I'm still trying to trace the rlsol -> plsol path, and I'm stuck in BRLPSSOL

I am assuming SY_BDE=0 (no direct injection)

After the fupsrl and IAT (evtmod actually) correction, it looks like rfr/rfrs is being subtracted and added back in... what are those constants?

Also, after walking through the whole thing, my calculated plsol isn't even close to what I'm actually logging

I still can't figure out how plsol is being calculated.

I have roughly:

subtract, add rfr (or rfrs) (but only to make sure it doesn't go negative)

divide by fupsrl (post evtmod correction via FWFTBRTA)

div by fpbrkds (from KFPBRK/KFPBRKNW)
div by vplsspls (from KVPDKSD/KFVPDKSDE)

but the result is off by a whole fuckton... any idea?

anybody have the RAM loc of fupsrl in mbox for logging?

haven't tried disassembling BRLPSSOL yet (i'm not great with IDA...)