diff --git a/gc_bba_test/source/tests.c b/gc_bba_test/source/tests.c
index 6e99cd9..b87484b 100644
--- a/gc_bba_test/source/tests.c
+++ b/gc_bba_test/source/tests.c
@@ -375,8 +375,34 @@ static int t_dma(char *m, size_t n)
 		         buf[16], buf[17]);
 		return 0;
 	}
-	snprintf(m, n, "p%u len 0x%04X implausible (RWP=%u)", (unsigned)page,
-	         (unsigned)dlen, (unsigned)(((u32)wp[1] << 8) | wp[0]));
+	/* Diagnostic: the length alone does not say WHERE the frames are.  Walk
+	 * all 15 ring pages and classify each descriptor, so one run shows
+	 * whether the ring is empty, written at a different page than RRP says,
+	 * or holding genuinely malformed descriptors:
+	 *   '-' all-zero (never written)   'o' plausible frame length
+	 *   'x' non-zero but implausible   '?' read failed
+	 * Plus the raw 4 descriptor bytes at the RRP page. */
+	{
+		char map[16];
+		u32 pg;
+		u8 d[4];
+		for (pg = 1; pg <= 15; pg++) {
+			u32 dl;
+			if (bba_stream((u16)(pg << 8), d, 4) < 0) {
+				map[pg - 1] = '?';
+				continue;
+			}
+			dl = ((u32)d[2] << 8) | d[3];
+			if (d[0] == 0 && d[1] == 0 && dl == 0)      map[pg - 1] = '-';
+			else if (dl > 4 && dl <= 1518)              map[pg - 1] = 'o';
+			else                                        map[pg - 1] = 'x';
+		}
+		map[15] = 0;
+		snprintf(m, n, "p%u len 0x%04X raw %02X %02X %02X %02X RWP=%u map %s",
+		         (unsigned)page, (unsigned)dlen,
+		         buf[0], buf[1], buf[2], buf[3],
+		         (unsigned)(((u32)wp[1] << 8) | wp[0]), map);
+	}
 	return 1;
 }