) -> float:
     speed_uom_kph = CV.MPH_TO_KPH if speed_units == "MPH" else 1.0
     return max(int(v_ego * CV.MS_TO_KPH / speed_uom_kph + 0.5) * speed_uom_kph, 0.0)
-

opendbc_repo/opendbc/car/tesla/preap/lateral.py

@@ -0,0 +1,21 @@
+from opendbc.car import structs
+from opendbc.safety import ALTERNATIVE_EXPERIENCE
+
+
+def preap_lateral_authorized(CP, CS, panda_states, panda_states_valid: bool) -> bool:
+  """Match Pre-AP's existing safety authorization without treating software CC availability as ACC main."""
+  if not panda_states_valid or CS.out.gearShifter != structs.CarState.GearShifter.drive or CS.out.doorOpen or CS.out.steeringDisengage:
+    return False
+  if CS.engagement.lateralRearmRequired:
+    return False
+  config = CP.safetyConfigs[0]
+  matching = [p for p in panda_states if p.safetyModel == config.safetyModel and p.safetyParam == config.safetyParam]
+  if len(matching) != 1 or matching[0].safetyRxChecksInvalid:
+    return False
+  panda = matching[0]
+  # Physical cancel/override/gear changes clear this latch immediately, whereas
+  # Panda telemetry can lag. Longitudinal software cancellation leaves it intact.
+  stalk_authorized = CS.engagement.lateralEnabled and panda.controlsAllowed
+  stock_main = CS.di_cruise_state in ("STANDBY", "ENABLED", "STANDSTILL", "OVERRIDE", "PRE_FAULT", "PRE_CANCEL")
+  aol_authorized = bool(panda.alternativeExperience & ALTERNATIVE_EXPERIENCE.ALWAYS_ON_LATERAL) and stock_main
+  return bool(stalk_authorized or aol_authorized)

opendbc_repo/opendbc/car/tesla/preap/tests/test_angle_tracking.py

@@ -0,0 +1,36 @@
+from types import SimpleNamespace
+
+import pytest
+
+from opendbc.car import structs
+from opendbc.car.tesla.carcontroller import CarController
+from opendbc.car.tesla.interface import CarInterface
+from opendbc.car.tesla.values import CAR, DBC
+
+
+@pytest.mark.parametrize('direction', [-1., 1.])
+def test_preap_stalled_rack_request_stays_within_legacy_tracking_envelope(direction):
+  cp = CarInterface.get_non_essential_params(CAR.TESLA_MODEL_S_PREAP)
+  controller = CarController(DBC[cp.carFingerprint], cp)
+  controller.stock_cc = None
+  cs = SimpleNamespace(out=SimpleNamespace(vEgoRaw=3., steeringAngleDeg=0.),
+                       hands_on_level=0, preap_lateral_authorized=True, cruiseEnabled=False)
+  cc = structs.CarControl.new_message()
+  cc.latActive = True
+  cc.actuators.steeringAngleDeg = direction * 100.
+  previous = 0.
+  for frame in range(100):
+    output, _ = controller.update(cc.as_reader(), cs, frame * 10000000, None)
+    assert abs(output.steeringAngleDeg) <= 20.
+    assert abs(output.steeringAngleDeg - previous) <= 5.
+    previous = output.steeringAngleDeg
+  assert previous == direction * 20.
+
+  cs.out.steeringAngleDeg = -direction * 50.
+  output, _ = controller.update(cc.as_reader(), cs, 1000000000, None)
+  assert abs(output.steeringAngleDeg - previous) <= 5.
+
+  cc.latActive = False
+  controller.frame = 102
+  output, _ = controller.update(cc.as_reader(), cs, 1020000000, None)
+  assert output.steeringAngleDeg == cs.out.steeringAngleDeg

opendbc_repo/opendbc/car/toyota/carcontroller.py

@@ -11,7 +11,7 @@ from opendbc.car.interfaces import CarControllerBase
 from opendbc.car.toyota import toyotacan
 from opendbc.car.toyota.values import CAR, MIN_ACC_SPEED, NO_STOP_TIMER_CAR, PEDAL_TRANSITION, TSS2_CAR, \
                                         CarControllerParams, ToyotaFlags, \
-                                        UNSUPPORTED_DSU_CAR, LEGACY_PRIUS_CAR, TOYOTA_AUTO_HOLD_CARS
+                                        UNSUPPORTED_DSU_CAR, LEGACY_PRIUS_CAR, TOYOTA_AUTO_HOLD_CARS, TOYOTA_AUTO_HOLD_AEB_CARS
 from opendbc.can import CANPacker
 
 Ecu = structs.CarParams.Ecu
@@ -47,6 +47,7 @@ TOYOTA_AUTO_HOLD_ACTIVATION_FRAMES = 100
 # EPS faults if you apply torque while the steering rate is above 100 deg/s for too long
 MAX_STEER_RATE = 100  # deg/s
 MAX_STEER_RATE_FRAMES = 17  # tx control frames needed before torque can be cut
+COROLLA_MAX_STEER_RATE = 80
 
 # EPS allows user torque above threshold for 50 frames before permanently faulting
 MAX_USER_TORQUE = 500
@@ -77,12 +78,12 @@ def should_bypass_toyota_long_pid(CP, starpilot_toggles=None) -> bool:
   ) or highlander_sdsu)
 
 
-def get_toyota_lat_active(car_fingerprint, requested_active: bool, steering_torque: float,
-                          steering_pressed: bool) -> bool:
-  if not requested_active or abs(steering_torque) >= MAX_USER_TORQUE:
-    return False
+def get_toyota_lat_active(requested_active: bool, steering_torque: float) -> bool:
+  return requested_active and abs(steering_torque) < MAX_USER_TORQUE
 
-  return not (car_fingerprint == CAR.TOYOTA_COROLLA_TSS2 and steering_pressed)
+
+def get_toyota_steer_rate_limit(car_fingerprint) -> int:
+  return COROLLA_MAX_STEER_RATE if car_fingerprint == CAR.TOYOTA_COROLLA_TSS2 else MAX_STEER_RATE
 
 
 def supports_toyota_auto_hold(CP, auto_hold_enabled: bool) -> bool:
@@ -252,6 +253,7 @@ class CarController(CarControllerBase):
     self.standstill_req = False
     self.permit_braking = True
     self.steer_rate_counter = 0
+    self.steer_rate_limit = get_toyota_steer_rate_limit(self.CP.carFingerprint)
     self.distance_button = 0
 
     # *** start long control state ***
@@ -334,6 +336,22 @@ class CarController(CarControllerBase):
 
     return self.brake_hold_active
 
+  def create_auto_brake_hold_messages(self, CS: structs.CarState, brake_hold_allowed_timer: int = 100):
+    brake_hold_allowed = (CS.out.standstill and CS.out.cruiseState.available and
+                          not CS.out.gasPressed and not CS.out.cruiseState.enabled and
+                          CS.out.gearShifter not in (PARK, REVERSE))
+
+    if brake_hold_allowed and not self.brake_hold_active and CS.out.brakePressed:
+      self._brake_hold_counter += 1
+      self.brake_hold_active = self._brake_hold_counter > brake_hold_allowed_timer
+    elif not brake_hold_allowed:
+      self._brake_hold_counter = 0
+      self.brake_hold_active = False
+
+    if self.frame % 2 == 0:
+      return [toyotacan.create_brake_hold_command(self.packer, self.frame, CS.pre_collision_2, self.brake_hold_active)]
+    return []
+
   def reset_auto_hold_state(self):
     self._brake_hold_counter = 0
     self.brake_hold_active = False
@@ -343,8 +361,7 @@ class CarController(CarControllerBase):
     stopping = actuators.longControlState == LongCtrlState.stopping
     hud_control = CC.hudControl
     pcm_cancel_cmd = CC.cruiseControl.cancel
-    lat_active = get_toyota_lat_active(self.CP.carFingerprint, CC.latActive,
-                                       CS.out.steeringTorque, CS.out.steeringPressed)
+    lat_active = get_toyota_lat_active(CC.latActive, CS.out.steeringTorque)
 
     if len(CC.orientationNED) == 3:
       self.pitch.update(CC.orientationNED[1])
@@ -371,7 +388,7 @@ class CarController(CarControllerBase):
 
     # >100 degree/sec steering fault prevention
     self.steer_rate_counter, apply_steer_req = common_fault_avoidance(
-      abs(CS.out.steeringRateDeg) >= MAX_STEER_RATE, lat_active,
+      abs(CS.out.steeringRateDeg) >= self.steer_rate_limit, lat_active,
       self.steer_rate_counter, MAX_STEER_RATE_FRAMES,
     )
 
@@ -435,7 +452,10 @@ class CarController(CarControllerBase):
 
     self._update_standstill_request(CC, CS, actuators, starpilot_toggles)
     if supports_toyota_auto_hold(self.CP, getattr(starpilot_toggles, "toyota_auto_hold", False)):
-      self.update_auto_hold_state(CS, pcm_cancel_cmd)
+      if self.CP.carFingerprint in TOYOTA_AUTO_HOLD_AEB_CARS:
+        can_sends.extend(self.create_auto_brake_hold_messages(CS))
+      else:
+        self.update_auto_hold_state(CS, pcm_cancel_cmd)
     else:
       self.reset_auto_hold_state()
 
@@ -545,7 +565,7 @@ class CarController(CarControllerBase):
 
         pcm_accel_cmd = float(np.clip(pcm_accel_cmd, self.params.ACCEL_MIN, self.params.ACCEL_MAX))
 
-        if self.brake_hold_active:
+        if self.brake_hold_active and self.CP.carFingerprint not in TOYOTA_AUTO_HOLD_AEB_CARS:
           pcm_accel_cmd = TOYOTA_AUTO_HOLD_ACCEL
           self.permit_braking = True
           self.standstill_req = True

opendbc_repo/opendbc/car/toyota/carstate.py

@@ -9,6 +9,7 @@ from opendbc.car.interfaces import CarStateBase
 from opendbc.car.toyota.values import ToyotaFlags, ToyotaStarPilotFlags, CAR, DBC, STEER_THRESHOLD, NO_STOP_TIMER_CAR, \
                                                   TSS2_CAR, RADAR_ACC_CAR, EPS_SCALE, UNSUPPORTED_DSU_CAR, \
                                                   SECOC_CAR, LEGACY_PRIUS_CAR
+from opendbc.safety import ALTERNATIVE_EXPERIENCE
 
 ButtonType = structs.CarState.ButtonEvent.Type
 SteerControlType = structs.CarParams.SteerControlType
@@ -90,6 +91,11 @@ class CarState(CarStateBase):
     self.has_can_filter = self.FPCP.flags & ToyotaStarPilotFlags.RADAR_CAN_FILTER.value
     self.has_SDSU = self.FPCP.flags & ToyotaStarPilotFlags.SMART_DSU.value
     self.has_ZSS = self.FPCP.flags & ToyotaStarPilotFlags.ZSS.value
+    self.auto_brake_hold = bool(
+      self.CP.flags & ToyotaFlags.AUTO_BRAKE_HOLD.value and
+      getattr(self.CP, "alternativeExperience", 0) & ALTERNATIVE_EXPERIENCE.ALLOW_AEB
+    )
+    self.pre_collision_2 = {}
 
   def update(self, can_parsers, starpilot_toggles) -> structs.CarState:
     cp = can_parsers[Bus.pt]
@@ -225,6 +231,9 @@ class CarState(CarStateBase):
     if self.CP.carFingerprint != CAR.TOYOTA_PRIUS_V:
       self.lkas_hud = copy.copy(cp_cam.vl["LKAS_HUD"])
 
+    if self.auto_brake_hold:
+      self.pre_collision_2 = copy.copy(cp_cam.vl["PRE_COLLISION_2"])
+
     if self.CP.carFingerprint not in UNSUPPORTED_DSU_CAR:
       self.pcm_follow_distance = cp.vl["PCM_CRUISE_2"]["PCM_FOLLOW_DISTANCE"]
 
@@ -309,6 +318,10 @@ class CarState(CarStateBase):
     if CP.carFingerprint in DISTANCE_BUTTON_CAR:
       pt_messages.append(("PCM_CRUISE_4", 1))
 
+    if (CP.flags & ToyotaFlags.AUTO_BRAKE_HOLD.value and
+        getattr(CP, "alternativeExperience", 0) & ALTERNATIVE_EXPERIENCE.ALLOW_AEB):
+      cam_messages.append(("PRE_COLLISION_2", 50))
+
     return {
       Bus.pt: CANParser(DBC[CP.carFingerprint][Bus.pt], pt_messages, 0),
       Bus.cam: CANParser(DBC[CP.carFingerprint][Bus.pt], cam_messages, 2),

opendbc_repo/opendbc/car/toyota/interface.py

@@ -4,7 +4,8 @@ from opendbc.car.toyota.carcontroller import CarController
 from opendbc.car.toyota.radar_interface import RadarInterface
 from opendbc.car.toyota.values import Ecu, CAR, DBC, ToyotaFlags, CarControllerParams, TSS2_CAR, RADAR_ACC_CAR, NO_DSU_CAR, \
                                                   MIN_ACC_SPEED, EPS_SCALE, NO_STOP_TIMER_CAR, ANGLE_CONTROL_CAR, \
-                                                  ToyotaSafetyFlags, LEGACY_PRIUS_CAR, TOYOTA_AUTO_HOLD_CARS
+                                                  ToyotaSafetyFlags, LEGACY_PRIUS_CAR, TOYOTA_AUTO_HOLD_CARS, \
+                                                  TOYOTA_AUTO_HOLD_AEB_CARS
 from opendbc.car.disable_ecu import disable_ecu
 from opendbc.car.interfaces import CarInterfaceBase
 from opendbc.safety import ALTERNATIVE_EXPERIENCE
@@ -165,7 +166,9 @@ class CarInterface(CarInterfaceBase):
 
     toyota_auto_hold = Params(return_defaults=True).get_bool("ToyotaAutoHold")
     if toyota_auto_hold and ret.openpilotLongitudinalControl and candidate in TOYOTA_AUTO_HOLD_CARS:
-      ret.alternativeExperience |= ALTERNATIVE_EXPERIENCE.TOYOTA_AUTO_HOLD
+      ret.alternativeExperience |= (ALTERNATIVE_EXPERIENCE.ALLOW_AEB
+                                    if candidate in TOYOTA_AUTO_HOLD_AEB_CARS
+                                    else ALTERNATIVE_EXPERIENCE.TOYOTA_AUTO_HOLD)
       ret.flags |= ToyotaFlags.AUTO_BRAKE_HOLD.value
 
     if not ret.openpilotLongitudinalControl:

opendbc_repo/opendbc/car/toyota/tests/test_toyota.py

@@ -6,12 +6,14 @@ from hypothesis import given, settings, strategies as st
 from opendbc.car import Bus, structs
 from opendbc.can import CANPacker, CANParser
 from opendbc.car.structs import CarParams
+from opendbc.car.lateral import common_fault_avoidance
 from opendbc.car.fw_versions import build_fw_dict, match_fw_to_car
 from opendbc.car.toyota import toyotacan
 from opendbc.car.toyota.carcontroller import CarController, get_camry_hybrid_feedforward, get_long_tune, get_prius_feedforward, \
                                              get_prius_positive_feedforward_scale, \
                                              get_rav4_interceptor_pedal_scale, \
-                                             get_toyota_lat_active, \
+                                             get_toyota_lat_active, get_toyota_steer_rate_limit, \
+                                             MAX_STEER_RATE, MAX_STEER_RATE_FRAMES, MAX_USER_TORQUE, \
                                              limit_interceptor_pcm_accel, \
                                              limit_interceptor_stopping_accel, limit_no_lead_cruise_sign_flip, \
                                              limit_prius_stopping_accel, should_bypass_toyota_long_pid, supports_toyota_auto_hold, \
@@ -23,6 +25,7 @@ from opendbc.car.toyota.radar_interface import RadarInterface, TSSP_RADAR_EGO_SP
 from opendbc.car.toyota.values import CAR, DBC, MIN_ACC_SPEED, TSS2_CAR, ANGLE_CONTROL_CAR, RADAR_ACC_CAR, SECOC_CAR, \
                                                   FW_QUERY_CONFIG, PLATFORM_CODE_ECUS, FUZZY_EXCLUDED_PLATFORMS, \
                                                   ToyotaFlags, ToyotaSafetyFlags, ToyotaStarPilotFlags, TOYOTA_AUTO_HOLD_CARS, \
+                                                  TOYOTA_AUTO_HOLD_AEB_CARS, \
                                                   get_platform_codes
 from opendbc.safety import ALTERNATIVE_EXPERIENCE
 from openpilot.common.params import Params
@@ -209,13 +212,17 @@ class TestToyotaInterfaces:
       params.remove("ToyotaAutoHold")
 
     assert car_params.flags & ToyotaFlags.AUTO_BRAKE_HOLD.value
-    assert car_params.alternativeExperience & ALTERNATIVE_EXPERIENCE.TOYOTA_AUTO_HOLD
-    assert not car_params.alternativeExperience & ALTERNATIVE_EXPERIENCE.ALLOW_AEB
+    if candidate in TOYOTA_AUTO_HOLD_AEB_CARS:
+      assert car_params.alternativeExperience & ALTERNATIVE_EXPERIENCE.ALLOW_AEB
+      assert not car_params.alternativeExperience & ALTERNATIVE_EXPERIENCE.TOYOTA_AUTO_HOLD
+    else:
+      assert car_params.alternativeExperience & ALTERNATIVE_EXPERIENCE.TOYOTA_AUTO_HOLD
+      assert not car_params.alternativeExperience & ALTERNATIVE_EXPERIENCE.ALLOW_AEB
 
     can_parsers = CarState.get_can_parsers(car_params)
     car_state = CarState(car_params, SimpleNamespace(flags=0))
     car_state.update(can_parsers, SimpleNamespace(cluster_offset=1.0))
-    assert "PRE_COLLISION_2" not in can_parsers[Bus.cam].vl
+    assert (0x344 in can_parsers[Bus.cam].vl) == (candidate in TOYOTA_AUTO_HOLD_AEB_CARS)
 
   @pytest.mark.parametrize("candidate", [CAR.TOYOTA_CAMRY_TSS2, CAR.TOYOTA_RAV4, CAR.TOYOTA_RAV4H])
   def test_auto_hold_is_disabled_by_default(self, candidate):
@@ -735,14 +742,43 @@ class TestToyotaFingerprint:
 
 
 class TestToyotaCarController:
-  def test_corolla_tss2_hands_off_immediately_when_driver_is_steering(self):
-    assert not get_toyota_lat_active(CAR.TOYOTA_COROLLA_TSS2, True, 117, True)
+  @pytest.mark.parametrize("driver_torque", [-191, -117, -99, 99, 117, 191])
+  def test_toyota_assisting_driver_keeps_lateral_active(self, driver_torque):
+    assert get_toyota_lat_active(True, driver_torque)
 
-  def test_corolla_tss2_stays_active_without_driver_input(self):
-    assert get_toyota_lat_active(CAR.TOYOTA_COROLLA_TSS2, True, 99, False)
+  @pytest.mark.parametrize("driver_torque", [-MAX_USER_TORQUE, MAX_USER_TORQUE, MAX_USER_TORQUE + 1])
+  def test_toyota_high_driver_torque_still_disables_lateral(self, driver_torque):
+    assert not get_toyota_lat_active(True, driver_torque)
 
-  def test_toyota_driver_handoff_behavior_is_corolla_only(self):
-    assert get_toyota_lat_active(CAR.TOYOTA_RAV4_TSS2, True, 117, True)
+  def test_toyota_inactive_request_stays_inactive(self):
+    assert not get_toyota_lat_active(False, 0)
+
+  def test_toyota_assisting_driver_retains_rate_fault_protection(self):
+    counter = 0
+    requests = []
+    for _ in range(36):
+      counter, request = common_fault_avoidance(
+        150 >= MAX_STEER_RATE, get_toyota_lat_active(True, 117), counter, MAX_STEER_RATE_FRAMES,
+      )
+      requests.append(request)
+    assert requests == ([True] * 17 + [False]) * 2
+
+  @pytest.mark.parametrize("candidate", list(CAR))
+  def test_steer_rate_margin_is_corolla_only(self, candidate):
+    expected = 80 if candidate == CAR.TOYOTA_COROLLA_TSS2 else MAX_STEER_RATE
+    assert get_toyota_steer_rate_limit(candidate) == expected
+
+  @pytest.mark.parametrize("direction", [-1, 1])
+  def test_corolla_rate_margin_preserves_request_spacing(self, direction):
+    counter = 0
+    requests = []
+    for rate in [0] * 30 + [90 * direction] * 36 + [0] * 30:
+      counter, request = common_fault_avoidance(
+        abs(rate) >= get_toyota_steer_rate_limit(CAR.TOYOTA_COROLLA_TSS2),
+        get_toyota_lat_active(True, 117 * direction), counter, MAX_STEER_RATE_FRAMES,
+      )
+      requests.append(request)
+    assert requests == [True] * 30 + ([True] * 17 + [False]) * 2 + [True] * 30
 
   @staticmethod
   def _make_controller(*, standstill_req=False, last_standstill=False):
@@ -858,6 +894,31 @@ class TestToyotaCarController:
     controller.update_auto_hold_state(cs, activation_frames=0)
     assert not controller.brake_hold_active
 
+  def test_camry_auto_hold_uses_legacy_aeb_brake_path(self):
+    controller = self._make_controller()
+    controller.CP.carFingerprint = CAR.TOYOTA_CAMRY_TSS2
+    controller.packer = CANPacker(DBC[CAR.TOYOTA_CAMRY_TSS2][Bus.pt])
+    controller.frame = 0
+
+    cs = SimpleNamespace(
+      out=SimpleNamespace(
+        standstill=True,
+        cruiseState=SimpleNamespace(available=True, enabled=False),
+        gasPressed=False,
+        brakePressed=True,
+        gearShifter=structs.CarState.GearShifter.drive,
+      ),
+      pre_collision_2={},
+    )
+
+    can_sends = controller.create_auto_brake_hold_messages(cs, brake_hold_allowed_timer=0)
+    parser = CANParser(DBC[CAR.TOYOTA_CAMRY_TSS2][Bus.pt], [("PRE_COLLISION_2", 0)], 0)
+    parser.update([(1, can_sends)])
+
+    assert controller.brake_hold_active
+    assert parser.vl["PRE_COLLISION_2"]["DSS1GDRV"] == -1.0
+    assert parser.vl["PRE_COLLISION_2"]["PBRTRGR"] == 1
+
   def test_prius_resume_request_releases_standstill_latch(self):
     controller = self._make_controller(standstill_req=True, last_standstill=True)
 

opendbc_repo/opendbc/car/toyota/toyotacan.py

@@ -89,6 +89,38 @@ def create_pcs_commands(packer, accel, active, mass):
   return [msg1, msg2]
 
 
+def create_brake_hold_command(packer, frame, pre_collision_2, brake_hold_active):
+  values = {s: pre_collision_2[s] for s in [
+    "DSS1GDRV",
+    "DS1STAT2",
+    "DS1STBK2",
+    "PCSWAR",
+    "PCSALM",
+    "PCSOPR",
+    "PCSABK",
+    "PBATRGR",
+    "PPTRGR",
+    "IBTRGR",
+    "CLEXTRGR",
+    "IRLT_REQ",
+    "BRKHLD",
+    "AVSTRGR",
+    "VGRSTRGR",
+    "PREFILL",
+    "PBRTRGR",
+    "PCSDIS",
+    "PBPREPMP",
+  ] if s in pre_collision_2}
+
+  if brake_hold_active:
+    values = {
+      "DSS1GDRV": 0x3FF,
+      "PBRTRGR": frame % 730 < 727,
+    }
+
+  return packer.make_can_msg("PRE_COLLISION_2", 0, values)
+
+
 def create_acc_cancel_command(packer):
   values = {
     "GAS_RELEASED": 0,

opendbc_repo/opendbc/car/toyota/values.py

@@ -629,6 +629,10 @@ TOYOTA_AUTO_HOLD_CARS = (TSS2_CAR - RADAR_ACC_CAR - SECOC_CAR) | {
   CAR.TOYOTA_RAV4H,
 }
 
+# The Camry uses the legacy camera AEB replacement for Auto Hold. Other
+# supported Toyota models use the ACC_CONTROL hold request.
+TOYOTA_AUTO_HOLD_AEB_CARS = {CAR.TOYOTA_CAMRY_TSS2}
+
 # no resume button press required
 NO_STOP_TIMER_CAR = CAR.with_flags(ToyotaFlags.NO_STOP_TIMER)
 

opendbc_repo/opendbc/car/volvo/carcontroller.py

@@ -170,8 +170,6 @@ class CarController(CarControllerBase):
           # convention = driver pushing right → yields right authority
           # (LOOSELY/+ arm), retains left (INV/- arm).
           # Yield arm scales with |drv| above OVERRIDE_THRESH — strong presses
-          # (potholes, hard corrections) cross past zero so EPS hands the wheel
-          # to the driver in their direction.
           excess = max(0.0, self.lca_auth_drv_mag_filt - float(P.LCA_AUTH_OVERRIDE_ENTER))
           yield_signed = float(P.LCA_AUTH_YIELD_BASE) - P.LCA_AUTH_YIELD_SLOPE * excess
           yield_signed = max(float(P.LCA_AUTH_YIELD_MIN), min(yield_signed, float(P.LCA_AUTH_YIELD_BASE)))

opendbc_repo/opendbc/car/volvo/tests/test_controller.py

@@ -1,11 +1,14 @@
 from collections import defaultdict
 from types import SimpleNamespace
 
+import pytest
+
 from opendbc.car.volvo.carcontroller import CarController
 from opendbc.car.volvo.helpers import checksum_lca_5_message
 from opendbc.car.volvo.interface import CarInterface
 from opendbc.car.volvo.values import CAR, DBC
 from opendbc.car.volvo.volvocan import create_c1_checksum
+from opendbc.safety.tests.libsafety import libsafety_py
 
 
 def _zero_message():
@@ -70,6 +73,35 @@ def test_controller_relays_stock_lca5_angle_when_inactive():
   assert abs(raw * 0.05596 - 12.0) < 0.1
 
 
+@pytest.mark.parametrize("fingerprint", [CAR.POLESTAR_2, CAR.VOLVO_XC40_RECHARGE])
+@pytest.mark.parametrize("driver_torque", [20.0, -20.0, 128.0, -127.0])
+def test_override_lca_stream_passes_safety_and_recovers(fingerprint, driver_torque):
+  cp = CarInterface.get_non_essential_params(fingerprint)
+  controller = CarController(DBC[cp.carFingerprint], cp)
+  cs = _state()
+  cc = SimpleNamespace(latActive=True, actuators=_Actuators())
+  safety = libsafety_py.libsafety
+  config = cp.safetyConfigs[0]
+  assert safety.set_safety_hooks(config.safetyModel.raw, config.safetyParam) == 0
+  safety.init_tests()
+  safety.set_controls_allowed(True)
+
+  for active, torque in [(True, 0), (True, driver_torque), (True, -driver_torque),
+                        (True, 0), (False, 0), (True, 0)]:
+    cc.latActive = active
+    cs.out.steeringTorque = torque
+    for _ in range(350):
+      _, messages = controller.update(cc, cs, 0, None)
+      address, data, bus = next(msg for msg in messages if msg[0] == 0x58)
+      assert safety.safety_tx_hook(libsafety_py.make_CANPacket(address, bus, data)), (
+        active, torque, controller.frame, controller.lca_auth_pos, controller.lca_auth_neg)
+    if active and torque == 0:
+      assert controller.lca_auth_pos == 614
+      assert controller.lca_auth_neg == -614
+    elif active:
+      assert min(abs(controller.lca_auth_pos), abs(controller.lca_auth_neg)) == 0
+
+
 def _c1_state():
   return SimpleNamespace(
     out=SimpleNamespace(steeringAngleDeg=10.0, vEgo=12.0, vEgoRaw=12.0),

opendbc_repo/opendbc/car/volvo/values.py

@@ -71,14 +71,12 @@ class CarControllerParams:
   # (potholes, lane corrections) get full yield while light sustained pressure
   # only gets a soft yield. yield_signed = YIELD_BASE − YIELD_SLOPE *
   # max(0, drv_mag_filt − OVERRIDE_ENTER), clamped to [YIELD_MIN, YIELD_BASE].
-  # At |drv|=7 (just over threshold): yield = +60 (light resistance).
-  # At |drv|=14: yield ≈ -4 (crosses past zero — EPS hands wheel to driver).
   # drv_mag_filt is a low-pass of |drv| (alpha=0.04, ~250 ms time constant) —
   # without it, 1-2 unit driver-torque jitter became ~10 unit yield-arm jitter
   # which PSCM converted to felt ripple at sustained co-steering pressure.
   LCA_AUTH_YIELD_BASE = 60        # yield-arm magnitude at the override threshold
   LCA_AUTH_YIELD_SLOPE = 8        # counts of yield reduction per unit |drv torque| above threshold
-  LCA_AUTH_YIELD_MIN = -30        # cap how far past zero the yield arm can go (full hand-over)
+  LCA_AUTH_YIELD_MIN = 0          # yield authority without crossing the safety sign boundary
   LCA_AUTH_YIELD_LP_ALPHA = 0.04  # LP-filter coefficient on |drv| for yield calc (~250 ms tau)
   LCA_AUTH_SPLIT = 200            # symmetric → asymmetric handover
   LCA_AUTH_REBUILD_RATE = 230     # counts/s (≈ 2.7 s rebuild from 0 to 614)

opendbc_repo/opendbc/dbc/generator/hyundai/hyundai_canfd.dbc

@@ -727,10 +727,14 @@ BO_ 1259 LOCAL_TIME2: 8 XXX
  SG_ NEW_SIGNAL_3 : 39|1@0+ (1,0) [0|1] "" XXX
 
 BO_ 1264 LOCAL_TIME: 8 XXX
- SG_ HOURS : 12|5@0+ (1,0) [0|31] "" XXX
- SG_ MINUTES : 21|6@0+ (1,0) [0|63] "" XXX
- SG_ SECONDS : 31|8@0+ (1,0) [0|59] "" XXX
+ SG_ HOURS : 8|8@1+ (1,0) [0|23] "" XXX
+ SG_ MINUTES : 16|8@1+ (1,0) [0|59] "" XXX
+ SG_ SECONDS : 24|8@1+ (1,0) [0|59] "" XXX
+ SG_ MONTH : 34|4@1+ (1,0) [1|12] "" XXX
+ SG_ YEAR : 40|8@1+ (1,2000) [2000|2255] "" XXX
+ SG_ DAY : 48|8@1+ (1,0) [1|31] "" XXX
 
+CM_ BO_ 1264 "Cluster wall clock, 1Hz. Local time, not UTC. All 0xFF until the cluster initializes.";
 CM_ SG_ 96 BRAKE_PRESSURE "User applied brake pedal pressure. Ramps from computer applied pressure on falling edge of cruise. Cruise cancels if !=0";
 CM_ SG_ 101 BRAKE_POSITION "User applied brake pedal position, max is ~700. Signed on some vehicles";
 CM_ SG_ 203 ADAS_ActvACISta "ADAS Active AngleControlInterface State";

opendbc_repo/opendbc/dbc/generator/subaru/subaru_global_2017.dbc

@@ -1,5 +1,15 @@
 CM_ "IMPORT _subaru_global.dbc";
 
+BO_ 1723 AVH_Request: 8 XXX
+ SG_ CHECKSUM : 0|8@1+ (1,0) [0|255] "" XXX
+ SG_ COUNTER : 8|4@1+ (1,0) [0|15] "" XXX
+ SG_ REQUEST : 16|2@1+ (1,0) [0|3] "" XXX
+
+BO_ 811 AVH_Status: 8 XXX
+ SG_ CHECKSUM : 0|8@1+ (1,0) [0|255] "" XXX
+ SG_ COUNTER : 8|4@1+ (1,0) [0|15] "" XXX
+ SG_ ENABLED : 45|1@1+ (1,0) [0|1] "" XXX
+
 BO_ 72 Transmission: 8 XXX
  SG_ CHECKSUM : 0|8@1+ (1,0) [0|255] "" XXX
  SG_ COUNTER : 8|4@1+ (1,0) [0|15] "" XXX

opendbc_repo/opendbc/dbc/hyundai_canfd_generated.dbc

@@ -964,10 +964,14 @@ BO_ 1259 LOCAL_TIME2: 8 XXX
  SG_ NEW_SIGNAL_3 : 39|1@0+ (1,0) [0|1] "" XXX
 
 BO_ 1264 LOCAL_TIME: 8 XXX
- SG_ HOURS : 12|5@0+ (1,0) [0|31] "" XXX
- SG_ MINUTES : 21|6@0+ (1,0) [0|63] "" XXX
- SG_ SECONDS : 31|8@0+ (1,0) [0|59] "" XXX
+ SG_ HOURS : 8|8@1+ (1,0) [0|23] "" XXX
+ SG_ MINUTES : 16|8@1+ (1,0) [0|59] "" XXX
+ SG_ SECONDS : 24|8@1+ (1,0) [0|59] "" XXX
+ SG_ MONTH : 34|4@1+ (1,0) [1|12] "" XXX
+ SG_ YEAR : 40|8@1+ (1,2000) [2000|2255] "" XXX
+ SG_ DAY : 48|8@1+ (1,0) [1|31] "" XXX
 
+CM_ BO_ 1264 "Cluster wall clock, 1Hz. Local time, not UTC. All 0xFF until the cluster initializes.";
 CM_ SG_ 96 BRAKE_PRESSURE "User applied brake pedal pressure. Ramps from computer applied pressure on falling edge of cruise. Cruise cancels if !=0";
 CM_ SG_ 101 BRAKE_POSITION "User applied brake pedal position, max is ~700. Signed on some vehicles";
 CM_ SG_ 203 ADAS_ActvACISta "ADAS Active AngleControlInterface State";

opendbc_repo/opendbc/dbc/subaru_global_2017_generated.dbc

@@ -307,6 +307,16 @@ VAL_ 544 AEB_Status 12 "AEB related" 8 "AEB actuation" 4 "AEB related" 0 "No AEB
 
 CM_ "subaru_global_2017.dbc starts here";
 
+BO_ 1723 AVH_Request: 8 XXX
+ SG_ CHECKSUM : 0|8@1+ (1,0) [0|255] "" XXX
+ SG_ COUNTER : 8|4@1+ (1,0) [0|15] "" XXX
+ SG_ REQUEST : 16|2@1+ (1,0) [0|3] "" XXX
+
+BO_ 811 AVH_Status: 8 XXX
+ SG_ CHECKSUM : 0|8@1+ (1,0) [0|255] "" XXX
+ SG_ COUNTER : 8|4@1+ (1,0) [0|15] "" XXX
+ SG_ ENABLED : 45|1@1+ (1,0) [0|1] "" XXX
+
 BO_ 72 Transmission: 8 XXX
  SG_ CHECKSUM : 0|8@1+ (1,0) [0|255] "" XXX
  SG_ COUNTER : 8|4@1+ (1,0) [0|15] "" XXX

opendbc_repo/opendbc/safety/modes/ford.h

@@ -96,6 +96,8 @@ static bool ford_lka_steering = false;
 static bool ford_extended_lateral = false;
 static bool ford_longitudinal = false;
 static bool ford_cancel_resume_button = false;
+static bool ford_mach_e_curvature = false;
+static int ford_path_angle_last = 0;
 
 // Curvature rate limits
 #define FORD_LIMITS(limit_lateral_acceleration) {                                               \
@@ -121,10 +123,10 @@ static bool ford_cancel_resume_button = false;
 
 static const AngleSteeringLimits FORD_STEERING_LIMITS = FORD_LIMITS(false);
 
-#define FORD_EXTENDED_LIMITS(limit_lateral_acceleration) {                                      \
+#define FORD_EXTENDED_LIMITS(limit_lateral_acceleration, max_curvature_error) {                 \
   .max_angle = 1000,                                                                            \
   .angle_deg_to_can = 50000,                                                                    \
-  .max_angle_error = 100,                                                                       \
+  .max_angle_error = (max_curvature_error),                                                     \
   .angle_rate_up_lookup = {                                                                     \
     {5., 16., 25.},                                                                             \
     {0.0025, 0.0014, 0.00018}                                                                   \
@@ -140,7 +142,7 @@ static const AngleSteeringLimits FORD_STEERING_LIMITS = FORD_LIMITS(false);
   .inactive_angle_is_zero = true,                                                               \
 }
 
-static const AngleSteeringLimits FORD_EXTENDED_STEERING_LIMITS = FORD_EXTENDED_LIMITS(false);
+static const AngleSteeringLimits FORD_EXTENDED_STEERING_LIMITS = FORD_EXTENDED_LIMITS(false, 100);
 
 static void ford_rx_hook(const CANPacket_t *msg) {
   if (msg->bus == FORD_MAIN_BUS) {
@@ -318,7 +320,8 @@ static bool ford_tx_hook(const CANPacket_t *msg) {
   // Safety check for LateralMotionControl2 action
   if (msg->addr == FORD_LateralMotionControl2) {
     static const AngleSteeringLimits FORD_CANFD_STEERING_LIMITS = FORD_LIMITS(true);
-    static const AngleSteeringLimits FORD_CANFD_EXTENDED_STEERING_LIMITS = FORD_EXTENDED_LIMITS(true);
+    static const AngleSteeringLimits FORD_CANFD_EXTENDED_STEERING_LIMITS = FORD_EXTENDED_LIMITS(true, 100);
+    static const AngleSteeringLimits FORD_MACH_E_CURVATURE_LIMITS = FORD_EXTENDED_LIMITS(true, 300);
 
     // Signal: LatCtl_D2_Rq
     bool steer_control_enabled = ((msg->data[0] >> 4) & 0x7U) != 0U;
@@ -336,9 +339,19 @@ static bool ford_tx_hook(const CANPacket_t *msg) {
     if (ford_extended_lateral) {
       violation |= desired_path_offset != 0;
       violation |= (desired_curvature_rate < -1024) || (desired_curvature_rate > 1023);
-      violation |= desired_path_angle != 0;
+      if (desired_path_angle != 0) {
+        const float speed = vehicle_speed.max / VEHICLE_SPEED_FACTOR;
+        const float curvature = (float)SAFETY_ABS(desired_curvature) / 50000.0f;
+        const float path_angle = (float)SAFETY_ABS(desired_path_angle) / 2000.0f;
+        const float combined_acceleration = (curvature + path_angle / SAFETY_MAX(speed, 1.0f)) * speed * speed;
+        violation |= !ford_mach_e_curvature || !steer_control_enabled || !controls_allowed;
+        violation |= (speed < 3.0f) || (speed >= 8.8f);
+        violation |= (SAFETY_ABS(desired_curvature) < 975) || (SAFETY_ABS(desired_path_angle) > 320);
+        violation |= (desired_curvature * desired_path_angle <= 0) || (combined_acceleration > 2.5f);
+        violation |= SAFETY_ABS(desired_path_angle - ford_path_angle_last) > 110;
+      }
       violation |= steer_angle_cmd_checks(desired_curvature, steer_control_enabled,
-                                          FORD_CANFD_EXTENDED_STEERING_LIMITS);
+                                          ford_mach_e_curvature ? FORD_MACH_E_CURVATURE_LIMITS : FORD_CANFD_EXTENDED_STEERING_LIMITS);
       if (!steer_control_enabled) {
         violation |= (desired_curvature != 0) || (desired_curvature_rate != 0);
       }
@@ -352,6 +365,8 @@ static bool ford_tx_hook(const CANPacket_t *msg) {
 
     if (violation) {
       tx = false;
+    } else {
+      ford_path_angle_last = desired_path_angle;
     }
   }
 
@@ -406,8 +421,11 @@ static safety_config ford_init(uint16_t param) {
 
   const uint16_t FORD_PARAM_CANFD = 2;
   const uint16_t FORD_PARAM_LKA_STEERING = 4;
+  const uint16_t FORD_PARAM_MACH_E_CURVATURE = 8;
   const bool ford_canfd = GET_FLAG(param, FORD_PARAM_CANFD);
   ford_lka_steering = GET_FLAG(param, FORD_PARAM_LKA_STEERING);
+  ford_mach_e_curvature = ford_canfd && GET_FLAG(param, FORD_PARAM_MACH_E_CURVATURE);
+  ford_path_angle_last = 0;
   ford_extended_lateral = false;
   ford_cancel_resume_button = false;
 

opendbc_repo/opendbc/safety/modes/hyundai.h

@@ -330,7 +330,7 @@ static bool hyundai_tx_hook(const CANPacket_t *msg) {
     const int expected_track2 = 497 + (2 * ((int)track1 - 264));
     if ((msg->data[4] & 0x70U) != 0U ||
         (msg->data[5] != hyundai_ray_pedal_checksum(msg)) ||
-        (enabled && (track1 < 264U || track1 > 397U || track2 < 497U || track2 > 766U ||
+        (enabled && (track1 < 264U || track1 > 473U || track2 < 497U || track2 > 919U ||
                      SAFETY_ABS((int)track2 - expected_track2) > 40)) ||
         (!enabled && ((track1 != 0U) || (track2 != 0U))) ||
         longitudinal_interceptor_checks(msg) ||

opendbc_repo/opendbc/safety/modes/hyundai_canfd.h

@@ -65,6 +65,7 @@
 static bool hyundai_canfd_alt_buttons = false;
 static bool hyundai_canfd_lka_steering_alt = false;
 static bool hyundai_canfd_angle_steering = false;
+static bool hyundai_canfd_no_stock_lka = false;
 static bool hyundai_ccnc = false;
 static bool hyundai_canfd_ccnc_angle_long = false;
 static bool hyundai_canfd_lka_alt_drive_gear = false;
@@ -100,7 +101,8 @@ static bool hyundai_canfd_lka_alt_openpilot_allowed(void) {
 }
 
 static bool hyundai_canfd_lka_alt_stock_forwarding(void) {
-  return hyundai_canfd_lka_steering_alt && hyundai_canfd_angle_steering && !hyundai_canfd_lka_alt_openpilot_allowed();
+  return hyundai_canfd_lka_steering_alt && hyundai_canfd_angle_steering &&
+         !hyundai_canfd_no_stock_lka && !hyundai_canfd_lka_alt_openpilot_allowed();
 }
 
 static void hyundai_canfd_rx_all_hook(const CANPacket_t *msg) {
@@ -270,6 +272,10 @@ static bool hyundai_canfd_tx_hook(const CANPacket_t *msg) {
       const int lkas_angle_active = (msg->data[9] >> 4U) & 0x3U;
       const bool steer_angle_req = lkas_angle_active != 1;
 
+      if (hyundai_canfd_no_stock_lka && steer_angle_req && !hyundai_canfd_lka_alt_openpilot_allowed()) {
+        tx = false;
+      }
+
       int desired_angle = (msg->data[11] << 6U) | (msg->data[10] >> 2U);
       desired_angle = to_signed(desired_angle, 14);
 
@@ -364,6 +370,7 @@ static safety_config hyundai_canfd_init(uint16_t param) {
   const uint16_t HYUNDAI_PARAM_CANFD_LKA_STEERING_ALT = 128;
   const uint16_t HYUNDAI_PARAM_CANFD_ALT_BUTTONS = 32;
   const uint16_t HYUNDAI_PARAM_CANFD_ANGLE_STEERING = 1024;
+  const uint16_t HYUNDAI_PARAM_CANFD_NO_STOCK_LKA = 4096U;
   const uint16_t HYUNDAI_PARAM_CCNC = 32768U;
 
   static const CanMsg HYUNDAI_CANFD_LKA_STEERING_TX_MSGS[] = {
@@ -479,12 +486,15 @@ static safety_config hyundai_canfd_init(uint16_t param) {
     {0x7C4, 2, 8, .check_relay = true},  /* camera support frame */ \
     {0xEA, 2, 24, .check_relay = true},  /* MDPS support frame */ \
 
-  hyundai_common_init(param);
+  // This CAN-FD-only bit is independent of classic CAN's NON_SCC mode.
+  hyundai_common_init(param & ~HYUNDAI_PARAM_CANFD_NO_STOCK_LKA);
 
   gen_crc_lookup_table_16(0x1021, hyundai_canfd_crc_lut);
   hyundai_canfd_alt_buttons = GET_FLAG(param, HYUNDAI_PARAM_CANFD_ALT_BUTTONS);
   hyundai_canfd_lka_steering_alt = GET_FLAG(param, HYUNDAI_PARAM_CANFD_LKA_STEERING_ALT);
   hyundai_canfd_angle_steering = GET_FLAG(param, HYUNDAI_PARAM_CANFD_ANGLE_STEERING);
+  hyundai_canfd_no_stock_lka = hyundai_canfd_angle_steering && hyundai_canfd_lka_steering &&
+                             hyundai_canfd_lka_steering_alt && GET_FLAG(param, HYUNDAI_PARAM_CANFD_NO_STOCK_LKA);
   hyundai_ccnc = GET_FLAG(param, HYUNDAI_PARAM_CCNC);
   hyundai_canfd_ccnc_angle_long = hyundai_longitudinal && hyundai_canfd_lka_steering &&
                                   hyundai_canfd_lka_steering_alt && hyundai_canfd_angle_steering && hyundai_ccnc;

opendbc_repo/opendbc/safety/modes/subaru.h

@@ -136,6 +136,8 @@ static uint32_t subaru_compute_checksum(const CANPacket_t *msg) {
   return checksum;
 }
 
+#include "opendbc/safety/modes/subaru_avh.h"
+
 static void subaru_rx_hook(const CANPacket_t *msg) {
   const unsigned int alt_main_bus = subaru_gen2 ? SUBARU_ALT_BUS : SUBARU_MAIN_BUS;
   const unsigned int status_bus = subaru_gen2 ? SUBARU_ALT_BUS : SUBARU_CAM_BUS;
@@ -308,6 +310,10 @@ static bool subaru_tx_hook(const CANPacket_t *msg) {
     violation |= subaru_get_checksum(msg) != subaru_compute_checksum(msg);
   }
 
+  if (msg->addr == 0x6BBU) {
+    violation |= !subaru_avh_tx(msg);
+  }
+
   if (violation){
     tx = false;
   }
@@ -315,6 +321,12 @@ static bool subaru_tx_hook(const CANPacket_t *msg) {
 }
 
 static safety_config subaru_init(uint16_t param) {
+  static const CanMsg SUBARU_LEGACY_AVH_TX_MSGS[] = {
+    SUBARU_BASE_TX_MSGS(SUBARU_ALT_BUS, MSG_SUBARU_ES_LKAS_ANGLE)
+    SUBARU_COMMON_TX_MSGS(SUBARU_ALT_BUS)
+    SUBARU_STOP_START_TX_MSGS(SUBARU_ALT_BUS)
+    {0x6BBU, SUBARU_ALT_BUS, 8, .check_relay = false},
+  };
   static const CanMsg SUBARU_TX_MSGS[] = {
     SUBARU_BASE_TX_MSGS(SUBARU_MAIN_BUS, MSG_SUBARU_ES_LKAS)
     SUBARU_COMMON_TX_MSGS(SUBARU_MAIN_BUS)
@@ -455,12 +467,22 @@ static safety_config subaru_init(uint16_t param) {
           subaru_stop_and_go  ? BUILD_SAFETY_CFG(subaru_rx_checks, SUBARU_STOP_AND_GO_TX_MSGS) : \
                                 BUILD_SAFETY_CFG(subaru_rx_checks, SUBARU_TX_MSGS);
   }
+  bool avh_enabled = false;
+#ifdef ALLOW_DEBUG
+  avh_enabled = GET_FLAG(param, 1024U) && subaru_gen2 && subaru_lkas_angle && subaru_fixed_angle_limits &&
+                subaru_stop_start_button && !subaru_d_platform && !GET_FLAG(param, 2U) && !subaru_redneck_cruise;
+#endif
+  subaru_avh_init(avh_enabled);
+  if (avh_enabled) {
+    ret = BUILD_SAFETY_CFG(subaru_gen2_lkas_angle_rx_checks, SUBARU_LEGACY_AVH_TX_MSGS);
+  }
   return ret;
 }
 
 const safety_hooks subaru_hooks = {
   .init = subaru_init,
   .rx = subaru_rx_hook,
+  .rx_all = subaru_avh_rx,
   .tx = subaru_tx_hook,
   .get_counter = subaru_get_counter,
   .get_checksum = subaru_get_checksum,

opendbc_repo/opendbc/safety/modes/subaru_avh.h

@@ -0,0 +1,140 @@
+#pragma once
+
+// Legacy startup AVH only. Never transmit the 0x32B status message.
+static const unsigned int SUBARU_AVH_INPUTS[] = {0x6BBU, 0x32BU, 0x40U, 0x48U, 0x13AU, 0x174U};
+static uint8_t subaru_avh_data[6][8];
+static uint32_t subaru_avh_ts[6];
+static bool subaru_avh_seen[6];
+static bool subaru_avh_seq[6];
+static bool subaru_avh_enabled;
+static bool subaru_avh_done;
+static unsigned int subaru_avh_count;
+static uint32_t subaru_avh_start;
+static uint32_t subaru_avh_sent;
+static uint32_t subaru_avh_template_ts;
+static uint32_t subaru_avh_stable_since;
+static bool subaru_avh_stable;
+
+static void subaru_avh_init(bool enabled) {
+  subaru_avh_enabled = enabled;
+  subaru_avh_done = false;
+  subaru_avh_count = 0U;
+  subaru_avh_start = microsecond_timer_get();
+  subaru_avh_sent = 0U;
+  subaru_avh_template_ts = 0U;
+  subaru_avh_stable_since = 0U;
+  subaru_avh_stable = false;
+  for (int i = 0; i < 6; i++) {
+    subaru_avh_seen[i] = false;
+    subaru_avh_seq[i] = false;
+    subaru_avh_ts[i] = 0U;
+    for (int j = 0; j < 8; j++) {
+      subaru_avh_data[i][j] = 0U;
+    }
+  }
+}
+
+static bool subaru_avh_ready(uint32_t now) {
+  bool ready = true;
+  for (int i = 0; i < 6; i++) {
+    ready &= subaru_avh_seen[i] && subaru_avh_seq[i] &&
+             (safety_get_ts_elapsed(now, subaru_avh_ts[i]) <= ((i == 0) ? 1500000U : 300000U));
+  }
+  const unsigned int rpm = ((unsigned int)subaru_avh_data[2][2] | ((unsigned int)subaru_avh_data[2][3] << 8U)) & 0x1FFFU;
+  ready &= (rpm >= 400U) && (subaru_avh_data[2][4] == 0U) && (subaru_avh_data[3][3] == 4U);
+  ready &= (subaru_avh_data[5][2] & 8U) != 0U;
+  ready &= !vehicle_moving && !controls_allowed;
+  return ready;
+}
+
+static void subaru_avh_rx(const CANPacket_t *msg) {
+  if (subaru_avh_enabled && !subaru_avh_done && (msg->bus == 1U)) {
+    const uint32_t now = microsecond_timer_get();
+    for (int i = 0; i < 6; i++) {
+      if (msg->addr == SUBARU_AVH_INPUTS[i]) {
+        if ((GET_LEN(msg) != 8U) || (subaru_get_checksum(msg) != subaru_compute_checksum(msg))) {
+          subaru_avh_done = true;
+        } else {
+          const uint8_t old_counter = subaru_avh_data[i][1] & 0xFU;
+          const uint8_t counter = msg->data[1] & 0xFU;
+          if (!subaru_avh_seen[i] || (counter != old_counter)) {
+            subaru_avh_seq[i] = subaru_avh_seen[i] && (counter == ((old_counter + 1U) & 0xFU));
+            subaru_avh_seen[i] = true;
+            subaru_avh_ts[i] = now;
+            for (int j = 0; j < 8; j++) {
+              subaru_avh_data[i][j] = msg->data[j];
+            }
+          }
+          if (((i == 0) && ((msg->data[2] & 3U) != 0U)) ||
+              ((i == 1) && ((msg->data[5] & 0x20U) != 0U)) ||
+              ((i == 2) && (msg->data[4] != 0U)) || ((i == 3) && (msg->data[3] != 4U)) ||
+              ((i == 4) && (((GET_BYTES(msg, 1, 3) >> 4) & 0x1FFFU) != 0U ||
+                            ((GET_BYTES(msg, 3, 3) >> 1) & 0x1FFFU) != 0U ||
+                            ((GET_BYTES(msg, 4, 3) >> 6) & 0x1FFFU) != 0U ||
+                            ((GET_BYTES(msg, 6, 2) >> 3) & 0x1FFFU) != 0U))) {
+            subaru_avh_done = true;
+          }
+        }
+      }
+    }
+    if (controls_allowed || (safety_get_ts_elapsed(now, subaru_avh_start) > 30000000U)) {
+      subaru_avh_done = true;
+    }
+    if (!subaru_avh_ready(now)) {
+      subaru_avh_stable = false;
+      if (subaru_avh_count > 0U) {
+        subaru_avh_done = true;
+      }
+    } else if (!subaru_avh_stable) {
+      subaru_avh_stable = true;
+      subaru_avh_stable_since = now;
+    }
+  }
+}
+
+static bool subaru_avh_tx(const CANPacket_t *msg) {
+  const uint32_t now = microsecond_timer_get();
+  const uint32_t elapsed = safety_get_ts_elapsed(now, subaru_avh_start);
+  const bool second = subaru_avh_count == 1U;
+  bool allowed = subaru_avh_enabled && !subaru_avh_done && (subaru_avh_count < 2U) &&
+                 (msg->bus == 1U) && (GET_LEN(msg) == 8U) && !safety_rx_checks_invalid &&
+                 (elapsed >= 10000000U) && (elapsed <= 30000000U) && subaru_avh_ready(now) &&
+                 subaru_avh_stable && (safety_get_ts_elapsed(now, subaru_avh_stable_since) >= 3000000U);
+  // Rejected generic RX frames may not reach our hook; invalidate their cached inputs too.
+  for (int i = 0; i < current_safety_config.rx_checks_len; i++) {
+    const RxCheck *check = &current_safety_config.rx_checks[i];
+    for (int j = 0; j < 6; j++) {
+      if (((unsigned int)check->msg[check->status.index].addr == SUBARU_AVH_INPUTS[j]) && (check->msg[check->status.index].bus == 1U)) {
+        allowed &= check->status.valid_checksum && (check->status.wrong_counters < MAX_WRONG_COUNTERS);
+      }
+    }
+  }
+  if (second) {
+    const uint32_t spacing = safety_get_ts_elapsed(now, subaru_avh_sent);
+    allowed &= (spacing >= 45000U) && (spacing <= 80000U) && (subaru_avh_ts[0] == subaru_avh_template_ts) &&
+               (safety_get_ts_elapsed(now, subaru_avh_ts[0]) <= 110000U);
+  } else {
+    allowed &= safety_get_ts_elapsed(now, subaru_avh_ts[0]) <= 30000U;
+  }
+  uint8_t sum = (uint8_t)(0xBBU + 6U);
+  for (int i = 1; i < 8; i++) {
+    uint8_t expected = subaru_avh_data[0][i];
+    if (i == 1) {
+      expected = (expected & 0xF0U) | ((expected + (second ? 2U : 1U)) & 0xFU);
+    } else if (i == 2) {
+      expected |= 2U;
+    } else {
+      // Preserve every unrelated payload bit.
+    }
+    allowed &= msg->data[i] == expected;
+    sum += expected;
+  }
+  allowed &= msg->data[0] == sum;
+  if (allowed) {
+    subaru_avh_count++;
+    subaru_avh_sent = now;
+    subaru_avh_template_ts = subaru_avh_ts[0];
+    subaru_avh_done = second;
+  }
+  return allowed;
+}

opendbc_repo/opendbc/safety/modes/toyota.h

@@ -404,7 +404,12 @@ static bool toyota_tx_hook(const CANPacket_t *msg) {
       tx = false;
     }
 
-    if ((msg->addr == 0x344U) && toyota_stock_longitudinal) {
+    // Camry Auto Hold replaces the camera AEB message only while stopped.
+    if ((msg->addr == 0x344U) && ((alternative_experience & ALT_EXP_ALLOW_AEB) != 0)) {
+      if (vehicle_moving || gas_pressed || !acc_main_on) {
+        tx = false;
+      }
+    } else if ((msg->addr == 0x344U) && toyota_stock_longitudinal) {
       tx = false;
     }
   }
@@ -571,11 +576,21 @@ static safety_config toyota_init(uint16_t param) {
   return ret;
 }
 
+static bool toyota_fwd_hook(int bus_num, int addr) {
+  bool block_msg = false;
+  if (bus_num == 2) {
+    block_msg = (addr == 0x344) && ((alternative_experience & ALT_EXP_ALLOW_AEB) != 0) &&
+                !vehicle_moving && !gas_pressed && acc_main_on;
+  }
+  return block_msg;
+}
+
 const safety_hooks toyota_hooks = {
   .init = toyota_init,
   .rx = toyota_rx_hook,
   .rx_all = toyota_rx_all_hook,
   .tx = toyota_tx_hook,
+  .fwd = toyota_fwd_hook,
   .get_checksum = toyota_get_checksum,
   .compute_checksum = toyota_compute_checksum,
   .get_quality_flag_valid = toyota_get_quality_flag_valid,

opendbc_repo/opendbc/safety/tests/safety_replay/replay_drive.py

@@ -20,6 +20,7 @@ def replay_drive(msgs, safety_mode, param, alternative_experience):
   init_segment(safety, msgs, safety_mode, param)
 
   rx_tot, rx_invalid, tx_tot, tx_blocked, tx_controls, tx_controls_blocked = 0, 0, 0, 0, 0, 0
+  tx_lateral, tx_lateral_blocked = 0, 0
   safety_tick_rx_invalid = False
   blocked_addrs = Counter()
   invalid_addrs = set()
@@ -38,14 +39,20 @@ def replay_drive(msgs, safety_mode, param, alternative_experience):
     if msg.which() == 'sendcan':
       for canmsg in msg.sendcan:
         _msg = package_can_msg(canmsg)
+        # TX hooks can revoke permission on a violation. Count the permission
+        # before checking the message, including lateral-only AOL operation.
+        controls_allowed = safety.get_controls_allowed()
+        lateral_allowed = controls_allowed or safety.get_aol_allowed()
         sent = safety.safety_tx_hook(_msg)
         if not sent:
           tx_blocked += 1
-          tx_controls_blocked += safety.get_controls_allowed()
+          tx_controls_blocked += controls_allowed
+          tx_lateral_blocked += lateral_allowed
           blocked_addrs[canmsg.address] += 1
 
           carlog.debug("blocked bus %d msg %d at %f" % (canmsg.src, canmsg.address, (msg.logMonoTime - start_t) / 1e9))
-        tx_controls += safety.get_controls_allowed()
+        tx_controls += controls_allowed
+        tx_lateral += lateral_allowed
         tx_tot += 1
     elif msg.which() == 'can':
       # ignore msgs we sent
@@ -68,9 +75,11 @@ def replay_drive(msgs, safety_mode, param, alternative_experience):
   print("total msgs with controls allowed:", tx_controls)
   print("blocked msgs:", tx_blocked)
   print("blocked with controls allowed:", tx_controls_blocked)
+  print("total msgs with lateral allowed:", tx_lateral)
+  print("blocked with lateral allowed:", tx_lateral_blocked)
   print("blocked addrs:", blocked_addrs)
 
-  return tx_controls_blocked == 0 and rx_invalid == 0 and not safety_tick_rx_invalid
+  return tx_lateral_blocked == 0 and rx_invalid == 0 and not safety_tick_rx_invalid
 
 
 if __name__ == "__main__":

opendbc_repo/opendbc/safety/tests/safety_replay/test_replay_drive.py

@@ -0,0 +1,63 @@
+import importlib.util
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+from unittest.mock import Mock
+
+import pytest
+
+
+@pytest.fixture
+def replay_module(monkeypatch):
+  # Load the sibling source explicitly, without native safety libraries or a
+  # host-runtime snapshot. These tests isolate replay accounting, not CAN rules.
+  monkeypatch.setitem(sys.modules, "opendbc.car.carlog", SimpleNamespace(carlog=Mock()))
+  monkeypatch.setitem(sys.modules, "opendbc.safety.tests.libsafety", SimpleNamespace(libsafety_py=SimpleNamespace()))
+  monkeypatch.setitem(sys.modules, "opendbc.safety.tests.safety_replay.helpers",
+                      SimpleNamespace(package_can_msg=lambda msg: msg, init_segment=Mock()))
+  spec = importlib.util.spec_from_file_location("replay_drive_accounting", Path(__file__).with_name("replay_drive.py"))
+  module = importlib.util.module_from_spec(spec)
+  spec.loader.exec_module(module)
+  module.tqdm = lambda msgs: msgs
+  return module
+
+
+@pytest.mark.parametrize("controls,aol,accepted,post_controls,post_aol", [
+  (False, True, False, False, True),   # AOL-only denial must fail replay.
+  (False, True, False, False, False),  # A TX hook can revoke AOL permission.
+  (True, False, False, False, False),  # A TX hook can revoke controls permission.
+  (False, False, False, False, False),  # Expected inactive blocks remain allowed.
+  (False, False, False, True, True),  # Post-hook permission must not misclassify a block.
+  (False, True, True, False, True),
+  (True, False, True, True, False),
+  (True, True, True, True, True),      # Count overlapping permissions only once.
+])
+def test_tx_authorization_accounted_before_hook(replay_module, capsys, controls, aol, accepted, post_controls, post_aol):
+  state = SimpleNamespace(controls=controls, aol=aol)
+
+  def tx_hook(msg):
+    state.controls = post_controls
+    state.aol = post_aol
+    return accepted
+
+  safety = Mock()
+  safety.set_safety_hooks.return_value = 0
+  safety.get_controls_allowed.side_effect = lambda: state.controls
+  safety.get_aol_allowed.side_effect = lambda: state.aol
+  safety.safety_tx_hook.side_effect = tx_hook
+  replay_module.libsafety_py.libsafety = safety
+  packet = SimpleNamespace(address=0x488, src=0, dat=b"\x00" * 4)
+  msg = SimpleNamespace(logMonoTime=0, sendcan=[packet], which=lambda: "sendcan")
+
+  result = replay_module.replay_drive([msg], 10, 0, 0)
+
+  lateral_allowed = controls or aol
+  assert result == (accepted or not lateral_allowed)
+  safety.safety_tx_hook.assert_called_once_with(packet)
+  output = capsys.readouterr().out
+  assert "total openpilot msgs: 1\n" in output
+  assert f"total msgs with controls allowed: {int(controls)}\n" in output
+  assert f"blocked msgs: {int(not accepted)}\n" in output
+  assert f"blocked with controls allowed: {int(controls and not accepted)}\n" in output
+  assert f"total msgs with lateral allowed: {int(lateral_allowed)}\n" in output
+  assert f"blocked with lateral allowed: {int(lateral_allowed and not accepted)}\n" in output

opendbc_repo/opendbc/safety/tests/test_ford.py

@@ -467,6 +467,53 @@ class TestFordCANFDStockSafety(TestFordSafetyBase):
     self.safety.set_safety_hooks(CarParams.SafetyModel.ford, FordSafetyFlags.CANFD)
     self.safety.init_tests()
 
+
+class TestFordMachEExtendedCurvatureSafety(TestFordCANFDStockSafety):
+  def setUp(self):
+    self.packer = CANPackerSafety("ford_lincoln_base_pt")
+    self.safety = libsafety_py.libsafety
+    self.safety.set_safety_hooks(CarParams.SafetyModel.ford,
+                                 FordSafetyFlags.CANFD | FordSafetyFlags.MACH_E_CURVATURE)
+    self.safety.init_tests()
+
+  def test_mach_e_extended_curvature_error(self):
+    self.safety.set_controls_allowed(True)
+    self._reset_curvature_measurement(0.0, 12.0)
+    self.assertTrue(self._tx(self._extended_lka_msg()))
+
+    for curvature, allowed in ((0.0058, True), (0.0062, False), (-0.0058, True), (-0.0062, False)):
+      self._set_prev_desired_angle(curvature)
+      self.assertEqual(allowed, self._tx(self._lat_ctl_msg(True, 0.0, 0.0, curvature, 0.0)))
+
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.02, 0.005, 0.0)))
+
+  def test_mach_e_bounded_path_angle_assist(self):
+    self.safety.set_controls_allowed(True)
+    self._reset_curvature_measurement(0.02, 7.5)
+    self._set_prev_desired_angle(0.02)
+    self.assertTrue(self._tx(self._extended_lka_msg()))
+    for path_angle in (0.055, 0.11, 0.15):
+      self.assertTrue(self._tx(self._lat_ctl_msg(True, 0.0, path_angle, 0.02, 0.0)))
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.161, 0.02, 0.0)))
+    self.assertTrue(self._tx(self._lat_ctl_msg(True, 0.0, 0.0, 0.02, 0.0)))
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, -0.055, 0.02, 0.0)))
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.055, 0.018, 0.0)))
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.12, 0.02, 0.0)))
+    self._reset_curvature_measurement(0.02, 9.0)
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.055, 0.02, 0.0)))
+
+  def test_other_canfd_fords_keep_original_error(self):
+    self.safety.set_safety_hooks(CarParams.SafetyModel.ford, FordSafetyFlags.CANFD)
+    self.safety.init_tests()
+    self.safety.set_controls_allowed(True)
+    self._reset_curvature_measurement(0.0, 12.0)
+    self.assertTrue(self._tx(self._extended_lka_msg()))
+    self._set_prev_desired_angle(0.0058)
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.0, 0.0058, 0.0)))
+    self._reset_curvature_measurement(0.02, 7.5)
+    self._set_prev_desired_angle(0.02)
+    self.assertFalse(self._tx(self._lat_ctl_msg(True, 0.0, 0.055, 0.02, 0.0)))
+
 class TestFordStockSafety(TestFordSafetyBase):
   STEER_MESSAGE = MSG_LateralMotionControl
   STOCK_LONGITUDINAL = True

opendbc_repo/opendbc/safety/tests/test_hyundai.py

@@ -635,6 +635,23 @@ class TestHyundaiLongitudinalAolLkasOnEngageSafety(HyundaiAolLkasOnEngageBase, T
                                  HyundaiSafetyFlags.LONG | HyundaiStarPilotSafetyFlags.AOL_LKAS_ON_ENGAGE)
     self.safety.init_tests()
 
+  def test_main_off_after_brake_keeps_lateral_permission(self):
+    self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.ALWAYS_ON_LATERAL)
+
+    self._rx(self._button_msg(Buttons.NONE, main_button=1))
+    self._rx(self._button_msg(Buttons.NONE, main_button=0))
+    self._rx(self._button_msg(Buttons.SET))
+    self._rx(self._button_msg(Buttons.NONE))
+    self._rx(self._user_brake_msg(True))
+    self._rx(self._button_msg(Buttons.NONE, main_button=1))
+    self._rx(self._button_msg(Buttons.NONE, main_button=0))
+
+    self.assertFalse(self.safety.get_controls_allowed())
+    self.assertFalse(self.safety.get_acc_main_on())
+    self.assertTrue(self.safety.get_lkas_on())
+    self._set_prev_torque(0)
+    self.assertTrue(self._tx(self._torque_cmd_msg(self.MAX_RATE_UP)))
+
 
 class TestHyundaiLongitudinalAolMainLkasOnEngageSafety(TestHyundaiLongitudinalSafety):
   def setUp(self):

opendbc_repo/opendbc/safety/tests/test_hyundai_canfd.py

@@ -959,5 +959,85 @@ class TestHyundaiCanfdLKASteeringAolLkasOnEngageEV(HyundaiAolLkasOnEngageStockBa
     self.safety.init_tests()
 
 
+class TestSportageNoStockLka(unittest.TestCase):
+  TX_MSGS = None  # Supplemental transition tests, not a separate safety mode.
+  PARAM = (HyundaiSafetyFlags.CANFD_LKA_STEERING | HyundaiSafetyFlags.CANFD_LKA_STEERING_ALT |
+           HyundaiSafetyFlags.CANFD_ANGLE_STEERING | HyundaiSafetyFlags.HYBRID_GAS)
+
+  def setUp(self):
+    self.safety = libsafety_py.libsafety
+    self.packer = CANPackerSafety("hyundai_canfd_generated")
+    self._init(True)
+
+  def _init(self, suppress):
+    param = self.PARAM | (HyundaiStarPilotSafetyFlags.CANFD_NO_STOCK_LKA if suppress else 0)
+    self.safety.set_safety_hooks(CarParams.SafetyModel.hyundaiCanfd, param)
+    self.safety.init_tests()
+    self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.ALWAYS_ON_LATERAL)
+
+  def _speed(self, speed):
+    for _ in range(common.MAX_SAMPLE_VALS):
+      self.safety.safety_rx_hook(self.packer.make_can_msg_safety(
+        "WHEEL_SPEEDS", 1, {f"WHL_Spd{pos}Val": speed for pos in ("FL", "FR", "RL", "RR")}))
+
+  def _toggle(self):
+    for pressed in (1, 0):
+      self.safety.safety_rx_hook(self.packer.make_can_msg_safety("CRUISE_BUTTONS", 1, {"LDA_BTN": pressed}))
+
+  def _steer(self, active, gain=None):
+    return self.packer.make_can_msg_safety("LKAS_ALT", 0, {
+      "LKAS_ANGLE_ACTIVE": 2 if active else 1,
+      "ADAS_StrAnglReqVal": 0,
+      "ADAS_ACIAnglTqRedcGainVal": (0.4 if active else 0.0) if gain is None else gain,
+      "Damping_Gain": 100,
+    })
+
+  def test_stock_scc_buttons_require_engagement(self):
+    resume = self.packer.make_can_msg_safety("CRUISE_BUTTONS", 1, {"CRUISE_BUTTONS": Buttons.RESUME})
+    set_button = self.packer.make_can_msg_safety("CRUISE_BUTTONS", 1, {"CRUISE_BUTTONS": Buttons.SET})
+    self.assertFalse(self.safety.safety_tx_hook(resume))
+    self.assertFalse(self.safety.safety_tx_hook(set_button))
+
+    self.safety.safety_rx_hook(set_button)
+    self.safety.safety_rx_hook(self.packer.make_can_msg_safety("SCC_CONTROL", 1, {"ACCMode": 1}))
+    self.assertTrue(self.safety.get_controls_allowed())
+    self.assertTrue(self.safety.safety_tx_hook(resume))
+    self.assertTrue(self.safety.safety_tx_hook(set_button))
+
+    self.safety.safety_rx_hook(self.packer.make_can_msg_safety("SCC_CONTROL", 1, {"ACCMode": 0}))
+    self.assertFalse(self.safety.safety_tx_hook(resume))
+    self.assertFalse(self.safety.safety_tx_hook(set_button))
+
+  def test_aol_toggle_keeps_stock_blocked_and_inactive_status_allowed(self):
+    self._speed(30)
+    for expected_aol in (False, True, False, True, False):
+      if expected_aol != self.safety.get_aol_allowed():
+        self._toggle()
+      self.assertEqual(expected_aol, self.safety.get_aol_allowed())
+      for addr in (0x110, 0x362):
+        self.assertEqual(-1, self.safety.safety_fwd_hook(2, addr))
+      self.assertTrue(self.safety.safety_tx_hook(self._steer(False)))
+      self.assertTrue(self.safety.safety_tx_hook(common.make_msg(0, 0x362, 32)))
+      self.assertEqual(expected_aol, self.safety.safety_tx_hook(self._steer(True)))
+      self.assertFalse(self.safety.safety_tx_hook(self._steer(False, gain=0.4)))
+
+  def test_standstill_does_not_allow_active_steering(self):
+    self._speed(0)
+    self._toggle()
+    self.assertTrue(self.safety.get_aol_allowed())
+    self.assertFalse(self.safety.safety_tx_hook(self._steer(True)))
+    self.assertTrue(self.safety.safety_tx_hook(self._steer(False)))
+    self.assertEqual(-1, self.safety.safety_fwd_hook(2, 0x110))
+
+  def test_unflagged_handoff_and_reinitialization_unchanged(self):
+    self._init(False)
+    self._speed(30)
+    self.assertEqual(0, self.safety.safety_fwd_hook(2, 0x110))
+    self.assertFalse(self.safety.safety_tx_hook(self._steer(False)))
+    self._toggle()
+    self.assertEqual(-1, self.safety.safety_fwd_hook(2, 0x110))
+    self.assertTrue(self.safety.safety_tx_hook(self._steer(True)))
+
+
 if __name__ == "__main__":
   unittest.main()

opendbc_repo/opendbc/safety/tests/test_hyundai_ray_pedal.py

@@ -4,6 +4,7 @@ from opendbc.can import CANPacker
 from opendbc.car import create_gas_interceptor_command
 from opendbc.car.structs import CarParams
 from opendbc.safety.tests.libsafety import libsafety_py
+from opendbc.safety.tests.test_hyundai import checksum
 
 
 @pytest.mark.parametrize("param", [0x9405, 0x9C05, 0x9401, 0x1005, 0])
@@ -20,8 +21,9 @@ def test_ray_pedal_tx_isolation_and_limits(param):
 
   has_ray_signature = param in (0x9405, 0x9C05)
   assert tx(0) is has_ray_signature
-  assert tx(0.35) is has_ray_signature
-  assert not tx(0.36)  # above the Ray-only initial command cap
+  assert tx(0.55) is has_ray_signature
+  assert not tx(0.56)
+  assert not tx(0.70)
   assert not tx(1.0)
 
   if has_ray_signature:
@@ -82,3 +84,49 @@ def test_non_ray_hyundai_ev_keeps_native_driver_gas_detection():
   native_gas = bytes.fromhex("004e008000ae0700")
   assert safety.safety_rx_hook(libsafety_py.make_CANPacket(0x371, 0, native_gas))
   assert safety.get_gas_pressed_prev()
+
+
+@pytest.mark.parametrize("controls_allowed", [False, True])
+def test_ray_native_cruise_cancel_allowed_during_pedal_override(controls_allowed):
+  safety = libsafety_py.libsafety
+  safety.set_safety_hooks(CarParams.SafetyModel.hyundai, 0x9405)
+  safety.init_tests()
+  safety.set_controls_allowed(controls_allowed)
+  safety.set_gas_pressed_prev(True)
+  packer = CANPacker("hyundai_can_refresh_generated")
+  addr, dat, bus = packer.make_can_msg("CLU11", 0, {"CF_Clu_CruiseSwState": 4})
+  assert safety.safety_tx_hook(libsafety_py.make_CANPacket(addr, bus, dat))
+
+  pedal_packer = CANPacker("hyundai_kia_ray_pedal")
+  addr, dat, bus = create_gas_interceptor_command(pedal_packer, 0.1, 3)
+  assert not safety.safety_tx_hook(libsafety_py.make_CANPacket(addr, bus, dat))
+
+
+def test_ray_standstill_launch_obeys_hardware_brake_override():
+  safety = libsafety_py.libsafety
+  safety.set_safety_hooks(CarParams.SafetyModel.hyundai, 0x9405)
+  safety.init_tests()
+  packer = CANPacker("hyundai_can_refresh_generated")
+  pedal_packer = CANPacker("hyundai_kia_ray_pedal")
+
+  def rx(name, values):
+    addr, dat, bus = checksum(packer.make_can_msg(name, 0, values))
+    assert safety.safety_rx_hook(libsafety_py.make_CANPacket(addr, bus, dat))
+
+  def tx(gas):
+    addr, dat, bus = create_gas_interceptor_command(pedal_packer, gas, 0)
+    return safety.safety_tx_hook(libsafety_py.make_CANPacket(addr, bus, dat))
+
+  rx("WHL_SPD11", {"WHL_SPD_FL": 0, "WHL_SPD_RR": 0})
+  assert not safety.get_vehicle_moving()
+  rx("TCS13", {"DriverOverride": 2})
+  safety.set_controls_allowed(True)
+  assert safety.get_brake_pressed_prev()
+  assert tx(0)
+  assert not tx(0.012)
+  rx("TCS13", {"DriverOverride": 0})
+  assert not safety.get_brake_pressed_prev()
+  assert tx(0.012)
+  rx("TCS13", {"DriverOverride": 2})
+  assert not tx(0.012)
+  assert tx(0)

opendbc_repo/opendbc/safety/tests/test_subaru_avh.py

@@ -0,0 +1,107 @@
+import pytest
+
+from opendbc.car.structs import CarParams
+from opendbc.car.subaru.avh import AVH_REQUEST, AVH_STATUS, INPUTS, avh_request, checksum
+from opendbc.car.subaru.tests.test_avh import sample
+from opendbc.car.subaru.values import SubaruSafetyFlags
+from opendbc.safety.tests.libsafety import libsafety_py
+
+FLAGS = int(SubaruSafetyFlags.GEN2 | SubaruSafetyFlags.LKAS_ANGLE | SubaruSafetyFlags.FIXED_ANGLE_LIMITS |
+            SubaruSafetyFlags.STOP_START_BUTTON | SubaruSafetyFlags.AVH_STARTUP)
+
+
+def packet(address, data, bus=1):
+  return libsafety_py.make_CANPacket(address, bus, data)
+
+
+@pytest.fixture
+def safety():
+  s = libsafety_py.libsafety
+  s.set_timer(0)
+  assert s.set_safety_hooks(CarParams.SafetyModel.subaru, FLAGS) == 0
+  s.set_controls_allowed(False)
+  for tick in range(101):
+    s.set_timer(tick * 100_000)
+    for address in INPUTS:
+      if address != AVH_REQUEST or tick % 10 == 0:
+        assert s.safety_rx_hook(packet(address, sample(address, tick // 10 if address == AVH_REQUEST else tick)))
+  return s
+
+
+def request(step=1):
+  return avh_request(sample(AVH_REQUEST, 10), step)[1]
+
+
+def test_pair_and_third_frame_blocked(safety):
+  assert safety.safety_tx_hook(packet(AVH_REQUEST, request()))
+  safety.set_timer(10_050_000)
+  assert safety.safety_tx_hook(packet(AVH_REQUEST, request(2)))
+  safety.set_timer(10_100_000)
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request(2)))
+
+
+@pytest.mark.parametrize('byte', range(8))
+def test_payload_mutation_blocked(safety, byte):
+  data = bytearray(request())
+  data[byte] ^= 4
+  if byte:
+    data[0] = checksum(AVH_REQUEST, data)
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, data))
+
+
+@pytest.mark.parametrize('bus', [0, 2])
+def test_wrong_bus_blocked(safety, bus):
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request(), bus))
+
+
+@pytest.mark.parametrize('delay', [44_999, 80_001])
+def test_followup_timing(safety, delay):
+  assert safety.safety_tx_hook(packet(AVH_REQUEST, request()))
+  safety.set_timer(10_000_000 + delay)
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request(2)))
+
+
+@pytest.mark.parametrize('address,offset,value', [(AVH_REQUEST, 2, 1), (AVH_STATUS, 5, 32),
+                                                (0x40, 4, 1), (0x48, 3, 3), (0x13A, 2, 1)])
+def test_abort_on_manual_ack_or_movement(safety, address, offset, value):
+  assert safety.safety_tx_hook(packet(AVH_REQUEST, request()))
+  safety.set_timer(10_050_000)
+  data = bytearray(sample(address, 11 if address == AVH_REQUEST else 101))
+  data[offset] = value
+  data[0] = checksum(address, data)
+  assert safety.safety_rx_hook(packet(address, data))
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request(2)))
+
+
+def test_stale_template_and_status_tx_blocked(safety):
+  assert not safety.safety_tx_hook(packet(AVH_STATUS, sample(AVH_STATUS, 1)))
+  safety.set_timer(10_030_001)
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request()))
+
+
+@pytest.mark.parametrize('flags', [FLAGS & ~1024, FLAGS | 32, FLAGS | 2, FLAGS & ~16, FLAGS | 512])
+def test_permission_gates(safety, flags):
+  assert safety.set_safety_hooks(CarParams.SafetyModel.subaru, flags) == 0
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request()))
+
+
+@pytest.mark.parametrize('reason', ['new_template', 'corrupt', 'engaged', 'expired', 'duplicate'])
+def test_extra_failure_gates(safety, reason):
+  if reason == 'engaged':
+    safety.set_controls_allowed(True)
+  elif reason == 'expired':
+    safety.set_timer(30_000_001)
+  elif reason == 'duplicate':
+    safety.set_timer(10_040_000)
+    assert safety.safety_rx_hook(packet(AVH_REQUEST, sample(AVH_REQUEST, 10)))
+  elif reason == 'corrupt':
+    data = bytearray(sample(AVH_REQUEST, 11))
+    data[0] ^= 1
+    safety.safety_rx_hook(packet(AVH_REQUEST, data))
+  else:
+    assert safety.safety_tx_hook(packet(AVH_REQUEST, request()))
+    safety.set_timer(10_050_000)
+    assert safety.safety_rx_hook(packet(AVH_REQUEST, sample(AVH_REQUEST, 11)))
+    assert not safety.safety_tx_hook(packet(AVH_REQUEST, request(2)))
+    return
+  assert not safety.safety_tx_hook(packet(AVH_REQUEST, request()))

opendbc_repo/opendbc/safety/tests/test_toyota.py

@@ -147,6 +147,34 @@ class TestToyotaSafetyBase(common.CarSafetyTest, common.LongitudinalAccelSafetyT
     self.safety.set_alternative_experience(0)
     self.assertFalse(self._tx(hold_msg))
 
+  def test_auto_brake_hold_aeb_replacement_only_at_standstill(self):
+    if (not self.LONGITUDINAL or
+        self.safety.get_current_safety_param() & (ToyotaSafetyFlags.STOCK_LONGITUDINAL.value | ToyotaSafetyFlags.SECOC.value)):
+      raise unittest.SkipTest("Toyota AEB Auto Hold requires non-SecOC openpilot longitudinal control")
+
+    self.safety.set_alternative_experience(ALTERNATIVE_EXPERIENCE.ALLOW_AEB)
+    hold_msg = libsafety_py.make_CANPacket(0x344, 0, b"\xfd\x80\x00\x00\x00\x00\x00\xcc")
+
+    self._rx(self._speed_msg(0))
+    self._rx(self._toggle_aol(True))
+    self._rx(self._user_gas_msg(False))
+    self.assertTrue(self._tx(hold_msg))
+    self.assertEqual(-1, self.safety.safety_fwd_hook(2, 0x344))
+
+    self._rx(self._speed_msg(1.0))
+    self.assertFalse(self._tx(hold_msg))
+    self.assertEqual(0, self.safety.safety_fwd_hook(2, 0x344))
+
+    self._rx(self._speed_msg(0))
+    self._rx(self._user_gas_msg(True))
+    self.assertFalse(self._tx(hold_msg))
+    self.assertEqual(0, self.safety.safety_fwd_hook(2, 0x344))
+
+    self._rx(self._user_gas_msg(False))
+    self._rx(self._toggle_aol(False))
+    self.assertFalse(self._tx(hold_msg))
+    self.assertEqual(0, self.safety.safety_fwd_hook(2, 0x344))
+
   # Only allow LTA msgs with no actuation
   def test_lta_steer_cmd(self):
     for engaged, req, req2, torque_wind_down, angle in itertools.product([True, False],

panda/board/obj/gitversion.h

@@ -1,2 +1,2 @@
 extern const uint8_t gitversion[19];
-const uint8_t gitversion[19] = "DEV-14370fe9-DEBUG";
+const uint8_t gitversion[19] = "DEV-96ef704d-DEBUG";