diff --git a/FABRIC.md b/FABRIC.md
index 4d71b14..686c337 100644
--- a/FABRIC.md
+++ b/FABRIC.md
@@ -2013,9 +2013,13 @@ on until there is a tick on all three architectures (§16.1, §16.5).*
   least one trap. Exceptions still halt with the same diagnostic as before.
 
 - [ ] **0.3 — riscv64: SBI timer and real time base.**
-  Arm the timer via the SBI TIME extension. Switch the time base from `rdcycle` to the
-  `time` CSR and take its frequency from the device tree `timebase-frequency`, with a named
-  fallback constant — not a bare magic number (§16.2).
+  **First, the prerequisite this item silently assumed (B1 verified it absent):** the
+  kernel has no DTB access — `BootInfo` (`uefi.h:624-639`) carries no FDT pointer and no
+  FDT code exists in the tree. Capture the DTB pointer from the EFI configuration table
+  (DTB table GUID) into a new `BootInfo` field in the shared loader. This also serves 0.6.
+  Then: arm the timer via the SBI TIME extension. Switch the time base from `rdcycle` to
+  the `time` CSR and take its frequency from the device tree `timebase-frequency`, with a
+  named fallback constant — not a bare magic number (§16.2).
   *Done when:* `heartbeat_ticks()` advances on riscv64 and the tick interval matches the
   configured rate within measurement noise. Verify the SBI extension is present before
   relying on it; if it is absent, stop and report rather than falling back silently.
@@ -2035,7 +2039,11 @@ on until there is a tick on all three architectures (§16.1, §16.5).*
 - [ ] **0.6 — aarch64: minimal GICv2.**
   Enable the distributor and CPU interface, set the priority mask, enable the timer PPI,
   acknowledge via `IAR` / `EOIR`. **Read the base addresses and the PPI INTID from the
-  device tree — do not take them from memory or from this document.**
+  device tree — do not take them from memory or from this document.** The DTB pointer
+  comes from the `BootInfo` field added in 0.3 (B1 verified no such field existed). If the
+  DTB turns out to be unreachable on aarch64 EDK2, stop and report — deciding between
+  loader work and named QEMU-virt constants with a recorded caveat is Captain Bob's call,
+  not the implementer's.
   *Done when:* the timer interrupt is delivered and acknowledged. Scope is one interrupt;
   a general GIC driver is out of scope and must not be written.