A successful CTRL read alone does not establish that all DMA registers are reachable. Compare each expected register and response with the observations in symptom 4.
What to notice. H3 is inside APB; other holes reach the fabric default; the DMA slot has a fixed set of register offsets.
AXI SLVERR, translated from the APB default slave PSLVERR.
Create a response predictor for every unmapped range and a register predictor for every documented DMA offset. Find and inject a fault that reproduces symptom 4, then check every documented register after your correction.
The five DMA register offsets (CTRL, STATUS, LEN, KEY, COUNT) from Programming the DMA Registers.
The four unmapped ranges (H1 to H4) and their response codes in The NanoSoC Tour.
Symptom 4 in the symptom table.
Deliverable. A response table with one probe per unmapped range and the expected response code, and a register table that maps each documented DMA offset to the register you expect to read.
Pass criterion. Your predictor agrees with the documented response for every probe and with the documented register for every offset; changing any single offset in your table makes the check fail.
The response table: probe address, expected code, and the block that must produce it.
The register table: offset, expected register, observed register for symptom 4.
Which repeated offsets you consider intended, and where the documentation says so.
Keep your diagnosis in your own report. After the stage checks, compare it with Solutions and run the provided injection checks.