Huh ? I don't understand what you are trying to say here at all. You believe FFF6B4DC-FFF6B6E4 are the addresses of something (which they aren't BTW, for the reason you suggested).
What is the address of the instruction that you believe refers to these addresses ? If you don't have such an address, where do the above values come from ? Be specific.
When I enter the branch "BL sub_FFA568A8\n" the first 3 register values are:
r0=FFD29730
r1=(av apex96)
r2= 672 (672 is apex96 value corresponding with F11)
The r0 address does not seem important to this branch as it gets stored away to r5 and overwritten:
ffa568b0: e59f0150 ldr r0, [pc, #336] ; ffa56a08: (0000d100)
ffa568b4: e1a04001 mov r4, r1
ffa568b8: e5900004 ldr r0, [r0, #4]
This is the point where the addresses I am referring to appear:
r0=FFF6B6E4
also note that our apex96 value gets moved out to r4 for future use
Jumping ahead:
ffa568c0: e1a0c000 mov ip, r0
move r0 to ip
ffa568c4: e08c1102 add r1, ip, r2, lsl #2
this is an important step as this is where the iterative loop is placed.
at first run, r2=0 so r1=ip=r0
ffa568c8: e1d130f0 ldrsh r3, [r1]
ffa568cc: e1530004 cmp r3, r4
at first run, r3=292 (apex96 for F2.8 )
and r3 is compared to r4 (which is our set AV)
ffa568d0: aa000003 bge ffa568e4
if r3>=r4 we branch forward to continue our function
if r3<r4, we continue here which is the iterative part
ffa568d4: e2822001 add r2, r2, #1 ; 0x1
increase r2 by 1
ffa568d8: e3520084 cmp r2, #132 ; 0x84
check the iteration progression against 132 (this it what actually limits us to F11.0)
ffa568dc: e1a00001 mov r0, r1
ffa568e0: 3afffff7 bcc ffa568c4
go back to FFA568C4 if r2<132
At this point, it continues to itereate through the function until either the APEX96 value retrieved equals the set value, or we reach the iteration limit (=F11.0). Each time we iterate through, the address gets decreased by 4, this is where the address range:
FFF6B4DC-FFF6B6E4 comes from (its actually reverse, but FFF6B6E4:F2.8, FFF6B4DC:F11)
If the apex96 value started out less than 292 (AV<F2.8 ), then at address ffa568cc, the compare comes out <0 and the address is left at the initial value FFF6B6E4 corresponding to F2.8.
ffa568e4: e1510000 cmp r1, r0
ffa568e8: 11d120f0 ldrshne r2, [r1]
ffa568ec: 11520004 cmpne r2, r4
This appears to be just an error check as R1 should always equal R0 as it was set at ffa568dc.
ffa568f0: 01d100f2 ldrsheq r0, [r1, #2]
ffa568f4: 01d110b0 ldrheq r1, [r1]
ffa568f8: 01c510b0 strheq r1, [r5]
ffa568fc: 08bd8070 popeq {r4, r5, r6, pc}
This where our conversion value gets loaded from and then we return from our branch. It is the second halfword of the referenced address (first halfword is the APEX96 value). The values pulled out here are the ones I referred to previously:
AV apex96 value
11.31 672 1903
10.08 640 1791
8.98 608 1671
8.00 576 1541
7.13 544 1400
6.35 512 1277
5.66 480 1128
5.04 448 993
4.49 416 852
4.00 384 731
3.56 352 599
3.17 320 488
2.87 292 340
The address iteration goes through steps of 4, however the addresses corresponding to the camera settable values are at increments of 44 (except F2.8-F3.2 which isn't a full 1/3EV step, the increment is 36) so there are additional intermediate values between the 1/3EV steps which I haven't tried to pull out yet. Oddly, they aren't even increments with respect to the AV apex96 increment (difference of 44(11 increments) vs 32 = steps of 2.9?). I have done a quick exposure test on a 1/6EV increment with a positive result, I just didn't bother checking the conversion value yet.
It also seems that once we return from the branch, only the conversion number is used. I have done tests where I hardcode in a conversion value, and the camera exposure gets fixed at whatever aperture it corresponds to. Hardcoding the AV or address after this branch has no effect on the exposure.
I hope all this is understandable. One thing I am not certain of if the addresses I am referring to (maybe they aren't what they appear, or are a literal pool that gets built elsewhere). The apex96 values are straightforward and the conversion numbers pulled out seem right (as I can hardcode values and they work as expected).
Do you see anything wrong with how I am understanding the branch? The changes I have made to the code seem to work, I just don't know how it is reaching the original conversion values.