# Device-enable flags (SAI / O2 / lambda) — validated

## How they were found

Both stock reference maps (20187, 20188) have SAI and O2 **active**, so diffing
them can't reveal the delete flags. The confirmation came from a community map
that explicitly disables them:

`20188Map2009AIRBOXBONNY.hex` — "Bonneville, aftermarket exhaust, mechanical
odometer, NO AIR BOX, K&N, British Custom mufflers, **NO SAI, NO O² SENSORS**".
Same base as stock 20188, so the diff isolates the deletes.

Diff (flat ROM) of that map vs stock 20188 = 0.36%, split into:
- the fuel tables (airbox/K&N enrichment — expected), and
- a small cluster in the device-config region at **0x53801…0x53819**.

## The flags

They are a **byte-boolean array** at flat-ROM `base + fe[33]` (= `0x50000 + 0x3801
= 0x53801`), one byte per device, **1 = enabled, 0 = disabled**.

The delete map changed exactly three bytes from 1 → 0:

| Flat-ROM offset | Stock | Deleted | Device |
|---|---|---|---|
| `0x53801` | 1 | 0 | **SAI** (Secondary Air Injection) |
| `0x53818` | 1 | 0 | **O2 sensor** |
| `0x53819` | 1 | 0 | **O2 sensor (2)** |

SAI is the first flag in the array; the two O2 sensors are the last two —
consistent with the `Devices` resource order (SAI = index 0; O2 Sensor / O2
Sensor (2)). The three-byte change matching "NO SAI, NO O²" is unambiguous.

To disable a device: set its byte to `0`. (The `0x5369C`/`0x536AB` bytes that
also changed are idle/open-loop trim that comes with removing the O2 feedback,
not device-enable flags.)

## Editing / export

The downloaded `.hex` format's integrity is the `dc` stream cipher + the unpack
directory; the `caXX` bytes in the header/tail are map-ID metadata, **not** a
calibration checksum. So a device toggle = flip the byte in the flat ROM, re-pack
to the decoded layout, and `dc`-encode back to `.hex`. (The separate *ECU flash*
checksum is computed at flash time and is out of scope for the read/edit tool.)

## Confidence

- **SAI = 0x53801: ~90% (high).** Two independent confirmations: the device-name
  logic in `l.java` `lc()` resolves `Devices[0]=SAI` via `fe[33]` to exactly
  0x53801, AND the real NO-SAI map cleared precisely that byte.
- **O2 sensors = 0x53818 / 0x53819: ~80% (probable).** The map declares "NO O²
  SENSORS" (the twin has two) and exactly two adjacent boolean bytes cleared
  beyond SAI; the 865 has no air-flap, so airbox removal is fuel-only (no flag).
  Not independently isolated — no single-mod reference map exists, and the exact
  `x.a()` device-layout branch for this ECU (i27=72) is too deeply nested to
  trace reliably.

## The real-world caveat (more important than the labels)

Correct flags are **not** a good tune by themselves. Disabling O2 forces the ECU
**open-loop**: it stops live fuel trim and runs entirely on the base fuel map.
Stock maps assume closed-loop trim at idle/cruise, so an O2-delete on an otherwise
stock map can run lean/rough. A proper delete pairs flags-off with fuel enrichment
(which is exactly why the AIRBOXBONNY reference map also changed the fuel tables).

**Recommendation:** flash a complete, known-good delete map matching the hardware
(exhaust/filters), not hand-toggled flags on a stock map. The checkbox editor is
for understanding/building a map, not a one-click safe delete.