[lionelZhaowy]

The EEPROM HAL calculates the control byte with shifts that place the block and chip-select bits above bit 7. Passing that value to the byte-wide DIF discards them. Reads in higher 64 KiB blocks therefore address block zero instead.

Map logical address bit 16 to B0 and bits 17/18 to the device-select bits. The one-line change follows the Microchip 24FC1025 Device Addressing format: 1010 B0 A1 A0 R/W.

Validation used official Cheshire 6c6dd5e834347f72c7be31cd6c41021ec293c5b9 and its locked opentitan_peripherals DIF cd3153de2783abd3d03d0595e6c4b32413c62f14. The host test compiles the actual HAL and DIF, then instruments their existing MMIO boundary. Ten one-byte reads cover all eight block/device selections and two boundary addresses. A literal table supplies independent expected control bytes.

• Original: 16 wrong write-address/read-control bytes.
• Patch: zero errors across the same ten cases.
• Both: expected scripted read data and unchanged buffer guards.
• GCC -std=gnu11 -O2 -Wall -Wextra -Werror: no warnings.

Commands and explicit adapters are in sw/tests/host/EEPROM_CONTROL.md. The test aliases the initializer's MMIO field token for the instrumented host type. It supplies a CLINT callback and scripted FIFO responses. It does not use an EEPROM model or claim RTL, STOP, page-write, or timing verification. Other EEPROM HAL defects remain separate.

AI assistance: OpenAI Codex assisted implementation, test, and validation. A separate AI review checked the actual changes and results. This was not a human review.