CPUINFO.TXT attached.
Thanks, matches M10 except for MPU region #6 which is unused here.
Also added another screenshot of the Canon OSD in rec mode.
That matches what I would see in the first RGBA buffer in my cams. The AF rectangle, for example, is always drawn on the second buffer.
The camera obviously does have an AF frame, and it is drawn somewhere. The yuv+opacity buffers should also be present somewhere that is accessible from the display hardware.
I would not rule out the possibility that, for this camera, the creators chose to configure the hw differently. On other cams, they seemed to keep memory mappings uniform between CPUs (ARM and Xtensa cores see the main RAM from address 0).
May I ask how you retrieve RAM content for purposes of finding something in it? Have you made full RAM dumps, and if so, with what method (cached address, uncached address, address passed directly to write() or memcpy'd to a buffer before)?