Discover a SunSpec Modbus device's model map by scanning well-known base registers and parsing chained model blocks.

Steps

1. Attempt to read holding registers at each candidate base address in turn — 0, 40000, and 50000 — since the SunSpec Device Information Model spec permits any of the three as the map's starting point.
2. Look for the fixed 32-bit 'SunS' marker split across the first two registers at that base (ASCII 'SunS' = 0x53756E53); its presence confirms a SunSpec map.
3. Confirm which Modbus addressing convention your stack/device uses (register 'address 0' vs. the human-readable '40001' naming) before computing offsets.
4. Read the next two registers after the marker as the first model block header: a 16-bit Model ID followed by a 16-bit Length (in registers) — this first block is normally the SunSpec Common Model (ID 1).
5. Read the following Length registers as that model's data per the SunSpec Information Model definition for that Model ID; skip unrecognized/vendor-private Model IDs using their declared Length rather than erroring.
6. Advance past the block (header + Length registers) and repeat, chaining through subsequent blocks until a block with Model ID 0xFFFF (End Model) and Length 0 is reached.