I'm wondering how deep the hack is... it seems sending a frame is just setting some registers and waiting for an interrupt. This suggests (though I'm not an exp

I'm wondering how deep the hack is... it seems sending a frame is just setting some registers and waiting for an interrupt. This suggests (though I'm not an expert!) that they are talking to another layer of firmware that does the actual stuff? Reminds me a bit of the Raspberry pico board which has the main RP2040 SoC but where the WiFi is a separate WiFi/BT module (CYW43xx) with its own Arm cores. Not even the external register interface to the WiFi module is documented publicly, but there is an open source driver (https://github.com/georgerobotics/cyw43-driver/tree/cf924bb04c8984675ca0fc2178f082e404e048c3 https://github.com/georgerobotics/cyw43-driver/tree/cf924bb0...) so one can infer the specification. However, this driver yet again talks to software running on Arm codes inside the module, the code for which is supplied as big firmware binary blobs by the manufacturer (the blobs are actually in the linked repo, defined inside header files in the firmware directory). I'm wondering how this ESP32 hack corresponds to this?