From 93df5c42a1b3ddd9362d7fc8541f811eac730248 Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Thu, 15 Oct 2026 12:43:58 +0200
Subject: [PATCH 001/218] fix(agc): run the unwatch hook when a watched import
 leaves the write watch

An import that should stay watched still drops its range from the watch
when the range was only partly watched or its import window cannot be
resolved. That fallback skipped the unwatch hook, so a storage image with
results pending in the range lost the watch without its guest bytes
saved, and its next store threw "storing storage image results pending
over memory outside the write watch without the guest bytes saved before
them is not implemented".

Since #6060 settled private imports on Windows take this path, and
ProsperoPuzzles (PPSA99006) stopped 5 s in (#6301). The fallback now
releases the tracker lock, runs the hook over the page range, and
unwatches it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Execution/src/GuestMemory.cpp             |  7 ++++++-
 .../libSceAgcDriver/tests/WriteTracking.cpp   | 21 +++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
index 8850453b34..26e7dff7d2 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
@@ -1345,7 +1345,12 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
         return true;
     }
     const WindowCopy window{first, saved, slots};
-    if (!before || !walkWrites(tracker, first, stop, StampKind::Cpu, true, &window)) unwatchLocked(tracker, first, static_cast<std::size_t>(stop - first));
+    if (!before || !walkWrites(tracker, first, stop, StampKind::Cpu, true, &window)) {
+        lock.unlock();
+        beforeUnwatch(first, static_cast<std::size_t>(stop - first));
+        lock.lock();
+        unwatchLocked(tracker, first, static_cast<std::size_t>(stop - first));
+    }
     return true;
 }
 
diff --git a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
index 86da33486d..ee6c53b388 100644
--- a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
@@ -570,6 +570,26 @@ void CheckImportWindow() {
     Require(!UnchangedSince(base, Block, after), "a store after the import window was missed");
 }
 
+std::uint64_t hookedBegin = 0;
+std::uint64_t hookedEnd = 0;
+
+void CheckImportWindowOverUnwatchedPart() {
+    void* memory = AllocateWatched(3 * Block);
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    std::memset(memory, 0x11, 3 * Block);
+    static_cast<void>(CollectWritesUncached(base, 3 * Block));
+    Unwatch(base + Block, Block);
+    SetUnwatchHook([](std::uint64_t address, std::size_t bytes) {
+        hookedBegin = address;
+        hookedEnd = address + bytes;
+    });
+    const bool imported = ImportWatched(base, 3 * Block, [] { return true; });
+    SetUnwatchHook(nullptr);
+    Require(imported, "an import over a partly unwatched range failed");
+    Require(!Watched(base, Block) && !Watched(base + 2 * Block, Block), "an import over a partly unwatched range left its watched blocks watched");
+    Require(hookedBegin <= base && hookedEnd >= base + 3 * Block, "an import that left the write watch did not run the unwatch hook over its range");
+}
+
 void CheckImportWindowOtherThread() {
     void* memory = AllocateWatched(2 * Block);
     const auto base = reinterpret_cast<std::uint64_t>(memory);
@@ -848,6 +868,7 @@ int main() {
         CheckImportWindow();
         CheckImportWindowZeroPages();
         CheckImportWindowOtherThread();
+        CheckImportWindowOverUnwatchedPart();
         CheckUnwatchedImport();
         CheckCommittedRanges();
     } catch (const std::exception& error) {

From 0205c3672fed5551239ec4c5138688533966d4c2 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 15 Oct 2026 22:29:02 +0200
Subject: [PATCH 002/218] test(agc): store results pending when an import over
 a partly unwatched range drops it

A storage image has results pending over a block whose neighbour block already left
the write watch. An import of both blocks that should stay watched cannot vouch for
its pages, so the range leaves the watch, and the image's next store has to find the
guest bytes the unwatch hook saved.

agc_storage_unwalked_import (Linux) runs that flow through HostImportFor. The host
import of the first creation is refused through the import budget so that the
import under test is the first one over the block. staleGenerationTests runs the
same flow for an import that does not stay watched; it now exists for both.
---
 core/libs/prx/libSceAgcDriver/CMakeLists.txt  |  4 ++
 .../prx/libSceAgcDriver/tests/Recorder.cpp    | 47 ++++++++++++++-----
 2 files changed, 38 insertions(+), 13 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index a6de94a52f..81879eb4d4 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -1180,6 +1180,10 @@ if(BUILD_TESTING)
         set_tests_properties(agc_storage_kept_unit_settle PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    if(NOT WIN32)
+        add_test(NAME agc_storage_unwalked_import COMMAND agc_driver_recorder_tests --unwalked-import-only)
+        set_tests_properties(agc_storage_unwalked_import PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
+    endif()
     add_test(NAME agc_storage_baseline_settled COMMAND agc_driver_recorder_tests --settled-baseline-only)
     add_test(NAME agc_storage_integer_clear COMMAND agc_driver_recorder_tests --integer-clear-only)
     set_tests_properties(agc_storage_integer_clear PROPERTIES SKIP_RETURN_CODE 77)
diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
index 7c4bd1b701..9135f56974 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
@@ -4444,41 +4444,51 @@ void importWatchTests(const Device& device) {
 #endif
 }
 
-void staleGenerationTests(const Device& device, Recorder& recorder) {
+template <bool StaysWatched>
+bool staleGenerationTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
 #ifdef _WIN32
     static_cast<void>(recorder);
     static_cast<void>(base);
     std::cout << "a range leaving the watch: Linux write watch only\n";
+    return false;
 #else
     if (base.hostImportAlignment == 0) {
         std::cout << "host imports unavailable: a range leaving the watch not tested\n";
-        return;
+        return false;
     }
     constexpr std::uint32_t side = 256;
     constexpr std::size_t surfaceBytes = side * side * 4;
     constexpr std::size_t keyCount = surfaceBytes / 256;
-    constexpr std::size_t bytes = surfaceBytes + 65536;
+    constexpr std::size_t lead = StaysWatched ? 65536 : 0;
+    constexpr std::size_t bytes = lead + surfaceBytes + 65536;
     void* block = AllocateWatched(bytes, 65536);
     if (block == nullptr) {
         std::cout << "no write watching: a range leaving the watch not tested\n";
-        return;
+        return false;
     }
     struct Release {
         void* block;
         ~Release() { ReleaseWatched(block, bytes); }
     } release{block};
     const auto decided = PrepareImportWatch(base);
-    SetImportWatch(base, ImportWatch::Unwatch);
+    SetImportWatch(base, StaysWatched ? ImportWatch::Watch : ImportWatch::Unwatch);
     struct Restore {
         const Context& context;
         ImportWatch decided;
         ~Restore() { SetImportWatch(context, decided); }
     } restore{base, decided};
-    auto* texels = static_cast<std::uint8_t*>(block);
+    struct Budget {
+        bool set;
+        ~Budget() {
+            if (set) SetHostImportBudget(0);
+        }
+    } budget{StaysWatched};
+    auto* texels = static_cast<std::uint8_t*>(block) + lead;
     std::memset(texels, 0x55, surfaceBytes);
     std::memset(texels + surfaceBytes, 0x00, keyCount);
-    const auto address = reinterpret_cast<std::uint64_t>(block);
+    const auto blockAddress = reinterpret_cast<std::uint64_t>(block);
+    const auto address = blockAddress + lead;
     {
         GuestAllocations::Mutation mutation;
         mutation.Add(block, bytes, true, true, true);
@@ -4494,7 +4504,7 @@ void staleGenerationTests(const Device& device, Recorder& recorder) {
             }
             HostImportFor(context, address, bytes);
         }
-    } unregister{base, block, address};
+    } unregister{base, block, blockAddress};
     TextureDetiler detiler(base);
     auto context = base;
     context.detiler = &detiler;
@@ -4512,7 +4522,8 @@ void staleGenerationTests(const Device& device, Recorder& recorder) {
     resource.dstSelW = 7;
     resource.dccAddress = address + surfaceBytes;
     {
-        Require(AgcDriver::GuestMemory::Watched(address, bytes), "(s) the block is not watched before the storage image takes its generation");
+        Require(AgcDriver::GuestMemory::Watched(blockAddress, bytes), "(s) the block is not watched before the storage image takes its generation");
+        if constexpr (StaysWatched) SetHostImportBudget(1);
         auto image = StorageTexture::Create(context, detiler, resource, 0);
         const VkImageSubresourceRange range{VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
         const auto commands = recorder.Commands();
@@ -4523,13 +4534,20 @@ void staleGenerationTests(const Device& device, Recorder& recorder) {
         context.Function<PFN_vkCmdClearColorImage>("vkCmdClearColorImage")(commands, image->Image(), VK_IMAGE_LAYOUT_GENERAL, &red, 1, &range);
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
         image->MarkDirty();
-        const auto* import = HostImportFor(base, address, bytes);
+        if constexpr (StaysWatched) {
+            SetHostImportBudget(0);
+            Require(!image->GuestSnapshotValid(), "(s) the pending results had saved guest bytes while their memory was watched");
+            AgcDriver::GuestMemory::Unwatch(blockAddress, lead);
+            Require(!AgcDriver::GuestMemory::Watched(blockAddress, lead) && AgcDriver::GuestMemory::Watched(address, bytes - lead), "(s) the block before the surface did not leave the watch alone");
+        }
+        const auto* import = HostImportFor(base, blockAddress, bytes);
         if (import == nullptr) {
             std::cout << "host import of the stale generation block refused: a range leaving the watch not tested\n";
             recorder.Sync();
-            return;
+            return false;
         }
-        Require(!AgcDriver::GuestMemory::Watched(address, bytes), "(s) the imported range stayed watched");
+        Require(!AgcDriver::GuestMemory::Watched(blockAddress, bytes), "(s) the imported range stayed watched");
+        if constexpr (StaysWatched) Require(image->GuestSnapshotValid(), "(s) the results pending when a walk gave up the watch saved no guest bytes");
         image->Refresh();
         Buffer readback(context, surfaceBytes, VK_BUFFER_USAGE_TRANSFER_DST_BIT);
         const auto copyCommands = recorder.Commands();
@@ -4553,6 +4571,7 @@ void staleGenerationTests(const Device& device, Recorder& recorder) {
         for (std::size_t i = 0; i < surfaceBytes; ++i) Require(texels[i] == expected[i % 4], "(s) results pending when their memory left the watch did not reach it");
     }
     recorder.Sync();
+    return true;
 #endif
 }
 
@@ -8801,6 +8820,7 @@ int main(int argc, char** argv) {
             settledBaselineTests(device, recorder);
             return 0;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--unwalked-import-only") return staleGenerationTests<true>(device, recorder) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--completion-labels-only") {
             completionCountTests(device, recorder);
             afterRecordedWorkTests(device, recorder);
@@ -8997,7 +9017,8 @@ int main(int argc, char** argv) {
         keptUnitSettleTests(device, recorder);
         settledBaselineTests(device, recorder);
         importWatchTests(device);
-        staleGenerationTests(device, recorder);
+        staleGenerationTests<false>(device, recorder);
+        staleGenerationTests<true>(device, recorder);
         importWindowTests(device, recorder);
         dataWordPositionsTests();
         dataRefreshTests(device, recorder);

From c20686e11410a33fe490a9e9d5446945ddabcd90 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 15 Oct 2026 22:29:04 +0200
Subject: [PATCH 003/218] fix(agc): run the unwatch hook before the import when
 the page walk already fails

An import that should stay watched runs the unwatch hook only when its range
leaves the write watch, after the import. When the range is partly outside the watch
or the walk before the import fails, the range leaves the watch whatever the import
does, so the hook can run first, as it does for the import that does not stay
watched.

After the import, the walk that tells an import's own page marks from CPU writes
(the window compare) is skipped in this case, so the hook collects those marks as CPU
writes. A driver that marks the pages of an import written (the NVIDIA driver on
Windows does, see Pages under an import window) makes the hook keep the blocks they
cover for the CPU unless their bytes are proven unchanged, and those blocks do not
receive the GPU results. A failure of the walk after the import still runs the hook
after it.

The check of #6308 also requires the hook to have run before the import.
---
 .../prx/libSceAgcDriver/Execution/src/GuestMemory.cpp | 11 ++++++++---
 core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp |  7 ++++++-
 docs/dev/debt/libSceAgcDriver.md                      |  2 +-
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
index 8d7f33e036..265951de04 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
@@ -1409,6 +1409,13 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
         }
     }
     const bool before = covered && walkWrites(tracker, first, stop, StampKind::Cpu, true);
+    const auto saveBytes = [&] {
+        lock.unlock();
+        beforeUnwatch(first, static_cast<std::size_t>(stop - first));
+        lock.lock();
+    };
+    const bool savedEarly = staysWatched && !before;
+    if (savedEarly) saveBytes();
     bool imported = false;
     {
 #ifdef __APPLE__
@@ -1424,9 +1431,7 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
     }
     const WindowCopy window{first, saved, slots};
     if (!before || !walkWrites(tracker, first, stop, StampKind::Cpu, true, &window)) {
-        lock.unlock();
-        beforeUnwatch(first, static_cast<std::size_t>(stop - first));
-        lock.lock();
+        if (!savedEarly) saveBytes();
         unwatchLocked(tracker, first, static_cast<std::size_t>(stop - first));
     }
     return true;
diff --git a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
index 63491a8619..f7607574bc 100644
--- a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
@@ -793,11 +793,16 @@ void CheckImportWindowOverUnwatchedPart() {
         hookedBegin = address;
         hookedEnd = address + bytes;
     });
-    const bool imported = ImportWatched(base, 3 * Block, [] { return true; });
+    bool hookedBeforeImport = false;
+    const bool imported = ImportWatched(base, 3 * Block, [&] {
+        hookedBeforeImport = hookedEnd != 0;
+        return true;
+    });
     SetUnwatchHook(nullptr);
     Require(imported, "an import over a partly unwatched range failed");
     Require(!Watched(base, Block) && !Watched(base + 2 * Block, Block), "an import over a partly unwatched range left its watched blocks watched");
     Require(hookedBegin <= base && hookedEnd >= base + 3 * Block, "an import that left the write watch did not run the unwatch hook over its range");
+    Require(hookedBeforeImport, "an import over a partly unwatched range ran the unwatch hook after the import");
 }
 
 void CheckImportWindowOtherThread() {
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index 01fbd5d3e5..e340ce1f71 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -79,9 +79,9 @@
 - On a device without VK_EXT_robustness2's `nullDescriptor`, such as MoltenVK, a null image descriptor in a typed heap is a [placeholder image](../../../core/libs/prx/libSceAgcDriver/Graphics/src/PlaceholderImages.cpp) of that heap's type, 1×1 and cleared to zero, which every null descriptor of the heap shares. Reads give zeros, as `nullDescriptor` allows, but stores and atomics to it are kept, so a later read of a null storage image can return them, and a depth comparison compares against depth 0. A heap whose placeholder the device cannot create, for example 1D or 3D depth, 64-bit atomics without 64-bit image atomics, or multisampled storage without `shaderStorageImageMultisample`, throws when a null descriptor reaches it.
 - [Draw input snapshots](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver): `PrepareDrawBindings` caps read-only input buffer snapshots at 64 MiB (overridable via `APS5_DRAW_SNAPSHOT_MAX_MIB`). Larger inputs (streaming heaps, bindless pools) or draws exceeding the cumulative budget skip the per-draw snapshot and bind in place, avoiding multi-gigabyte CPU copy stalls (such as Ratchet & Clank: Rift Apart PPSA01474 stalling at frame ~380 copying 36 GB every 5 s). If the title rewrites those large ranges on the CPU before GPU completion, the in-place binding observes the modification, as verified by `drawSnapshotCapTests`.
 - [Pending storage-image results](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) are stored when something reads their memory, not when the GPU work that wrote them completes. A title that waits for that work, frees the image and reuses its memory can have the new data overwritten by the late store (#1970). A title's own CPU reads are not seen either, so a title that reads the results after waiting for a label reads stale memory. `APS5_STORE_AT_FLIP=1` stores every pending result at each flip and `APS5_STORE_AT_LABEL=1` before each label the GPU writes; both store every pending image, not only the ones the waited-for work wrote, and neither is on by default.
-- [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending, and ranges that leave the watch through a failed collect, have no saved bytes; storing such results throws.
 - Windows host-pointer imports of the guest mapping itself are compared instead of write-watched, except writable imports of private `MEM_WRITE_WATCH` memory when the import probe keeps the write watch and a settle queue exists: those of 1 MiB or more stay watched, and smaller ones return to the watch once their settle has completed (see Pages under an import window): a driver can mark imported pages dirty after the synchronous import window. Shared memory imported through a separate writable alias retains protection-based tracking on the guest views; driver access to the import alias does not disarm those views. [GuestMemory](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) excludes every overlapping 64 KiB tracker block while its backing is retained. A full block replaced by fresh private backing regains tracking and gets a new generation; protection changes, partial replacements and shared remappings do not restore it. Excluded blocks keep their write-watch marks as a hint only (`UntrackedHint`): a storage image or a sampled texture snapshot over them compares its bytes again after a mark in its range, a driver store, a mapping change or a recorded GPU write instead of at every collect epoch or lookup, and a mark the driver makes without a CPU store costs one comparison. This preserves CPU edits through byte comparisons but limits snapshot reuse on excluded blocks to draws of one collect epoch and disables unit shadows for them; restoring tracking on import retirement without replacing the backing remains unimplemented.
 - [Pages under an import window](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) (libSceAgcDriver) whose write protection was resolved while a host import that leaves its range watched was made are compared with the bytes they held before the import and count as stored over only when those differ. A CPU store of the bytes already there within the window cannot be told apart from an import that resolves the write protection without storing, as the NVIDIA driver (610.57.04) does for every imported page, so such a store does not win over pending results. Where host-pointer and dma-buf imports differ in whether they stay watched, a failed host-pointer import and the dma-buf import after it are two windows, and the pages the failed one resolved count as stored over. On Windows, the NVIDIA driver (617.42) marks every page of a host import of private `MEM_WRITE_WATCH` memory written, asynchronously, until a GPU use of the import completes; a 4-byte read of it on the settle queue ends that even while main-queue work that used the import first is still running, and an earlier import of the same pages whose first use runs after that read marks none of them (`agc_import_settle_first_use`, `agc_import_settle_earlier_import`). Such an import stays watched only after a 4-byte read of it on the settle queue has completed inside the window. Each one waits for that read, which keeps its window open for one round trip on the settle queue, so a same-value CPU store from another thread in that time counts as unchanged too. An import made where no settle queue exists is compared instead. An import of under 1 MiB is not settled inside its window, because the settle blocks the importing thread and a title that imports a 64 KiB buffer around every submission lost about 19 % of its frame rate to that wait (Dripl1x, #6060). It is compared until its read, submitted in a batch by a later import lookup under `GpuMutex` while the imports match the registry, has completed; a later lookup then returns its whole blocks to the write watch, each stamped as a CPU store, so whatever was derived from them while they were compared reads as changed once. Its blocks stay compared while storage results are pending over them, and those of an import retired before that stay compared.
+- [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched or whose page walk fails), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending, and ranges that leave the watch through the failed collect of a driver store or, on Linux, because their direct memory is mapped a second time, have no saved bytes; storing such results throws.
 - [Settled dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a dma-buf import of 1 MiB or more is read by a 4-byte copy on the settle queue right after it is made (`settleImport`), so the kernel maps its pages for the GPU there and not in the first submission that uses it (about 2 s for a 3 GiB import on RADV). The import's buffer is shared with the settle queue's family. An import made at map time settles on the guest thread that maps the range, inside its map call, so that thread waits while the kernel maps the pages: 0.47 to 2.2 s for the 3 GiB range of Hades (PPSA03355) and 0.49 to 4.3 s for the 4.5 GiB range of ASTRO BOT (PPSA21567) on RADV. Both titles map these ranges at start-up; a title that maps large ranges during gameplay stalls its mapping thread for as long. An import made from a submission settles under the GPU mutex, so its frame still pays for it; a smaller import, and every import on a device with no settle queue (one without a copy-capable queue besides the main one), pays in its first submission. A range imported through a host pointer, as lavapipe imports shared memory, is not settled
 - [Sparse dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a shared-backed range larger than one 64 MiB udmabuf buffer is imported as one sparse buffer bound to the 64 MiB buffers, on a queue of its own when the device has a second family that binds sparse memory. The path is decided before anything is imported, and a failure after that throws. A range takes the single udmabuf import instead, which udmabuf's `size_limit_mb` refuses above 64 MiB by default so the range is copied, when its offset in the backing file is not a multiple of the buffer's sparse block size (64 KiB on RADV), when the sparse buffer does not accept every memory type a chunk import can have, when the backing file ends inside its last chunk, or when it is imported at map time on a device with no second family (the bind then needs the GPU mutex); the NVIDIA proprietary driver imports no dma-buf memory
 - [Unnormalized S# coordinates](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) - `FORCE_UNNORMALIZED` uses a Vulkan `unnormalizedCoordinates` sampler, so the S# LOD range, LOD bias and mip filter are not applied, which is exact only on a one-level view.

From aaf19708ff31c4d28dea3bfaf0cc04dfbb62e110 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Sun, 18 Oct 2026 10:47:31 +0200
Subject: [PATCH 004/218] test(agc): cover the unwatch hook on each exit that
 drops a range from the write watch

CheckUnwatchHooks runs Unwatch, an import that does not stay watched, an import whose
page walk vouches for its pages and, on Linux, an import whose range loses a block
during the import. The hook has to run once, over the dropped range, while the range
is still watched: before the import for the first two, after it for the last, and not
at all for the vouched import.
---
 .../libSceAgcDriver/tests/WriteTracking.cpp   | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
index f7607574bc..7f8fc018ee 100644
--- a/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/WriteTracking.cpp
@@ -938,6 +938,80 @@ void CheckUnwatchedImport() {
 #endif
 }
 
+struct HookCall {
+    std::uint64_t address;
+    std::size_t bytes;
+    bool watched;
+};
+
+std::vector<HookCall> hookCalls;
+std::uint64_t hookProbe = 0;
+std::size_t hookProbeBytes = 0;
+
+void RecordHook(std::uint64_t address, std::size_t bytes) {
+    hookCalls.push_back({address, bytes, Watched(hookProbe, hookProbeBytes)});
+}
+
+struct RecordedHook {
+    RecordedHook() {
+        hookCalls.clear();
+        SetUnwatchHook(&RecordHook);
+    }
+    ~RecordedHook() { SetUnwatchHook(nullptr); }
+    RecordedHook(const RecordedHook&) = delete;
+    RecordedHook& operator=(const RecordedHook&) = delete;
+};
+
+void RequireHookOver(std::uint64_t address, std::size_t bytes, const std::string& path) {
+    Require(hookCalls.size() == 1, path + " did not run the unwatch hook once");
+    const auto& call = hookCalls.front();
+    Require(call.address <= address && address + bytes <= call.address + call.bytes, path + " gave the unwatch hook a range that misses its own");
+    Require(call.watched, path + " ran the unwatch hook after its range left the write watch");
+}
+
+void CheckUnwatchHooks() {
+    void* memory = AllocateWatched(8 * Block);
+    const auto base = reinterpret_cast<std::uint64_t>(memory);
+    std::memset(memory, 0x11, 8 * Block);
+    Require(CollectWritesUncached(base, 8 * Block) != 0, "the hooked block is not collected");
+    const RecordedHook recorded;
+    hookProbe = base;
+    hookProbeBytes = Block;
+    Unwatch(base, Block);
+    RequireHookOver(base, Block, "Unwatch");
+    Require(!Watched(base, Block), "Unwatch left its range watched");
+
+    hookCalls.clear();
+    hookProbe = base + Block;
+    bool hookedBeforeImport = false;
+    Require(ImportWatched(base + Block, Block, [&] {
+        hookedBeforeImport = hookCalls.size() == 1;
+        return true;
+    }, false), "an import that does not stay watched failed");
+    RequireHookOver(base + Block, Block, "an import that does not stay watched");
+    Require(hookedBeforeImport, "an import that does not stay watched ran the unwatch hook after the import");
+    Require(!Watched(base + Block, Block), "an import that does not stay watched left its range watched");
+
+    hookCalls.clear();
+    Require(ImportWatched(base + 2 * Block, Block, [] { return true; }), "an import that stays watched failed");
+    Require(hookCalls.empty() && Watched(base + 2 * Block, Block), "an import whose page walk vouched for its pages ran the unwatch hook or gave up its range");
+
+#ifndef _WIN32
+    hookCalls.clear();
+    const auto late = base + 4 * Block;
+    hookProbe = late;
+    bool hookedBeforeLoss = false;
+    Require(ImportWatched(late, 3 * Block, [&] {
+        GuestWriteWatch::GuestWriteWatchUnregister_nid_postfix(reinterpret_cast<const void*>(late + 2 * Block), Block);
+        hookedBeforeLoss = !hookCalls.empty();
+        return true;
+    }), "an import whose range lost a block during the import failed");
+    RequireHookOver(late, 3 * Block, "an import whose page walk failed after the import");
+    Require(!hookedBeforeLoss, "an import whose page walk failed after the import ran the unwatch hook before it");
+    Require(!Watched(late, Block), "an import whose page walk failed after the import left its range watched");
+#endif
+}
+
 class PartlyCommitted {
 public:
     static constexpr std::size_t Bytes = 4 * Block;
@@ -1111,6 +1185,7 @@ int main() {
         CheckImportWindowOverUnwatchedPart();
         CheckStoreAcrossImports();
         CheckUnwatchedImport();
+        CheckUnwatchHooks();
         CheckCommittedRanges();
     } catch (const std::exception& error) {
         std::cerr << "write tracking test failed: " << error.what() << "\n";

From d5886fce88378e350a895cc0720f60bc9938269d Mon Sep 17 00:00:00 2001
From: javierUDP <javier.p@digitalmeet.cl>
Date: Tue, 20 Oct 2026 02:22:14 -0300
Subject: [PATCH 005/218] test(relinker): execute the in-place Rosetta
 replacements

RDPID, RDSEED and CLWB are checked through their replacement bytes but
never run, although all three raise an illegal instruction on a Rosetta
host, which is what the replacements exist for. The x86-64 execution
section now calls the RDPID stub and the RDSEED and CLWB replacements
and checks the value, the carry flag and the registers they leave.
---
 .../codegen/tests/Amd64OnlyConverterTests.cpp | 91 +++++++++++++++++++
 1 file changed, 91 insertions(+)

diff --git a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
index 8d4f08930c..9615dc1ae3 100644
--- a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
+++ b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
@@ -1903,6 +1903,91 @@ void mcommitExecution() {
     }
     munmap(code, 4096);
 }
+
+void rdpidExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0xF3, 0x0F, 0xC7, 0xF8};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::Trampoline, "RDPID stub was not produced");
+    auto body = match->StubBody;
+    body[match->ReturnBranchOffset] = 0xC3;
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the stub");
+    std::memcpy(code, body.data(), body.size());
+    std::uint64_t processor = ~std::uint64_t{0};
+    std::uint8_t carry = 0;
+    asm volatile(
+        "sub $128, %%rsp\n\t"
+        "stc\n\t"
+        "call *%[code]\n\t"
+        "setc %[carry]\n\t"
+        "add $128, %%rsp\n\t"
+        : "=&a"(processor), [carry] "=&q"(carry)
+        : [code] "r"(code)
+        : "memory", "cc");
+    munmap(code, 4096);
+    require(processor == 0, "RDPID stub left a value other than processor 0 in RAX");
+    require(carry == 1, "RDPID stub changed the flags");
+}
+
+void rdseedExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0x0F, 0xC7, 0xF8};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::InPlace, "RDSEED replacement was not produced");
+    require(match->ReplacementBytes.size() == site.size(), "RDSEED replacement changed the instruction length");
+    auto body = match->ReplacementBytes;
+    body.push_back(0xC3);
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the replacement");
+    std::memcpy(code, body.data(), body.size());
+    bool produced = false;
+    for (unsigned attempt = 0; attempt < 16 && !produced; ++attempt) {
+        std::uint64_t value = 0;
+        std::uint8_t carry = 0;
+        asm volatile(
+            "sub $128, %%rsp\n\t"
+            "call *%[code]\n\t"
+            "setc %[carry]\n\t"
+            "add $128, %%rsp\n\t"
+            : "=&a"(value), [carry] "=&q"(carry)
+            : [code] "r"(code)
+            : "memory", "cc");
+        produced = carry == 1;
+    }
+    munmap(code, 4096);
+    require(produced, "RDSEED replacement never reported a random value");
+}
+
+void clwbExecution() {
+    const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
+    const Bytes site = {0x66, 0x0F, 0xAE, 0x30};
+    const auto match = matcher->Match(site.data(), site.size());
+    require(match && match->Lowering == Codegen::Amd64OnlyLowering::InPlace, "CLWB replacement was not produced");
+    require(match->ReplacementBytes.size() == site.size(), "CLWB replacement changed the instruction length");
+    auto body = match->ReplacementBytes;
+    body.push_back(0xC3);
+    void* code = mmap(nullptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    require(code != MAP_FAILED, "cannot map executable memory for the replacement");
+    std::memcpy(code, body.data(), body.size());
+    std::uint8_t line[64] = {};
+    std::uint64_t address = reinterpret_cast<std::uint64_t>(line);
+    std::uint64_t kept = 0x5A5A5A5A5A5A5A5Aull;
+    std::uint8_t carry = 0;
+    asm volatile(
+        "sub $128, %%rsp\n\t"
+        "stc\n\t"
+        "call *%[code]\n\t"
+        "setc %[carry]\n\t"
+        "add $128, %%rsp\n\t"
+        : "+a"(address), "+b"(kept), [carry] "=&q"(carry)
+        : [code] "r"(code)
+        : "memory", "cc");
+    munmap(code, 4096);
+    require(address == reinterpret_cast<std::uint64_t>(line), "CLWB replacement changed its address register");
+    require(kept == 0x5A5A5A5A5A5A5A5Aull, "CLWB replacement changed an unrelated register");
+    require(carry == 1, "CLWB replacement changed the flags");
+}
 #else
 void reciprocalExecution() {}
 void registerFormExecution() {}
@@ -1947,6 +2032,9 @@ void rdtscpExecution() {
 }
 #else
 void rdtscpExecution() {}
+void rdpidExecution() {}
+void rdseedExecution() {}
+void clwbExecution() {}
 #endif
 
 void scannerZeroTail() {
@@ -1993,6 +2081,9 @@ int main() {
         rosettaLegacyScalarCompares();
         converterRosettaLegacyScalarCompare();
         rdtscpExecution();
+        rdpidExecution();
+        rdseedExecution();
+        clwbExecution();
         wideStoreSplit();
         converterWideStoreWindows();
         converterJumpTableTargets();

From 5272ecd1afbe06fc7a03779e31ffba2ac58aef71 Mon Sep 17 00:00:00 2001
From: Amr Yasser <154547867+AMRYB@users.noreply.github.com>
Date: Fri, 9 Oct 2026 23:54:57 +0300
Subject: [PATCH 006/218] feat(input): add browser-based input mapping
 configurator

---
 docs/user/INPUT_MAPPING.md               |   26 +
 tools/input-mapper/app.js                |  446 ++++++++
 tools/input-mapper/capture.js            |   30 +
 tools/input-mapper/dropdown.js           |  167 +++
 tools/input-mapper/i18n.js               | 1263 ++++++++++++++++++++++
 tools/input-mapper/index.html            |   78 ++
 tools/input-mapper/keys.js               |  230 ++++
 tools/input-mapper/mapping.js            |   34 +
 tools/input-mapper/package.json          |   15 +
 tools/input-mapper/serve.js              |   30 +
 tools/input-mapper/styles.css            |  203 ++++
 tools/input-mapper/tests/i18n.test.js    |   39 +
 tools/input-mapper/tests/mapping.test.js |  132 +++
 tools/input-mapper/validation.js         |   93 ++
 14 files changed, 2786 insertions(+)
 create mode 100644 tools/input-mapper/app.js
 create mode 100644 tools/input-mapper/capture.js
 create mode 100644 tools/input-mapper/dropdown.js
 create mode 100644 tools/input-mapper/i18n.js
 create mode 100644 tools/input-mapper/index.html
 create mode 100644 tools/input-mapper/keys.js
 create mode 100644 tools/input-mapper/mapping.js
 create mode 100644 tools/input-mapper/package.json
 create mode 100644 tools/input-mapper/serve.js
 create mode 100644 tools/input-mapper/styles.css
 create mode 100644 tools/input-mapper/tests/i18n.test.js
 create mode 100644 tools/input-mapper/tests/mapping.test.js
 create mode 100644 tools/input-mapper/validation.js

diff --git a/docs/user/INPUT_MAPPING.md b/docs/user/INPUT_MAPPING.md
index 7ab80c3d4f..9a051c8898 100644
--- a/docs/user/INPUT_MAPPING.md
+++ b/docs/user/INPUT_MAPPING.md
@@ -130,3 +130,29 @@ MouseCurve = 1.3
 Earlier versions sampled the mouse every 33 ms and tilted the stick at least halfway for any movement. `MouseDeadzoneOffset = 0.5`, `MouseSmoothingMs = 0` and `MouseDecayMs = 33` come close to that behavior.
 
 An invalid line reports the file and line number and stops input initialization. If the configured file does not exist or cannot be read, AnyPS5 reports an error. With no `anyps5-input.ini` and no `ANYPS5_INPUT_CONFIG`, the built-in mapping is used.
+
+
+
+## Web configurator
+
+The [input mapper](../../tools/input-mapper/index.html) edits keyboard, mouse and wheel overrides in the browser. It supports alternate bindings, physical-key capture, search, INI import, preview, copy and download. Invalid imports preserve the current configuration. Invalid bindings block export; duplicate and shared inputs, including retained built-in bindings, produce warnings. Removing every binding for an action restores its built-in inputs.
+
+From the repository root, with Node.js 22 or later:
+
+```sh
+npm --prefix tools/input-mapper start
+```
+
+Open `http://127.0.0.1:4173`. Stop the server with Ctrl+C. No package installation is required. Set `PORT` to use another port. Run the tests with:
+
+```sh
+npm --prefix tools/input-mapper test
+```
+
+Controls, Configuration and Help are separate views; switching views preserves bindings. Search covers all control groups. The group selector supports arrow keys, Home and End. Input and language menus support search, arrow keys and Enter; Escape cancels selection. Menus open beside their fields on larger screens and as bottom sheets on phones. The interface uses system fonts and respects reduced-motion preferences.
+
+The translation button selects one of 22 interface and FAQ languages. First visits use English; a saved language choice takes priority. Egyptian Arabic appears first in the language list. Arabic, Urdu and Persian use right-to-left layouts. Only the language preference is persisted; copy or download input changes before reloading.
+
+Keyboard capture converts physical browser key codes to SDL scancode names. Escape cancels capture; select Escape manually to assign it. Composition, ambiguous keys and some browser or system shortcuts require manual selection. Names containing `#` or `;` cannot be exported because those characters start INI comments. The key catalogue follows SDL commit `4b69833bc54abf3dd3288d4aa7afbba527775e5b`. The source-contract tests compare actions, restrictions and defaults with the current native input code.
+
+For static hosting, serve `index.html`, `styles.css`, `app.js`, `mapping.js`, `keys.js`, `capture.js`, `validation.js`, `i18n.js` and `dropdown.js` from one directory. For the existing GitHub Pages deployment, these files can be copied into `out/input-mapper/` after the Progress workflow generates `out`. The progress dashboard remains at `out/index.html`; publication and a dashboard link are left for maintainer review.
diff --git a/tools/input-mapper/app.js b/tools/input-mapper/app.js
new file mode 100644
index 0000000000..4703578fe0
--- /dev/null
+++ b/tools/input-mapper/app.js
@@ -0,0 +1,446 @@
+import {actions, defaults, groups, mouseValues, typesForAction, wheelValues} from './mapping.js';
+import {exportableKeys} from './keys.js';
+import {captureKey} from './capture.js';
+import {parseIni, serialize, validate} from './validation.js';
+import {diagnostic, initialLocale, locales, translate} from './i18n.js';
+import {createDropdown} from './dropdown.js';
+
+const byId = id => document.getElementById(id);
+let entries = [];
+let savedConfiguration = '[]';
+let captureTarget;
+let captureButton;
+let selectedGroup = groups[0].name;
+let locale = initialLocale();
+let languageControl;
+const bindingControls = new WeakMap();
+let activeView = ['controls', 'configuration', 'help'].includes(location.hash.slice(1)) ? location.hash.slice(1) : 'controls';
+let currentStatus;
+let importReport;
+const dialog = byId('capture-dialog');
+try {
+    const savedLocale = localStorage.getItem('anyps5-controls-language');
+    locale = initialLocale(savedLocale);
+} catch {}
+const t = (key, values) => translate(locale, key, values);
+const groupLabel = name => t(`group${groups.findIndex(group => group.name === name)}`);
+
+function setStatus(key, values = {}) {
+    currentStatus = {key, values};
+    byId('status').textContent = t(key, values);
+}
+
+function showView(view, focus = true, updateHash = true) {
+    activeView = view;
+    const controls = view === 'controls';
+    byId('categories').hidden = !controls;
+    byId('toolbar').hidden = !controls;
+    byId('mappings').hidden = !controls;
+    byId('configuration').hidden = view !== 'configuration';
+    byId('help').hidden = view !== 'help';
+    byId('validation').hidden = view === 'help';
+    byId('status').hidden = view === 'help';
+    byId('import-report').hidden = view === 'help' || !importReport;
+    byId('view-intro').textContent = t(controls ? 'intro' : view === 'help' ? 'helpIntro' : 'configIntro');
+    if (controls) filterActions();
+    else byId('group-title').textContent = t(view);
+    for (const link of document.querySelectorAll('[data-view]')) {
+        const current = link.dataset.view === view;
+        link.classList.toggle('current', current);
+        if (current) link.setAttribute('aria-current', 'page');
+        else link.removeAttribute('aria-current');
+    }
+    if (updateHash && location.hash !== `#${view}`) history.pushState(null, '', `#${view}`);
+    if (focus) {
+        byId('content').focus({preventScroll: true});
+        window.scrollTo({top: 0, behavior: 'auto'});
+    }
+}
+
+function renderHelp() {
+    const opened = [...byId('help').querySelectorAll('details')].map(item => item.open);
+    byId('help').replaceChildren();
+    for (let index = 0; index < 4; index++) {
+        const question = element('details', undefined, 'faq');
+        question.open = opened[index] || false;
+        question.append(element('summary', t(`faq${index}Question`)), element('p', t(`faq${index}Answer`)));
+        byId('help').append(question);
+    }
+}
+
+function renderImportReport() {
+    if (!importReport) return;
+    const report = byId('import-report');
+    report.replaceChildren(element('h2', t(importReport.errors.length ? 'importRejected' : 'importRead')));
+    const messages = [...importReport.errors, ...importReport.warnings];
+    if (messages.length) {
+        const list = element('ul');
+        for (const item of messages) list.append(element('li', t('line', {line: item.line, message: diagnostic(locale, item.message)})));
+        report.append(list);
+    }
+    if (importReport.errors.length) report.append(element('p', t('preserved'), 'error'));
+    report.hidden = false;
+}
+
+function applyLocale() {
+    document.documentElement.lang = locale;
+    document.documentElement.dir = locales.find(item => item.code === locale).direction;
+    for (const node of document.querySelectorAll('[data-i18n]')) node.textContent = t(node.dataset.i18n);
+    for (const node of document.querySelectorAll('[data-i18n-label]')) node.setAttribute('aria-label', t(node.dataset.i18nLabel));
+    for (const node of document.querySelectorAll('[data-i18n-placeholder]')) node.placeholder = t(node.dataset.i18nPlaceholder);
+    languageControl.label = t('language');
+    languageControl.direction = document.documentElement.dir;
+    languageControl.text = dropdownText();
+    languageControl.setValue(locale);
+    byId('settings').title = t('language');
+    byId('categories').replaceChildren();
+    renderCategories();
+    renderHelp();
+    render();
+    renderImportReport();
+    if (currentStatus) setStatus(currentStatus.key, currentStatus.values);
+    showView(activeView, false, false);
+    updateClock();
+}
+
+function element(tag, text, className) {
+    const node = document.createElement(tag);
+    if (text !== undefined) node.textContent = text;
+    if (className) node.className = className;
+    return node;
+}
+
+function isDirty() {
+    return JSON.stringify(entries) !== savedConfiguration;
+}
+
+async function confirmReplacement() {
+    if (!isDirty()) return true;
+    const confirmation = byId('replace-dialog');
+    confirmation.returnValue = 'cancel';
+    return new Promise(resolve => {
+        confirmation.addEventListener('close', () => resolve(confirmation.returnValue === 'discard'), {once: true});
+        confirmation.showModal();
+    });
+}
+
+function valueChoices(type) {
+    return type === 'KEY' ? exportableKeys : type === 'MOUSE' ? mouseValues : type === 'WHEEL' ? wheelValues : [];
+}
+
+function dropdownText() {
+    return {search: t('searchOptions'), close: t('close'), empty: t('noOptions')};
+}
+
+function selectControl(label, choices, value) {
+    return createDropdown({label, choices: [{value: '', label: t('select')}, ...choices], value, placeholder: t('select'), text: dropdownText()});
+}
+
+function button(text, label, click) {
+    const control = element('button', text);
+    control.type = 'button';
+    control.setAttribute('aria-label', label);
+    control.addEventListener('click', click);
+    return control;
+}
+
+function renderCategories() {
+    const icons = ['face-icon', 'shoulder-icon', 'direction-icon', 'stick-icon', 'stick-icon', 'touch-icon'];
+    const symbols = ['△ ○ × □', 'L2 R2', '', 'L', 'R', ''];
+    groups.forEach((group, index) => {
+        const category = button('', groupLabel(group.name), () => {
+            selectedGroup = group.name;
+            byId('search').value = '';
+            filterActions();
+        });
+        category.className = 'category';
+        category.dataset.group = group.name;
+        const icon = element('span', undefined, 'category-icon');
+        icon.setAttribute('aria-hidden', 'true');
+        const mark = element('span', undefined, icons[index]);
+        if (index === 0) {
+            for (const symbol of symbols[index].split(' ')) mark.append(element('span', symbol));
+        } else mark.textContent = symbols[index];
+        icon.append(mark);
+        category.append(icon, element('span', t(`group${index}`), 'category-label'));
+        category.addEventListener('keydown', event => {
+            const direction = document.documentElement.dir === 'rtl' ? -1 : 1;
+            const offset = event.key === 'ArrowRight' ? direction : event.key === 'ArrowLeft' ? -direction : 0;
+            if (!offset && event.key !== 'Home' && event.key !== 'End') return;
+            event.preventDefault();
+            const next = event.key === 'Home' ? 0 : event.key === 'End' ? groups.length - 1 : (index + offset + groups.length) % groups.length;
+            const target = byId('categories').children[next];
+            target.click();
+            target.focus();
+            target.scrollIntoView({block: 'nearest', inline: 'nearest'});
+        });
+        byId('categories').append(category);
+    });
+}
+
+function renderBinding(entry, position) {
+    const row = element('div', undefined, 'binding');
+    const label = t('bindingLabel', {action: entry.action, number: position + 1});
+    const type = selectControl(t('typeLabel', {binding: label}), typesForAction(entry.action), entry.type);
+    const value = selectControl(t('valueLabel', {binding: label}), valueChoices(entry.type), entry.value);
+    type.element.dir = 'ltr';
+    value.element.dir = 'ltr';
+    const capture = button(t('capture'), t('captureLabel', {binding: label}), () => {
+        captureTarget = entry;
+        captureButton = capture;
+        byId('capture-title').textContent = t('captureTitle', {action: entry.action});
+        byId('capture-status').textContent = '';
+        dialog.showModal();
+    });
+    capture.disabled = entry.type !== 'KEY';
+    const remove = button(t('remove'), t('removeLabel', {binding: label}), () => {
+        entries = entries.filter(binding => binding !== entry);
+        render();
+        const remaining = document.querySelector(`[data-action="${entry.action}"] .dropdown-trigger`);
+        (remaining || document.querySelector(`[data-action="${entry.action}"] .add-binding`)).focus();
+    });
+    type.select.addEventListener('change', () => {
+        entry.type = type.select.value;
+        entry.value = '';
+        value.setChoices([{value: '', label: t('select')}, ...valueChoices(entry.type)]);
+        value.setValue('');
+        capture.disabled = entry.type !== 'KEY';
+        updateOutput();
+    });
+    value.select.addEventListener('change', () => {
+        entry.value = value.select.value;
+        updateOutput();
+    });
+    row.append(type.element, value.element, capture, remove);
+    bindingControls.set(entry, value);
+    return row;
+}
+
+function render() {
+    const container = byId('mappings');
+    container.replaceChildren();
+    for (const group of groups) {
+        const section = element('section', undefined, 'group');
+        section.dataset.group = group.name;
+        section.append(element('h2', groupLabel(group.name)));
+        for (const action of group.actions) {
+            const article = element('div', undefined, 'action');
+            article.dataset.action = action;
+            const heading = element('div', undefined, 'action-heading');
+            const add = button(t('add'), t('addLabel', {action}), () => {
+                entries.push({action, type: 'KEY', value: ''});
+                render();
+                const rows = document.querySelectorAll(`[data-action="${action}"] .binding`);
+                rows[rows.length - 1].querySelectorAll('.dropdown-trigger')[1].focus();
+            });
+            add.className = 'add-binding';
+            const title = element('div', undefined, 'action-title');
+            const symbols = {Cross: '×', Circle: '○', Triangle: '△', Square: '□', Up: '↑', Right: '→', Down: '↓', Left: '←'};
+            if (symbols[action]) {
+                const symbol = element('span', symbols[action], 'action-symbol');
+                symbol.setAttribute('aria-hidden', 'true');
+                title.append(symbol);
+            }
+            const actionName = element('h3', action);
+            actionName.dir = 'ltr';
+            title.append(actionName);
+            heading.append(title, add);
+            article.append(heading);
+            const configured = entries.filter(entry => entry.action === action);
+            article.append(element('p', configured.length ? t('custom') : t('builtin', {inputs: defaults[action].join(', ') || t('noDefault')}), 'hint'));
+            configured.forEach((entry, position) => article.append(renderBinding(entry, position)));
+            section.append(article);
+        }
+        container.append(section);
+    }
+    filterActions();
+    updateOutput();
+}
+
+function filterActions() {
+    const search = byId('search').value.trim().toLowerCase();
+    if (activeView === 'controls') byId('group-title').textContent = search ? t('search') : groupLabel(selectedGroup);
+    for (const category of byId('categories').children) {
+        category.setAttribute('aria-pressed', String(!search && category.dataset.group === selectedGroup));
+    }
+    let visible = 0;
+    for (const section of document.querySelectorAll('.group')) {
+        let matches = 0;
+        for (const action of section.querySelectorAll('.action')) {
+            action.hidden = search ? !`${section.dataset.group} ${groupLabel(section.dataset.group)} ${action.dataset.action}`.toLowerCase().includes(search) : section.dataset.group !== selectedGroup;
+            if (!action.hidden) matches++;
+        }
+        section.hidden = matches === 0;
+        visible += matches;
+    }
+    let empty = byId('no-results');
+    if (!empty) {
+        empty = element('p', t('noResults'), 'hint');
+        empty.id = 'no-results';
+        byId('mappings').append(empty);
+    }
+    empty.hidden = visible !== 0;
+}
+
+function updateOutput() {
+    const result = validate(entries);
+    const valid = result.errors.length === 0;
+    byId('preview').value = valid ? serialize(entries) : '';
+    byId('count').textContent = `${new Set(result.bindings.map(binding => binding.action)).size} / ${actions.length}`;
+    byId('download').disabled = !valid;
+    byId('copy').disabled = !valid;
+    const report = byId('validation');
+    report.replaceChildren();
+    for (const [name, messages] of [['error', result.errors], ['warning', result.warnings]]) {
+        if (!messages.length) continue;
+        const list = element('ul', undefined, name);
+        for (const item of messages) list.append(element('li', diagnostic(locale, item.message)));
+        report.append(list);
+    }
+    const rows = [...document.querySelectorAll('.binding')];
+    const renderedEntries = groups.flatMap(group => group.actions.flatMap(action => entries.filter(entry => entry.action === action)));
+    rows.forEach((row, index) => {
+        const invalid = result.errors.some(error => entries[error.index] === renderedEntries[index]);
+        for (const control of row.querySelectorAll('.dropdown-trigger')) control.setAttribute('aria-invalid', String(invalid));
+    });
+}
+
+function cancelCapture(message) {
+    captureTarget = undefined;
+    dialog.close();
+    captureButton?.focus();
+    if (message) setStatus(message);
+}
+
+byId('cancel-capture').addEventListener('click', () => cancelCapture('captureCancelled'));
+dialog.addEventListener('cancel', event => {
+    event.preventDefault();
+    cancelCapture('captureCancelled');
+});
+window.addEventListener('blur', () => {
+    if (captureTarget) cancelCapture('captureBlur');
+});
+window.addEventListener('keydown', event => {
+    if (!captureTarget) return;
+    event.preventDefault();
+    event.stopImmediatePropagation();
+    if (event.code === 'Escape' || event.key === 'Escape') {
+        cancelCapture('captureCancelled');
+        return;
+    }
+    if (event.repeat) return;
+    const result = captureKey(event);
+    if (result.error) {
+        byId('capture-status').textContent = diagnostic(locale, result.error);
+        return;
+    }
+    const target = captureTarget;
+    target.value = result.value;
+    cancelCapture();
+    bindingControls.get(target)?.setValue(result.value);
+    updateOutput();
+    setStatus('captured', {value: result.value, action: target.action});
+}, true);
+
+byId('search').addEventListener('input', filterActions);
+byId('reset').addEventListener('click', async () => {
+    if (!await confirmReplacement()) return;
+    entries = [];
+    savedConfiguration = '[]';
+    importReport = undefined;
+    byId('import-report').hidden = true;
+    render();
+    setStatus('resetDone');
+});
+byId('import').addEventListener('click', () => byId('file').click());
+byId('file').addEventListener('change', async event => {
+    const file = event.target.files[0];
+    if (!file) return;
+    event.target.value = '';
+    try {
+        if (file.size > 1024 * 1024) throw new Error(t('fileTooLarge'));
+        const text = new TextDecoder('utf-8', {fatal: true}).decode(await file.arrayBuffer());
+        const result = parseIni(text);
+        const report = byId('import-report');
+        importReport = result;
+        renderImportReport();
+        if (result.errors.length) {
+            report.focus();
+            return;
+        }
+        if (!await confirmReplacement()) return;
+        entries = result.entries;
+        savedConfiguration = JSON.stringify(entries);
+        render();
+        setStatus('imported', {name: file.name});
+    } catch (error) {
+        setStatus('importFailed', {message: error instanceof TypeError ? t('invalidUtf8') : error.message});
+    }
+});
+byId('download').addEventListener('click', () => {
+    const content = serialize(entries);
+    const url = URL.createObjectURL(new Blob([content], {type: 'text/plain;charset=utf-8'}));
+    const link = element('a');
+    link.href = url;
+    link.download = 'anyps5-input.ini';
+    document.body.append(link);
+    link.click();
+    link.remove();
+    setTimeout(() => URL.revokeObjectURL(url), 1000);
+    savedConfiguration = JSON.stringify(entries);
+    setStatus('downloaded');
+});
+byId('copy').addEventListener('click', async () => {
+    try {
+        const content = serialize(entries);
+        const copiedConfiguration = JSON.stringify(entries);
+        await navigator.clipboard.writeText(content);
+        savedConfiguration = copiedConfiguration;
+        setStatus('copied');
+    } catch {
+        byId('preview').focus();
+        byId('preview').select();
+        setStatus('clipboardFailed');
+    }
+});
+window.addEventListener('beforeunload', event => {
+    if (!isDirty()) return;
+    event.preventDefault();
+    event.returnValue = '';
+});
+byId('focus-search').addEventListener('click', () => {
+    showView('controls');
+    byId('search').focus();
+});
+for (const link of document.querySelectorAll('[data-view]')) {
+    link.addEventListener('click', event => {
+        event.preventDefault();
+        showView(link.dataset.view);
+    });
+}
+byId('back-controls').addEventListener('click', () => showView('controls'));
+function restoreView() {
+    const view = location.hash.slice(1);
+    if (['controls', 'configuration', 'help'].includes(view)) showView(view, false, false);
+    else if (!view) showView('controls', false, false);
+}
+window.addEventListener('popstate', restoreView);
+window.addEventListener('hashchange', restoreView);
+languageControl = createDropdown({
+    label: t('language'), choices: locales.map(item => ({value: item.code, label: item.name, lang: item.code, direction: item.direction})),
+    value: locale, placeholder: t('language'), text: dropdownText(), trigger: byId('settings'), direction: locales.find(item => item.code === locale).direction
+});
+byId('language-control').append(languageControl.element);
+languageControl.select.addEventListener('change', event => {
+    locale = event.target.value;
+    try { localStorage.setItem('anyps5-controls-language', locale); } catch {}
+    applyLocale();
+});
+function updateClock() {
+    const now = new Date();
+    byId('clock').textContent = new Intl.DateTimeFormat(locale, {hour: '2-digit', minute: '2-digit'}).format(now);
+    byId('clock').dateTime = now.toISOString();
+}
+updateClock();
+setInterval(updateClock, 60000);
+applyLocale();
diff --git a/tools/input-mapper/capture.js b/tools/input-mapper/capture.js
new file mode 100644
index 0000000000..05bbce0c36
--- /dev/null
+++ b/tools/input-mapper/capture.js
@@ -0,0 +1,30 @@
+import {exportableKeys} from './keys.js';
+
+const codes = {
+    Enter: 'Return', Escape: 'Escape', Space: 'Space', Backspace: 'Backspace', Tab: 'Tab',
+    Minus: '-', Equal: '=', BracketLeft: '[', BracketRight: ']', Backslash: '\\',
+    Semicolon: ';', Quote: "'", Backquote: '`', Comma: ',', Period: '.', Slash: '/',
+    CapsLock: 'CapsLock', PrintScreen: 'PrintScreen', ScrollLock: 'ScrollLock', Pause: 'Pause',
+    Insert: 'Insert', Home: 'Home', PageUp: 'PageUp', Delete: 'Delete', End: 'End', PageDown: 'PageDown',
+    ArrowRight: 'Right', ArrowLeft: 'Left', ArrowDown: 'Down', ArrowUp: 'Up', NumLock: 'Numlock',
+    NumpadDivide: 'Keypad /', NumpadMultiply: 'Keypad *', NumpadSubtract: 'Keypad -',
+    NumpadAdd: 'Keypad +', NumpadEnter: 'Keypad Enter', NumpadDecimal: 'Keypad .',
+    NumpadEqual: 'Keypad =', NumpadComma: 'Keypad ,', ContextMenu: 'Application',
+    ControlLeft: 'Left Ctrl', ControlRight: 'Right Ctrl', ShiftLeft: 'Left Shift', ShiftRight: 'Right Shift',
+    AltLeft: 'Left Alt', AltRight: 'Right Alt', MetaLeft: 'Left GUI', MetaRight: 'Right GUI'
+};
+
+export function captureKey(event) {
+    if (event.isComposing || event.key === 'Dead' || event.key === 'Process') {
+        return {error: 'Composition and dead keys are ambiguous. Select an SDL key from the list.'};
+    }
+    let value = codes[event.code];
+    if (/^Key[A-Z]$/u.test(event.code)) value = event.code.slice(3);
+    else if (/^Digit[0-9]$/u.test(event.code)) value = event.code.slice(5);
+    else if (/^Numpad[0-9]$/u.test(event.code)) value = `Keypad ${event.code.slice(6)}`;
+    else if (/^F(?:[1-9]|1[0-9]|2[0-4])$/u.test(event.code)) value = event.code;
+    if (!value || !exportableKeys.includes(value)) {
+        return {error: 'This physical key cannot be captured in the current INI format. Select an SDL key from the list.'};
+    }
+    return {value};
+}
diff --git a/tools/input-mapper/dropdown.js b/tools/input-mapper/dropdown.js
new file mode 100644
index 0000000000..63a962e2ea
--- /dev/null
+++ b/tools/input-mapper/dropdown.js
@@ -0,0 +1,167 @@
+const dialog = document.getElementById('picker-dialog');
+const title = document.getElementById('picker-title');
+const search = document.getElementById('picker-search');
+const list = document.getElementById('picker-options');
+const empty = document.getElementById('picker-empty');
+const close = document.getElementById('picker-close');
+let active;
+let visible = [];
+let focused = 0;
+
+function renderOptions() {
+    const query = search.value.trim().toLocaleLowerCase();
+    visible = active.choices.filter(item => `${item.label} ${item.value}`.toLocaleLowerCase().includes(query));
+    list.replaceChildren();
+    const exactMatch = query ? visible.findIndex(item => item.label.toLocaleLowerCase() === query || item.value.toLocaleLowerCase() === query) : -1;
+    focused = Math.max(0, exactMatch >= 0 ? exactMatch : visible.findIndex(item => item.value === active.select.value));
+    visible.forEach((item, index) => {
+        const option = document.createElement('button');
+        option.type = 'button';
+        option.className = 'picker-option';
+        option.setAttribute('role', 'option');
+        option.setAttribute('aria-selected', String(item.value === active.select.value));
+        option.tabIndex = index === focused ? 0 : -1;
+        option.textContent = item.label;
+        if (item.lang) option.lang = item.lang;
+        option.dir = item.direction || active.direction;
+        option.addEventListener('click', () => choose(item));
+        option.addEventListener('focus', () => { focused = index; });
+        list.append(option);
+    });
+    empty.hidden = visible.length !== 0;
+    if (dialog.open) list.children[focused]?.scrollIntoView({block: 'nearest'});
+}
+
+function choose(item) {
+    const current = active;
+    current.setValue(item.value);
+    dialog.close();
+    current.select.dispatchEvent(new Event('change', {bubbles: true}));
+}
+
+function focusOption(index) {
+    if (!visible.length) return;
+    focused = (index + visible.length) % visible.length;
+    [...list.children].forEach((option, position) => { option.tabIndex = position === focused ? 0 : -1; });
+    list.children[focused].focus({preventScroll: true});
+    list.children[focused].scrollIntoView({block: 'nearest'});
+}
+
+function positionPicker() {
+    if (!dialog.open || !active) return;
+    if (matchMedia('(max-width: 600px)').matches) {
+        for (const name of ['top', 'left', 'width']) dialog.style.removeProperty(name);
+        return;
+    }
+    const rect = active.trigger.getBoundingClientRect();
+    const width = Math.min(Math.max(rect.width, 320), innerWidth - 32);
+    dialog.style.width = `${width}px`;
+    const height = dialog.getBoundingClientRect().height;
+    const preferred = rect.bottom + 10;
+    const top = preferred + height <= innerHeight - 16 ? preferred : Math.max(16, rect.top - height - 10);
+    const left = active.direction === 'rtl' ? rect.right - width : rect.left;
+    dialog.style.top = `${Math.min(top, Math.max(16, innerHeight - height - 16))}px`;
+    dialog.style.left = `${Math.max(16, Math.min(left, innerWidth - width - 16))}px`;
+}
+
+function openPicker(control) {
+    active = control;
+    title.textContent = control.label;
+    list.setAttribute('aria-label', control.label);
+    search.value = '';
+    search.placeholder = control.text.search;
+    search.setAttribute('aria-label', control.text.search);
+    close.textContent = control.text.close;
+    empty.textContent = control.text.empty;
+    dialog.style.setProperty('--picker-height', `${Math.min(480, 136 + Math.min(control.choices.length, 8) * 46)}px`);
+    renderOptions();
+    control.trigger.setAttribute('aria-expanded', 'true');
+    dialog.showModal();
+    positionPicker();
+    list.children[focused]?.scrollIntoView({block: 'nearest'});
+    search.focus();
+}
+
+search.addEventListener('input', renderOptions);
+dialog.addEventListener('keydown', event => {
+    if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+        event.preventDefault();
+        const inSearch = event.target === search;
+        focusOption(inSearch ? focused : focused + (event.key === 'ArrowDown' ? 1 : -1));
+    } else if (event.target !== search && (event.key === 'Home' || event.key === 'End')) {
+        event.preventDefault();
+        focusOption(event.key === 'Home' ? 0 : visible.length - 1);
+    } else if (event.target === search && event.key === 'Enter' && visible.length) {
+        event.preventDefault();
+        choose(visible[focused]);
+    }
+});
+close.addEventListener('click', () => dialog.close());
+dialog.addEventListener('click', event => {
+    if (event.target !== dialog) return;
+    const rect = dialog.getBoundingClientRect();
+    if (event.clientX < rect.left || event.clientX > rect.right || event.clientY < rect.top || event.clientY > rect.bottom) dialog.close();
+});
+dialog.addEventListener('close', () => {
+    const current = active;
+    active = undefined;
+    current?.trigger.setAttribute('aria-expanded', 'false');
+    if (current?.trigger.isConnected) current.trigger.focus({preventScroll: true});
+});
+window.addEventListener('resize', positionPicker);
+
+export function createDropdown({label, choices, value, placeholder, text, trigger, direction = 'ltr'}) {
+    const wrapper = document.createElement('div');
+    wrapper.className = 'dropdown';
+    const select = document.createElement('select');
+    select.hidden = true;
+    const providedTrigger = Boolean(trigger);
+    const control = trigger || document.createElement('button');
+    control.type = 'button';
+    if (!providedTrigger) {
+        control.className = 'dropdown-trigger';
+        control.setAttribute('role', 'combobox');
+    }
+    control.setAttribute('aria-label', label);
+    control.setAttribute('aria-haspopup', 'dialog');
+    control.setAttribute('aria-controls', 'picker-dialog');
+    control.setAttribute('aria-expanded', 'false');
+    const selected = document.createElement('span');
+    selected.className = 'dropdown-value';
+    if (!providedTrigger) control.append(selected);
+    const api = {
+        element: wrapper, select, trigger: control, label, direction, text, choices: [],
+        setValue(next) {
+            select.value = next;
+            const choice = api.choices.find(item => item.value === select.value);
+            if (!providedTrigger) selected.textContent = choice?.label || placeholder;
+            if (!providedTrigger) control.title = choice?.label || placeholder;
+        },
+        setChoices(next) {
+            const previous = select.value;
+            api.choices = next.map(item => typeof item === 'string' ? {value: item, label: item} : item);
+            select.replaceChildren();
+            for (const item of api.choices) {
+                const option = document.createElement('option');
+                option.value = item.value;
+                option.textContent = item.label;
+                select.append(option);
+            }
+            api.setValue(previous);
+        },
+        focus() { control.focus(); }
+    };
+    api.setChoices(choices);
+    api.setValue(value);
+    select.addEventListener('change', () => api.setValue(select.value));
+    control.addEventListener('click', () => openPicker(api));
+    control.addEventListener('keydown', event => {
+        if (event.key === 'ArrowDown' || event.key === 'ArrowUp') {
+            event.preventDefault();
+            openPicker(api);
+        }
+    });
+    wrapper.append(select);
+    if (!providedTrigger) wrapper.append(control);
+    return api;
+}
diff --git a/tools/input-mapper/i18n.js b/tools/input-mapper/i18n.js
new file mode 100644
index 0000000000..3f6b3f0d86
--- /dev/null
+++ b/tools/input-mapper/i18n.js
@@ -0,0 +1,1263 @@
+export const locales = [
+    {
+        "code": "ar-EG",
+        "name": "العربية (المصري)",
+        "direction": "rtl"
+    },
+    {
+        "code": "en",
+        "name": "English",
+        "direction": "ltr"
+    },
+    {
+        "code": "es",
+        "name": "Español",
+        "direction": "ltr"
+    },
+    {
+        "code": "fr",
+        "name": "Français",
+        "direction": "ltr"
+    },
+    {
+        "code": "de",
+        "name": "Deutsch",
+        "direction": "ltr"
+    },
+    {
+        "code": "it",
+        "name": "Italiano",
+        "direction": "ltr"
+    },
+    {
+        "code": "pt",
+        "name": "Português",
+        "direction": "ltr"
+    },
+    {
+        "code": "ru",
+        "name": "Русский",
+        "direction": "ltr"
+    },
+    {
+        "code": "tr",
+        "name": "Türkçe",
+        "direction": "ltr"
+    },
+    {
+        "code": "zh-Hans",
+        "name": "简体中文",
+        "direction": "ltr"
+    },
+    {
+        "code": "ja",
+        "name": "日本語",
+        "direction": "ltr"
+    },
+    {
+        "code": "ko",
+        "name": "한국어",
+        "direction": "ltr"
+    },
+    {
+        "code": "hi",
+        "name": "हिन्दी",
+        "direction": "ltr"
+    },
+    {
+        "code": "bn",
+        "name": "বাংলা",
+        "direction": "ltr"
+    },
+    {
+        "code": "ur",
+        "name": "اردو",
+        "direction": "rtl"
+    },
+    {
+        "code": "fa",
+        "name": "فارسی",
+        "direction": "rtl"
+    },
+    {
+        "code": "id",
+        "name": "Bahasa Indonesia",
+        "direction": "ltr"
+    },
+    {
+        "code": "vi",
+        "name": "Tiếng Việt",
+        "direction": "ltr"
+    },
+    {
+        "code": "th",
+        "name": "ไทย",
+        "direction": "ltr"
+    },
+    {
+        "code": "sw",
+        "name": "Kiswahili",
+        "direction": "ltr"
+    },
+    {
+        "code": "nl",
+        "name": "Nederlands",
+        "direction": "ltr"
+    },
+    {
+        "code": "pl",
+        "name": "Polski",
+        "direction": "ltr"
+    }
+];
+
+export const messages = {
+    "en": {
+        "controls": "Controls",
+        "configuration": "Configuration",
+        "help": "Help",
+        "settings": "Settings",
+        "language": "Language",
+        "close": "Close",
+        "eyebrow": "Accessories / Custom controls",
+        "intro": "Choose a control, then assign your keyboard or mouse inputs.",
+        "search": "Search controls",
+        "import": "Import INI",
+        "reset": "Reset",
+        "group0": "Face buttons",
+        "group1": "Shoulders",
+        "group2": "D-pad",
+        "group3": "Left stick",
+        "group4": "Right stick",
+        "group5": "Touch & utility",
+        "select": "Select…",
+        "add": "+ Add binding",
+        "capture": "Capture",
+        "remove": "Remove",
+        "builtin": "Built-in: {inputs}",
+        "custom": "Custom inputs replace built-in inputs.",
+        "noResults": "No controls match your search.",
+        "download": "Download INI",
+        "copy": "Copy configuration",
+        "previewEmpty": "Add a binding to begin.",
+        "backControls": "Back to controls",
+        "switchGroup": "Switch group",
+        "moveFocus": "Move focus",
+        "helpIntro": "A few answers to help you get started.",
+        "configIntro": "Review your inputs, then copy or download your file.",
+        "captureTitle": "Press a key for {action}",
+        "cancelCapture": "Cancel capture",
+        "keepEditing": "Keep editing",
+        "discard": "Discard changes",
+        "faq0Question": "How do I assign a key?",
+        "faq0Answer": "Choose a group, select Add binding, then Capture or choose a key from the list. Multiple bindings are alternatives.",
+        "faq1Question": "Where does my INI file go?",
+        "faq1Answer": "Download anyps5-input.ini and put it next to the generated game executable. For another location, set ANYPS5_INPUT_CONFIG to the file path.",
+        "faq2Question": "Why does a key not get captured?",
+        "faq2Answer": "Browser or system shortcuts may intercept it. Choose it manually from the list. Escape cancels capture; bind Escape using the list.",
+        "faq3Question": "Are my edits saved automatically?",
+        "faq3Answer": "Input edits stay in memory: copy or download before reloading. Only your language choice is saved in this browser. Unconfigured actions keep their defaults.",
+        "skip": "Skip to content",
+        "mainNav": "Main navigation",
+        "groups": "Control groups",
+        "find": "Find an action",
+        "clock": "Local time",
+        "output": "Configuration output",
+        "captureHelp": "Capture uses physical key positions. Escape cancels capture; choose Escape from the list to assign it. Some browser and system shortcuts require manual selection.",
+        "replaceTitle": "Discard unsaved changes?",
+        "replaceHelp": "Copy or download your configuration first if you want to keep it.",
+        "captureCancelled": "Capture cancelled.",
+        "captureBlur": "Capture cancelled because the window lost focus.",
+        "captured": "Captured {value} for {action}.",
+        "resetDone": "Configuration reset.",
+        "importRejected": "Import rejected",
+        "importRead": "Import read successfully",
+        "line": "Line {line}: {message}",
+        "preserved": "Your current configuration has been preserved.",
+        "imported": "Imported {name}.",
+        "importFailed": "Import failed: {message}",
+        "fileTooLarge": "INI file must be smaller than 1 MiB.",
+        "invalidUtf8": "The file must be valid UTF-8 text.",
+        "downloaded": "Configuration download requested.",
+        "copied": "Configuration copied.",
+        "clipboardFailed": "Clipboard unavailable. Copy the selected preview with Ctrl+C.",
+        "noScript": "Enable JavaScript to use this configurator.",
+        "noDefault": "no keyboard or mouse input",
+        "bindingLabel": "{action} binding {number}",
+        "typeLabel": "{binding} input type",
+        "valueLabel": "{binding} input value",
+        "addLabel": "Add binding to {action}",
+        "captureLabel": "Capture key for {binding}",
+        "removeLabel": "Remove {binding}",
+        "searchOptions": "Search options",
+        "noOptions": "No matching options."
+    },
+    "ar-EG": {
+        "controls": "التحكم",
+        "configuration": "ملف الإعدادات",
+        "help": "المساعدة",
+        "settings": "الإعدادات",
+        "language": "اللغة",
+        "close": "قفل",
+        "eyebrow": "الملحقات / تخصيص التحكم",
+        "intro": "اختار زرار، وبعدين حدد له زرار من الكيبورد أو الماوس.",
+        "search": "دور على زرار",
+        "import": "استيراد INI",
+        "reset": "إعادة ضبط",
+        "group0": "أزرار التحكم",
+        "group1": "الأزرار العلوية",
+        "group2": "الاتجاهات",
+        "group3": "الانالوج الشمال",
+        "group4": "الانالوج اليمين",
+        "group5": "اللمس وأدوات تانية",
+        "select": "اختار…",
+        "add": "+ ضيف زرار",
+        "capture": "تسجيل زرار",
+        "remove": "إزالة",
+        "builtin": "الافتراضي: {inputs}",
+        "custom": "الزرار اللي اخترته بيستبدل التحكم الافتراضي.",
+        "noResults": "مفيش أزرار مطابقة للبحث.",
+        "download": "تنزيل INI",
+        "copy": "نسخ الإعدادات",
+        "previewEmpty": "ضيف زرار عشان تبدأ.",
+        "backControls": "ارجع للتحكم",
+        "switchGroup": "بدّل المجموعة",
+        "moveFocus": "انقل التركيز",
+        "helpIntro": "إجابات سريعة تساعدك تبدأ.",
+        "configIntro": "راجع اختياراتك، وبعدين انسخ الملف أو نزّله.",
+        "captureTitle": "اضغط زرار لـ {action}",
+        "cancelCapture": "إلغاء التسجيل",
+        "keepEditing": "كمّل التعديل",
+        "discard": "تجاهل التعديلات",
+        "faq0Question": "أربط زرار إزاي؟",
+        "faq0Answer": "اختار المجموعة واضغط ضيف زرار. بعدها اضغط تسجيل زرار أو اختاره من القائمة. تقدر تضيف أكتر من زرار لنفس الحركة.",
+        "faq1Question": "أحط ملف INI فين؟",
+        "faq1Answer": "نزّل anyps5-input.ini وحطه جنب ملف تشغيل اللعبة اللي اتولّد. لو عايزه في مكان تاني، حط مساره في ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "ليه فيه زرار مش بيتسجل؟",
+        "faq2Answer": "ممكن المتصفح أو النظام يكون بيستخدمه كاختصار. اختاره من القائمة يدويًا. Escape بيلغي التسجيل؛ لو عايز تربطه اختاره من القائمة.",
+        "faq3Question": "تعديلاتي بتتحفظ لوحدها؟",
+        "faq3Answer": "التعديلات بتفضل في الذاكرة بس: انسخها أو نزّلها قبل تحديث الصفحة. اللغة بس هي اللي بتتحفظ في المتصفح. الأزرار اللي ماعدّلتهاش بتفضل على الافتراضي.",
+        "skip": "روح للمحتوى",
+        "mainNav": "التنقل الرئيسي",
+        "groups": "مجموعات التحكم",
+        "find": "دور على زرار",
+        "clock": "الوقت الحالي",
+        "output": "ملف الإعدادات",
+        "captureHelp": "التسجيل بيستخدم مكان الزرار على الكيبورد. Escape بيلغي التسجيل؛ عشان تربطه اختاره من القائمة. بعض اختصارات المتصفح والنظام لازم تختارها يدويًا.",
+        "replaceTitle": "تتجاهل التعديلات اللي لسه ماحفظتهاش؟",
+        "replaceHelp": "انسخ الإعدادات أو نزّلها الأول لو عايز تحتفظ بيها.",
+        "captureCancelled": "تم إلغاء تسجيل الزرار.",
+        "captureBlur": "التسجيل اتلغى عشان خرجت من النافذة.",
+        "captured": "تم تسجيل {value} لـ {action}.",
+        "resetDone": "الإعدادات رجعت للافتراضي.",
+        "importRejected": "الملف مااتقبلش",
+        "importRead": "الملف اتقري بنجاح",
+        "line": "سطر {line}: {message}",
+        "preserved": "إعداداتك الحالية لسه زي ما هي.",
+        "imported": "تم استيراد {name}.",
+        "importFailed": "الاستيراد ماكملش: {message}",
+        "fileTooLarge": "ملف INI لازم يكون أصغر من 1 MiB.",
+        "invalidUtf8": "الملف لازم يكون نص بترميز UTF-8 سليم.",
+        "downloaded": "تم طلب تنزيل الإعدادات.",
+        "copied": "الإعدادات اتنسخت.",
+        "clipboardFailed": "النسخ مش متاح. انسخ النص المحدد بـ Ctrl+C.",
+        "noScript": "فعّل JavaScript عشان تستخدم الصفحة.",
+        "noDefault": "مفيش زرار كيبورد أو ماوس افتراضي",
+        "bindingLabel": "{action}، الربط {number}",
+        "typeLabel": "نوع الإدخال لـ {binding}",
+        "valueLabel": "الزرار لـ {binding}",
+        "addLabel": "ضيف زرار لـ {action}",
+        "captureLabel": "سجّل زرار لـ {binding}",
+        "removeLabel": "شيل {binding}",
+        "searchOptions": "دور في القائمة",
+        "noOptions": "مفيش اختيار مطابق للبحث."
+    },
+    "es": {
+        "controls": "Controles",
+        "configuration": "Configuración",
+        "help": "Ayuda",
+        "settings": "Ajustes",
+        "language": "Idioma",
+        "close": "Cerrar",
+        "eyebrow": "Accesorios / Controles personalizados",
+        "intro": "Elige un control y asigna entradas del teclado o ratón.",
+        "search": "Buscar controles",
+        "import": "Importar INI",
+        "reset": "Restablecer",
+        "group0": "Botones frontales",
+        "group1": "Botones superiores",
+        "group2": "Cruceta",
+        "group3": "Stick izquierdo",
+        "group4": "Stick derecho",
+        "group5": "Táctil y utilidades",
+        "select": "Seleccionar…",
+        "add": "+ Añadir entrada",
+        "capture": "Capturar",
+        "remove": "Eliminar",
+        "builtin": "Predeterminado: {inputs}",
+        "custom": "Las entradas personalizadas sustituyen las predeterminadas.",
+        "noResults": "No se encontraron controles.",
+        "download": "Descargar INI",
+        "copy": "Copiar configuración",
+        "previewEmpty": "Añade una entrada para empezar.",
+        "backControls": "Volver a controles",
+        "switchGroup": "Cambiar grupo",
+        "moveFocus": "Mover el foco",
+        "helpIntro": "Respuestas rápidas para empezar.",
+        "configIntro": "Revisa las entradas y copia o descarga el archivo.",
+        "captureTitle": "Pulsa una tecla para {action}",
+        "cancelCapture": "Cancelar captura",
+        "keepEditing": "Seguir editando",
+        "discard": "Descartar cambios",
+        "faq0Question": "¿Cómo asigno una tecla?",
+        "faq0Answer": "Elige un grupo y Añadir entrada. Usa Capturar o la lista. Puedes asignar varias entradas a una acción.",
+        "faq1Question": "¿Dónde guardo el archivo INI?",
+        "faq1Answer": "Pon anyps5-input.ini junto al ejecutable generado del juego. Para otra ruta, usa ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "¿Por qué no se captura una tecla?",
+        "faq2Answer": "El navegador o sistema puede interceptarla. Elígela en la lista. Escape cancela la captura; asígnala desde la lista.",
+        "faq3Question": "¿Se guardan mis cambios solos?",
+        "faq3Answer": "Los cambios están en memoria: cópialos o descárgalos antes de recargar. Solo se guarda el idioma. Las acciones no configuradas conservan sus valores predeterminados.",
+        "searchOptions": "Buscar opciones",
+        "noOptions": "No hay opciones coincidentes."
+    },
+    "fr": {
+        "controls": "Commandes",
+        "configuration": "Configuration",
+        "help": "Aide",
+        "settings": "Paramètres",
+        "language": "Langue",
+        "close": "Fermer",
+        "eyebrow": "Accessoires / Commandes personnalisées",
+        "intro": "Choisissez une commande, puis une touche ou un bouton de souris.",
+        "search": "Rechercher une commande",
+        "import": "Importer INI",
+        "reset": "Réinitialiser",
+        "group0": "Boutons principaux",
+        "group1": "Boutons supérieurs",
+        "group2": "Croix directionnelle",
+        "group3": "Stick gauche",
+        "group4": "Stick droit",
+        "group5": "Tactile et utilitaires",
+        "select": "Choisir…",
+        "add": "+ Ajouter une entrée",
+        "capture": "Capturer",
+        "remove": "Supprimer",
+        "builtin": "Par défaut : {inputs}",
+        "custom": "Les entrées personnalisées remplacent celles par défaut.",
+        "noResults": "Aucune commande trouvée.",
+        "download": "Télécharger INI",
+        "copy": "Copier la configuration",
+        "previewEmpty": "Ajoutez une entrée pour commencer.",
+        "backControls": "Retour aux commandes",
+        "switchGroup": "Changer de groupe",
+        "moveFocus": "Déplacer le focus",
+        "helpIntro": "Quelques réponses pour bien commencer.",
+        "configIntro": "Vérifiez les entrées, puis copiez ou téléchargez le fichier.",
+        "captureTitle": "Appuyez sur une touche pour {action}",
+        "cancelCapture": "Annuler la capture",
+        "keepEditing": "Continuer la modification",
+        "discard": "Ignorer les modifications",
+        "faq0Question": "Comment attribuer une touche ?",
+        "faq0Answer": "Choisissez un groupe et Ajouter une entrée. Utilisez Capturer ou la liste. Plusieurs entrées peuvent déclencher la même action.",
+        "faq1Question": "Où placer le fichier INI ?",
+        "faq1Answer": "Placez anyps5-input.ini près de l’exécutable généré du jeu. Pour un autre chemin, utilisez ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Pourquoi une touche n’est-elle pas capturée ?",
+        "faq2Answer": "Un raccourci du navigateur ou du système peut l’intercepter. Choisissez-la dans la liste. Escape annule la capture ; attribuez-la via la liste.",
+        "faq3Question": "Mes modifications sont-elles enregistrées ?",
+        "faq3Answer": "Les modifications restent en mémoire : copiez-les ou téléchargez-les avant de recharger. Seule la langue est mémorisée. Les actions non configurées gardent leurs valeurs par défaut.",
+        "searchOptions": "Rechercher une option",
+        "noOptions": "Aucune option trouvée."
+    },
+    "de": {
+        "controls": "Steuerung",
+        "configuration": "Konfiguration",
+        "help": "Hilfe",
+        "settings": "Einstellungen",
+        "language": "Sprache",
+        "close": "Schließen",
+        "eyebrow": "Zubehör / Eigene Steuerung",
+        "intro": "Wähle eine Steuerung und weise Tastatur- oder Mauseingaben zu.",
+        "search": "Steuerung suchen",
+        "import": "INI importieren",
+        "reset": "Zurücksetzen",
+        "group0": "Aktionstasten",
+        "group1": "Schultertasten",
+        "group2": "Steuerkreuz",
+        "group3": "Linker Stick",
+        "group4": "Rechter Stick",
+        "group5": "Touch und Werkzeuge",
+        "select": "Auswählen…",
+        "add": "+ Eingabe hinzufügen",
+        "capture": "Erfassen",
+        "remove": "Entfernen",
+        "builtin": "Standard: {inputs}",
+        "custom": "Eigene Eingaben ersetzen die Standardeingaben.",
+        "noResults": "Keine passende Steuerung gefunden.",
+        "download": "INI herunterladen",
+        "copy": "Konfiguration kopieren",
+        "previewEmpty": "Füge eine Eingabe hinzu, um zu beginnen.",
+        "backControls": "Zurück zur Steuerung",
+        "switchGroup": "Gruppe wechseln",
+        "moveFocus": "Fokus verschieben",
+        "helpIntro": "Kurze Antworten für den Einstieg.",
+        "configIntro": "Prüfe die Eingaben und kopiere oder lade die Datei herunter.",
+        "captureTitle": "Drücke eine Taste für {action}",
+        "cancelCapture": "Erfassung abbrechen",
+        "keepEditing": "Weiter bearbeiten",
+        "discard": "Änderungen verwerfen",
+        "faq0Question": "Wie weise ich eine Taste zu?",
+        "faq0Answer": "Wähle eine Gruppe und Eingabe hinzufügen. Nutze Erfassen oder die Liste. Mehrere Eingaben können dieselbe Aktion auslösen.",
+        "faq1Question": "Wohin gehört die INI-Datei?",
+        "faq1Answer": "Lege anyps5-input.ini neben die erzeugte Spielprogrammdatei. Für einen anderen Pfad nutze ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Warum wird eine Taste nicht erfasst?",
+        "faq2Answer": "Browser- oder Systemkürzel können sie abfangen. Wähle sie in der Liste. Escape bricht die Erfassung ab; weise Escape über die Liste zu.",
+        "faq3Question": "Werden Änderungen automatisch gespeichert?",
+        "faq3Answer": "Änderungen bleiben im Speicher: vor dem Neuladen kopieren oder herunterladen. Nur die Sprache wird gespeichert. Nicht konfigurierte Aktionen behalten ihre Standardwerte.",
+        "searchOptions": "Optionen suchen",
+        "noOptions": "Keine passenden Optionen."
+    },
+    "it": {
+        "controls": "Controlli",
+        "configuration": "Configurazione",
+        "help": "Aiuto",
+        "settings": "Impostazioni",
+        "language": "Lingua",
+        "close": "Chiudi",
+        "eyebrow": "Accessori / Controlli personalizzati",
+        "intro": "Scegli un controllo e assegna un tasto o un pulsante del mouse.",
+        "search": "Cerca controlli",
+        "import": "Importa INI",
+        "reset": "Reimposta",
+        "group0": "Pulsanti principali",
+        "group1": "Pulsanti superiori",
+        "group2": "Croce direzionale",
+        "group3": "Stick sinistro",
+        "group4": "Stick destro",
+        "group5": "Touch e utilità",
+        "select": "Seleziona…",
+        "add": "+ Aggiungi input",
+        "capture": "Acquisisci",
+        "remove": "Rimuovi",
+        "builtin": "Predefinito: {inputs}",
+        "custom": "Gli input personalizzati sostituiscono quelli predefiniti.",
+        "noResults": "Nessun controllo trovato.",
+        "download": "Scarica INI",
+        "copy": "Copia configurazione",
+        "previewEmpty": "Aggiungi un input per iniziare.",
+        "backControls": "Torna ai controlli",
+        "switchGroup": "Cambia gruppo",
+        "moveFocus": "Sposta il focus",
+        "helpIntro": "Risposte rapide per iniziare.",
+        "configIntro": "Controlla gli input e copia o scarica il file.",
+        "captureTitle": "Premi un tasto per {action}",
+        "cancelCapture": "Annulla acquisizione",
+        "keepEditing": "Continua a modificare",
+        "discard": "Scarta modifiche",
+        "faq0Question": "Come assegno un tasto?",
+        "faq0Answer": "Scegli un gruppo e Aggiungi input. Usa Acquisisci o l’elenco. Puoi assegnare più input alla stessa azione.",
+        "faq1Question": "Dove metto il file INI?",
+        "faq1Answer": "Metti anyps5-input.ini accanto all’eseguibile generato del gioco. Per un altro percorso, usa ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Perché un tasto non viene acquisito?",
+        "faq2Answer": "Il browser o il sistema potrebbe intercettarlo. Sceglilo dall’elenco. Escape annulla l’acquisizione; assegnalo dall’elenco.",
+        "faq3Question": "Le modifiche si salvano automaticamente?",
+        "faq3Answer": "Le modifiche restano in memoria: copiale o scaricale prima di ricaricare. Si salva solo la lingua. Le azioni non configurate mantengono i valori predefiniti.",
+        "searchOptions": "Cerca opzioni",
+        "noOptions": "Nessuna opzione trovata."
+    },
+    "pt": {
+        "controls": "Controles",
+        "configuration": "Configuração",
+        "help": "Ajuda",
+        "settings": "Configurações",
+        "language": "Idioma",
+        "close": "Fechar",
+        "eyebrow": "Acessórios / Controles personalizados",
+        "intro": "Escolha um controle e atribua entradas do teclado ou mouse.",
+        "search": "Buscar controles",
+        "import": "Importar INI",
+        "reset": "Redefinir",
+        "group0": "Botões principais",
+        "group1": "Botões superiores",
+        "group2": "Direcional",
+        "group3": "Analógico esquerdo",
+        "group4": "Analógico direito",
+        "group5": "Toque e utilidades",
+        "select": "Selecionar…",
+        "add": "+ Adicionar entrada",
+        "capture": "Capturar",
+        "remove": "Remover",
+        "builtin": "Padrão: {inputs}",
+        "custom": "As entradas personalizadas substituem as entradas padrão.",
+        "noResults": "Nenhum controle encontrado.",
+        "download": "Baixar INI",
+        "copy": "Copiar configuração",
+        "previewEmpty": "Adicione uma entrada para começar.",
+        "backControls": "Voltar aos controles",
+        "switchGroup": "Trocar grupo",
+        "moveFocus": "Mover o foco",
+        "helpIntro": "Respostas rápidas para começar.",
+        "configIntro": "Confira as entradas e copie ou baixe o arquivo.",
+        "captureTitle": "Pressione uma tecla para {action}",
+        "cancelCapture": "Cancelar captura",
+        "keepEditing": "Continuar editando",
+        "discard": "Descartar alterações",
+        "faq0Question": "Como atribuo uma tecla?",
+        "faq0Answer": "Escolha um grupo e Adicionar entrada. Use Capturar ou a lista. Uma ação pode ter várias entradas alternativas.",
+        "faq1Question": "Onde coloco o arquivo INI?",
+        "faq1Answer": "Coloque anyps5-input.ini junto do executável gerado do jogo. Para outro caminho, use ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Por que uma tecla não é capturada?",
+        "faq2Answer": "O navegador ou sistema pode interceptá-la. Escolha na lista. Escape cancela a captura; atribua Escape pela lista.",
+        "faq3Question": "As alterações são salvas sozinhas?",
+        "faq3Answer": "As alterações ficam na memória: copie ou baixe antes de recarregar. Só o idioma é salvo. Ações não configuradas mantêm os padrões.",
+        "searchOptions": "Buscar opções",
+        "noOptions": "Nenhuma opção encontrada."
+    },
+    "ru": {
+        "controls": "Управление",
+        "configuration": "Конфигурация",
+        "help": "Помощь",
+        "settings": "Настройки",
+        "language": "Язык",
+        "close": "Закрыть",
+        "eyebrow": "Аксессуары / Настройка управления",
+        "intro": "Выберите действие и назначьте клавишу или кнопку мыши.",
+        "search": "Поиск действий",
+        "import": "Импорт INI",
+        "reset": "Сбросить",
+        "group0": "Основные кнопки",
+        "group1": "Верхние кнопки",
+        "group2": "Крестовина",
+        "group3": "Левый стик",
+        "group4": "Правый стик",
+        "group5": "Сенсор и инструменты",
+        "select": "Выбрать…",
+        "add": "+ Добавить ввод",
+        "capture": "Записать",
+        "remove": "Удалить",
+        "builtin": "По умолчанию: {inputs}",
+        "custom": "Новые назначения заменяют стандартные.",
+        "noResults": "Действия не найдены.",
+        "download": "Скачать INI",
+        "copy": "Копировать конфигурацию",
+        "previewEmpty": "Добавьте назначение, чтобы начать.",
+        "backControls": "Назад к управлению",
+        "switchGroup": "Сменить группу",
+        "moveFocus": "Переместить фокус",
+        "helpIntro": "Краткие ответы для начала работы.",
+        "configIntro": "Проверьте назначения и скопируйте или скачайте файл.",
+        "captureTitle": "Нажмите клавишу для {action}",
+        "cancelCapture": "Отменить запись",
+        "keepEditing": "Продолжить изменение",
+        "discard": "Отменить изменения",
+        "faq0Question": "Как назначить клавишу?",
+        "faq0Answer": "Выберите группу и Добавить ввод. Используйте Записать или список. Одно действие может иметь несколько назначений.",
+        "faq1Question": "Куда поместить INI-файл?",
+        "faq1Answer": "Поместите anyps5-input.ini рядом с созданным исполняемым файлом игры. Для другого пути используйте ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Почему клавиша не записывается?",
+        "faq2Answer": "Браузер или система может перехватывать её. Выберите клавишу в списке. Escape отменяет запись; назначайте Escape через список.",
+        "faq3Question": "Изменения сохраняются автоматически?",
+        "faq3Answer": "Изменения хранятся в памяти: копируйте или скачивайте их перед перезагрузкой. Сохраняется только язык. Ненастроенные действия используют значения по умолчанию.",
+        "searchOptions": "Поиск вариантов",
+        "noOptions": "Совпадений нет."
+    },
+    "tr": {
+        "controls": "Kontroller",
+        "configuration": "Yapılandırma",
+        "help": "Yardım",
+        "settings": "Ayarlar",
+        "language": "Dil",
+        "close": "Kapat",
+        "eyebrow": "Aksesuarlar / Özel kontroller",
+        "intro": "Bir kontrol seçip klavye veya fare girdisi atayın.",
+        "search": "Kontrol ara",
+        "import": "INI içe aktar",
+        "reset": "Sıfırla",
+        "group0": "Ana düğmeler",
+        "group1": "Üst düğmeler",
+        "group2": "Yön tuşları",
+        "group3": "Sol çubuk",
+        "group4": "Sağ çubuk",
+        "group5": "Dokunma ve araçlar",
+        "select": "Seç…",
+        "add": "+ Girdi ekle",
+        "capture": "Yakala",
+        "remove": "Kaldır",
+        "builtin": "Varsayılan: {inputs}",
+        "custom": "Özel girdiler varsayılanların yerini alır.",
+        "noResults": "Kontrol bulunamadı.",
+        "download": "INI indir",
+        "copy": "Yapılandırmayı kopyala",
+        "previewEmpty": "Başlamak için bir girdi ekleyin.",
+        "backControls": "Kontrollere dön",
+        "switchGroup": "Grubu değiştir",
+        "moveFocus": "Odağı taşı",
+        "helpIntro": "Başlamanıza yardımcı olacak kısa yanıtlar.",
+        "configIntro": "Girdileri kontrol edip dosyayı kopyalayın veya indirin.",
+        "captureTitle": "{action} için bir tuşa basın",
+        "cancelCapture": "Yakalamayı iptal et",
+        "keepEditing": "Düzenlemeye devam et",
+        "discard": "Değişiklikleri sil",
+        "faq0Question": "Nasıl tuş atarım?",
+        "faq0Answer": "Bir grup seçip Girdi ekle düğmesine basın. Yakala veya listeyi kullanın. Bir eyleme birden fazla girdi atanabilir.",
+        "faq1Question": "INI dosyasını nereye koyarım?",
+        "faq1Answer": "anyps5-input.ini dosyasını oluşturulan oyun yürütülebilir dosyasının yanına koyun. Başka yol için ANYPS5_INPUT_CONFIG kullanın.",
+        "faq2Question": "Neden bir tuş yakalanmıyor?",
+        "faq2Answer": "Tarayıcı veya sistem kısayolu engelleyebilir. Listeden seçin. Escape yakalamayı iptal eder; Escape tuşunu listeden atayın.",
+        "faq3Question": "Değişiklikler otomatik kaydedilir mi?",
+        "faq3Answer": "Değişiklikler bellekte kalır: yenilemeden önce kopyalayın veya indirin. Yalnızca dil kaydedilir. Ayarlanmayan eylemler varsayılanlarını korur.",
+        "searchOptions": "Seçenek ara",
+        "noOptions": "Eşleşen seçenek yok."
+    },
+    "zh-Hans": {
+        "controls": "控制",
+        "configuration": "配置",
+        "help": "帮助",
+        "settings": "设置",
+        "language": "语言",
+        "close": "关闭",
+        "eyebrow": "配件 / 自定义控制",
+        "intro": "选择一个控制，然后分配键盘或鼠标输入。",
+        "search": "搜索控制",
+        "import": "导入 INI",
+        "reset": "重置",
+        "group0": "主要按钮",
+        "group1": "肩部按钮",
+        "group2": "方向键",
+        "group3": "左摇杆",
+        "group4": "右摇杆",
+        "group5": "触摸和工具",
+        "select": "选择…",
+        "add": "+ 添加输入",
+        "capture": "录入",
+        "remove": "移除",
+        "builtin": "默认：{inputs}",
+        "custom": "自定义输入会替换默认输入。",
+        "noResults": "没有找到匹配的控制。",
+        "download": "下载 INI",
+        "copy": "复制配置",
+        "previewEmpty": "添加输入以开始。",
+        "backControls": "返回控制",
+        "switchGroup": "切换分组",
+        "moveFocus": "移动焦点",
+        "helpIntro": "帮助您入门的简短解答。",
+        "configIntro": "检查输入，然后复制或下载文件。",
+        "captureTitle": "为 {action} 按下一个键",
+        "cancelCapture": "取消录入",
+        "keepEditing": "继续编辑",
+        "discard": "放弃更改",
+        "faq0Question": "如何分配按键？",
+        "faq0Answer": "选择分组和添加输入，然后使用录入或列表。同一操作可以使用多个输入。",
+        "faq1Question": "INI 文件放在哪里？",
+        "faq1Answer": "将 anyps5-input.ini 放在生成的游戏可执行文件旁。其他位置可使用 ANYPS5_INPUT_CONFIG 指定路径。",
+        "faq2Question": "为什么无法录入某个键？",
+        "faq2Answer": "浏览器或系统快捷键可能会拦截它。请从列表选择。Escape 会取消录入；要分配 Escape，请使用列表。",
+        "faq3Question": "修改会自动保存吗？",
+        "faq3Answer": "输入修改只保留在内存中，刷新前请复制或下载。浏览器只保存语言选择。未配置的操作保留默认输入。",
+        "searchOptions": "搜索选项",
+        "noOptions": "没有匹配选项。"
+    },
+    "ja": {
+        "controls": "操作",
+        "configuration": "構成",
+        "help": "ヘルプ",
+        "settings": "設定",
+        "language": "言語",
+        "close": "閉じる",
+        "eyebrow": "アクセサリー / 操作のカスタマイズ",
+        "intro": "操作を選び、キーボードやマウスの入力を割り当てます。",
+        "search": "操作を検索",
+        "import": "INI を読み込む",
+        "reset": "リセット",
+        "group0": "メインボタン",
+        "group1": "ショルダーボタン",
+        "group2": "方向キー",
+        "group3": "左スティック",
+        "group4": "右スティック",
+        "group5": "タッチとツール",
+        "select": "選択…",
+        "add": "+ 入力を追加",
+        "capture": "記録",
+        "remove": "削除",
+        "builtin": "初期設定：{inputs}",
+        "custom": "カスタム入力は初期設定を置き換えます。",
+        "noResults": "一致する操作がありません。",
+        "download": "INI をダウンロード",
+        "copy": "構成をコピー",
+        "previewEmpty": "入力を追加して開始します。",
+        "backControls": "操作に戻る",
+        "switchGroup": "グループを切り替え",
+        "moveFocus": "フォーカスを移動",
+        "helpIntro": "使い始めるための簡単な説明です。",
+        "configIntro": "入力を確認してファイルをコピーまたはダウンロードします。",
+        "captureTitle": "{action} のキーを押してください",
+        "cancelCapture": "記録をキャンセル",
+        "keepEditing": "編集を続ける",
+        "discard": "変更を破棄",
+        "faq0Question": "キーを割り当てるには？",
+        "faq0Answer": "グループと入力を追加を選び、記録または一覧を使います。同じ操作に複数の入力を割り当てられます。",
+        "faq1Question": "INI ファイルはどこに置きますか？",
+        "faq1Answer": "anyps5-input.ini を生成されたゲーム実行ファイルの隣に置きます。別の場所には ANYPS5_INPUT_CONFIG でパスを指定します。",
+        "faq2Question": "キーが記録されないのはなぜですか？",
+        "faq2Answer": "ブラウザーやシステムのショートカットが優先される場合があります。一覧から選んでください。Escape は記録をキャンセルするため、一覧から割り当てます。",
+        "faq3Question": "変更は自動保存されますか？",
+        "faq3Answer": "入力の変更はメモリ内だけです。再読み込み前にコピーかダウンロードをしてください。言語のみ保存されます。未設定の操作は初期設定を使います。",
+        "searchOptions": "選択肢を検索",
+        "noOptions": "一致する選択肢がありません。"
+    },
+    "ko": {
+        "controls": "컨트롤",
+        "configuration": "구성",
+        "help": "도움말",
+        "settings": "설정",
+        "language": "언어",
+        "close": "닫기",
+        "eyebrow": "액세서리 / 컨트롤 맞춤 설정",
+        "intro": "컨트롤을 선택하고 키보드 또는 마우스 입력을 지정하세요.",
+        "search": "컨트롤 검색",
+        "import": "INI 가져오기",
+        "reset": "초기화",
+        "group0": "주요 버튼",
+        "group1": "상단 버튼",
+        "group2": "방향키",
+        "group3": "왼쪽 스틱",
+        "group4": "오른쪽 스틱",
+        "group5": "터치 및 도구",
+        "select": "선택…",
+        "add": "+ 입력 추가",
+        "capture": "기록",
+        "remove": "제거",
+        "builtin": "기본값: {inputs}",
+        "custom": "사용자 입력이 기본 입력을 대체합니다.",
+        "noResults": "일치하는 컨트롤이 없습니다.",
+        "download": "INI 다운로드",
+        "copy": "구성 복사",
+        "previewEmpty": "입력을 추가하여 시작하세요.",
+        "backControls": "컨트롤로 돌아가기",
+        "switchGroup": "그룹 전환",
+        "moveFocus": "포커스 이동",
+        "helpIntro": "시작을 돕는 간단한 답변입니다.",
+        "configIntro": "입력을 확인하고 파일을 복사하거나 다운로드하세요.",
+        "captureTitle": "{action}에 사용할 키를 누르세요",
+        "cancelCapture": "기록 취소",
+        "keepEditing": "계속 편집",
+        "discard": "변경 사항 삭제",
+        "faq0Question": "키는 어떻게 지정하나요?",
+        "faq0Answer": "그룹과 입력 추가를 선택한 뒤 기록 또는 목록을 사용하세요. 같은 동작에 여러 입력을 지정할 수 있습니다.",
+        "faq1Question": "INI 파일은 어디에 두나요?",
+        "faq1Answer": "생성된 게임 실행 파일 옆에 anyps5-input.ini를 두세요. 다른 경로는 ANYPS5_INPUT_CONFIG로 지정하세요.",
+        "faq2Question": "키가 기록되지 않는 이유는 무엇인가요?",
+        "faq2Answer": "브라우저나 시스템 단축키가 가로챌 수 있습니다. 목록에서 선택하세요. Escape는 기록을 취소하므로 목록에서 지정하세요.",
+        "faq3Question": "변경 사항이 자동 저장되나요?",
+        "faq3Answer": "입력 변경은 메모리에만 있습니다. 새로고침 전에 복사하거나 다운로드하세요. 언어 선택만 저장됩니다. 설정하지 않은 동작은 기본값을 유지합니다.",
+        "searchOptions": "옵션 검색",
+        "noOptions": "일치하는 옵션이 없습니다."
+    },
+    "hi": {
+        "controls": "नियंत्रण",
+        "configuration": "कॉन्फ़िगरेशन",
+        "help": "मदद",
+        "settings": "सेटिंग्स",
+        "language": "भाषा",
+        "close": "बंद करें",
+        "eyebrow": "सहायक उपकरण / कस्टम नियंत्रण",
+        "intro": "नियंत्रण चुनें और कीबोर्ड या माउस इनपुट जोड़ें।",
+        "search": "नियंत्रण खोजें",
+        "import": "INI आयात करें",
+        "reset": "रीसेट",
+        "group0": "मुख्य बटन",
+        "group1": "ऊपरी बटन",
+        "group2": "दिशा बटन",
+        "group3": "बायाँ स्टिक",
+        "group4": "दायाँ स्टिक",
+        "group5": "टच और उपकरण",
+        "select": "चुनें…",
+        "add": "+ इनपुट जोड़ें",
+        "capture": "रिकॉर्ड करें",
+        "remove": "हटाएँ",
+        "builtin": "डिफ़ॉल्ट: {inputs}",
+        "custom": "कस्टम इनपुट डिफ़ॉल्ट इनपुट की जगह लेते हैं।",
+        "noResults": "कोई नियंत्रण नहीं मिला।",
+        "download": "INI डाउनलोड करें",
+        "copy": "कॉन्फ़िगरेशन कॉपी करें",
+        "previewEmpty": "शुरू करने के लिए इनपुट जोड़ें।",
+        "backControls": "नियंत्रण पर वापस जाएँ",
+        "switchGroup": "समूह बदलें",
+        "moveFocus": "फ़ोकस बदलें",
+        "helpIntro": "शुरू करने के लिए कुछ आसान जवाब।",
+        "configIntro": "इनपुट जाँचें और फ़ाइल कॉपी या डाउनलोड करें।",
+        "captureTitle": "{action} के लिए कोई कुंजी दबाएँ",
+        "cancelCapture": "रिकॉर्डिंग रद्द करें",
+        "keepEditing": "संपादन जारी रखें",
+        "discard": "बदलाव हटाएँ",
+        "faq0Question": "कुंजी कैसे जोड़ूँ?",
+        "faq0Answer": "समूह और इनपुट जोड़ें चुनें, फिर रिकॉर्ड करें या सूची का उपयोग करें। एक काम के लिए कई इनपुट जोड़ सकते हैं।",
+        "faq1Question": "INI फ़ाइल कहाँ रखें?",
+        "faq1Answer": "anyps5-input.ini को बनाए गए गेम प्रोग्राम के पास रखें। दूसरे स्थान के लिए ANYPS5_INPUT_CONFIG में पथ दें।",
+        "faq2Question": "कुंजी रिकॉर्ड क्यों नहीं होती?",
+        "faq2Answer": "ब्राउज़र या सिस्टम का शॉर्टकट उसे रोक सकता है। सूची से चुनें। Escape रिकॉर्डिंग रद्द करता है; इसे सूची से जोड़ें।",
+        "faq3Question": "क्या बदलाव अपने आप सेव होते हैं?",
+        "faq3Answer": "बदलाव केवल मेमोरी में रहते हैं: रीलोड से पहले कॉपी या डाउनलोड करें। केवल भाषा सेव होती है। बिना बदले काम अपने डिफ़ॉल्ट रखते हैं।",
+        "searchOptions": "विकल्प खोजें",
+        "noOptions": "कोई विकल्प नहीं मिला।"
+    },
+    "bn": {
+        "controls": "নিয়ন্ত্রণ",
+        "configuration": "কনফিগারেশন",
+        "help": "সাহায্য",
+        "settings": "সেটিংস",
+        "language": "ভাষা",
+        "close": "বন্ধ করুন",
+        "eyebrow": "আনুষঙ্গিক / নিজস্ব নিয়ন্ত্রণ",
+        "intro": "একটি নিয়ন্ত্রণ বেছে কিবোর্ড বা মাউস ইনপুট দিন।",
+        "search": "নিয়ন্ত্রণ খুঁজুন",
+        "import": "INI আমদানি",
+        "reset": "রিসেট",
+        "group0": "প্রধান বোতাম",
+        "group1": "ওপরের বোতাম",
+        "group2": "দিক বোতাম",
+        "group3": "বাম স্টিক",
+        "group4": "ডান স্টিক",
+        "group5": "টাচ ও সরঞ্জাম",
+        "select": "বাছুন…",
+        "add": "+ ইনপুট যোগ",
+        "capture": "রেকর্ড",
+        "remove": "সরান",
+        "builtin": "ডিফল্ট: {inputs}",
+        "custom": "নিজস্ব ইনপুট ডিফল্ট ইনপুটের বদলে কাজ করে।",
+        "noResults": "কোনো নিয়ন্ত্রণ পাওয়া যায়নি।",
+        "download": "INI ডাউনলোড",
+        "copy": "কনফিগারেশন কপি",
+        "previewEmpty": "শুরু করতে একটি ইনপুট যোগ করুন।",
+        "backControls": "নিয়ন্ত্রণে ফিরে যান",
+        "switchGroup": "গ্রুপ বদলান",
+        "moveFocus": "ফোকাস সরান",
+        "helpIntro": "শুরু করার জন্য কিছু সহজ উত্তর।",
+        "configIntro": "ইনপুট দেখে ফাইল কপি বা ডাউনলোড করুন।",
+        "captureTitle": "{action}-এর জন্য একটি কী চাপুন",
+        "cancelCapture": "রেকর্ড বাতিল",
+        "keepEditing": "সম্পাদনা চালান",
+        "discard": "পরিবর্তন বাদ দিন",
+        "faq0Question": "কী কীভাবে যোগ করব?",
+        "faq0Answer": "গ্রুপ ও ইনপুট যোগ বেছে রেকর্ড বা তালিকা ব্যবহার করুন। এক কাজের জন্য একাধিক ইনপুট দিতে পারেন।",
+        "faq1Question": "INI ফাইল কোথায় রাখব?",
+        "faq1Answer": "তৈরি হওয়া গেম চালানোর ফাইলের পাশে anyps5-input.ini রাখুন। অন্য পথের জন্য ANYPS5_INPUT_CONFIG ব্যবহার করুন।",
+        "faq2Question": "কোনো কী রেকর্ড হচ্ছে না কেন?",
+        "faq2Answer": "ব্রাউজার বা সিস্টেম শর্টকাট সেটি আটকাতে পারে। তালিকা থেকে বাছুন। Escape রেকর্ড বাতিল করে; তালিকা থেকে যোগ করুন।",
+        "faq3Question": "পরিবর্তন কি নিজে থেকে সেভ হয়?",
+        "faq3Answer": "পরিবর্তন শুধু মেমোরিতে থাকে: রিলোডের আগে কপি বা ডাউনলোড করুন। শুধু ভাষা সেভ হয়। না বদলানো কাজগুলো ডিফল্ট রাখে।",
+        "searchOptions": "বিকল্প খুঁজুন",
+        "noOptions": "কোনো বিকল্প মেলেনি।"
+    },
+    "ur": {
+        "controls": "کنٹرول",
+        "configuration": "ترتیب",
+        "help": "مدد",
+        "settings": "سیٹنگز",
+        "language": "زبان",
+        "close": "بند کریں",
+        "eyebrow": "لوازمات / حسب ضرورت کنٹرول",
+        "intro": "کنٹرول منتخب کرکے کی بورڈ یا ماؤس ان پٹ مقرر کریں۔",
+        "search": "کنٹرول تلاش کریں",
+        "import": "INI درآمد کریں",
+        "reset": "ری سیٹ",
+        "group0": "بنیادی بٹن",
+        "group1": "اوپری بٹن",
+        "group2": "سمت کے بٹن",
+        "group3": "بائیں اسٹک",
+        "group4": "دائیں اسٹک",
+        "group5": "ٹچ اور اوزار",
+        "select": "منتخب کریں…",
+        "add": "+ ان پٹ شامل کریں",
+        "capture": "ریکارڈ کریں",
+        "remove": "ہٹائیں",
+        "builtin": "پہلے سے طے شدہ: {inputs}",
+        "custom": "حسب ضرورت ان پٹ پہلے سے طے شدہ ان پٹ کی جگہ لیتے ہیں۔",
+        "noResults": "کوئی کنٹرول نہیں ملا۔",
+        "download": "INI ڈاؤن لوڈ کریں",
+        "copy": "ترتیب کاپی کریں",
+        "previewEmpty": "شروع کرنے کے لیے ان پٹ شامل کریں۔",
+        "backControls": "کنٹرول پر واپس جائیں",
+        "switchGroup": "گروپ بدلیں",
+        "moveFocus": "فوکس بدلیں",
+        "helpIntro": "شروع کرنے کے لیے مختصر جوابات۔",
+        "configIntro": "ان پٹ دیکھ کر فائل کاپی یا ڈاؤن لوڈ کریں۔",
+        "captureTitle": "{action} کے لیے کوئی کلید دبائیں",
+        "cancelCapture": "ریکارڈنگ منسوخ کریں",
+        "keepEditing": "ترمیم جاری رکھیں",
+        "discard": "تبدیلیاں چھوڑ دیں",
+        "faq0Question": "کلید کیسے مقرر کروں؟",
+        "faq0Answer": "گروپ اور ان پٹ شامل کریں منتخب کریں، پھر ریکارڈ یا فہرست استعمال کریں۔ ایک عمل کے لیے کئی ان پٹ رکھ سکتے ہیں۔",
+        "faq1Question": "INI فائل کہاں رکھوں؟",
+        "faq1Answer": "anyps5-input.ini کو بنائی گئی گیم کی قابل اجرا فائل کے ساتھ رکھیں۔ دوسرے راستے کے لیے ANYPS5_INPUT_CONFIG استعمال کریں۔",
+        "faq2Question": "کلید ریکارڈ کیوں نہیں ہوتی؟",
+        "faq2Answer": "براؤزر یا نظام کا شارٹ کٹ روک سکتا ہے۔ فہرست سے منتخب کریں۔ Escape ریکارڈنگ منسوخ کرتا ہے؛ اسے فہرست سے مقرر کریں۔",
+        "faq3Question": "کیا تبدیلیاں خود محفوظ ہوتی ہیں؟",
+        "faq3Answer": "تبدیلیاں صرف میموری میں رہتی ہیں: ری لوڈ سے پہلے کاپی یا ڈاؤن لوڈ کریں۔ صرف زبان محفوظ ہوتی ہے۔ غیر تبدیل شدہ اعمال اپنی طے شدہ ترتیب رکھتے ہیں۔",
+        "searchOptions": "اختیارات تلاش کریں",
+        "noOptions": "کوئی اختیار نہیں ملا۔"
+    },
+    "fa": {
+        "controls": "کنترل‌ها",
+        "configuration": "پیکربندی",
+        "help": "راهنما",
+        "settings": "تنظیمات",
+        "language": "زبان",
+        "close": "بستن",
+        "eyebrow": "لوازم جانبی / کنترل سفارشی",
+        "intro": "یک کنترل را انتخاب کنید و ورودی صفحه‌کلید یا ماوس بدهید.",
+        "search": "جستجوی کنترل",
+        "import": "وارد کردن INI",
+        "reset": "بازنشانی",
+        "group0": "دکمه‌های اصلی",
+        "group1": "دکمه‌های بالایی",
+        "group2": "دکمه‌های جهت",
+        "group3": "دسته چپ",
+        "group4": "دسته راست",
+        "group5": "لمس و ابزارها",
+        "select": "انتخاب…",
+        "add": "+ افزودن ورودی",
+        "capture": "ثبت",
+        "remove": "حذف",
+        "builtin": "پیش‌فرض: {inputs}",
+        "custom": "ورودی سفارشی جای ورودی پیش‌فرض را می‌گیرد.",
+        "noResults": "کنترلی پیدا نشد.",
+        "download": "دانلود INI",
+        "copy": "کپی پیکربندی",
+        "previewEmpty": "برای شروع یک ورودی اضافه کنید.",
+        "backControls": "بازگشت به کنترل‌ها",
+        "switchGroup": "تغییر گروه",
+        "moveFocus": "جابجایی تمرکز",
+        "helpIntro": "پاسخ‌های کوتاه برای شروع.",
+        "configIntro": "ورودی‌ها را بررسی و فایل را کپی یا دانلود کنید.",
+        "captureTitle": "برای {action} کلیدی فشار دهید",
+        "cancelCapture": "لغو ثبت",
+        "keepEditing": "ادامه ویرایش",
+        "discard": "کنار گذاشتن تغییرات",
+        "faq0Question": "چطور کلید تعیین کنم؟",
+        "faq0Answer": "گروه و افزودن ورودی را انتخاب کنید، سپس ثبت یا فهرست را به کار ببرید. یک عمل می‌تواند چند ورودی داشته باشد.",
+        "faq1Question": "فایل INI را کجا بگذارم؟",
+        "faq1Answer": "anyps5-input.ini را کنار فایل اجرایی ساخته‌شده بازی قرار دهید. برای مسیر دیگر از ANYPS5_INPUT_CONFIG استفاده کنید.",
+        "faq2Question": "چرا کلید ثبت نمی‌شود؟",
+        "faq2Answer": "میانبر مرورگر یا سیستم ممکن است آن را بگیرد. از فهرست انتخاب کنید. Escape ثبت را لغو می‌کند؛ آن را از فهرست تعیین کنید.",
+        "faq3Question": "آیا تغییرات خودکار ذخیره می‌شوند؟",
+        "faq3Answer": "تغییرات فقط در حافظه‌اند: قبل از بارگذاری دوباره کپی یا دانلود کنید. تنها زبان ذخیره می‌شود. اعمال تنظیم‌نشده پیش‌فرض خود را حفظ می‌کنند.",
+        "searchOptions": "جستجوی گزینه‌ها",
+        "noOptions": "گزینه‌ای پیدا نشد."
+    },
+    "id": {
+        "controls": "Kontrol",
+        "configuration": "Konfigurasi",
+        "help": "Bantuan",
+        "settings": "Pengaturan",
+        "language": "Bahasa",
+        "close": "Tutup",
+        "eyebrow": "Aksesori / Kontrol khusus",
+        "intro": "Pilih kontrol, lalu tetapkan input keyboard atau mouse.",
+        "search": "Cari kontrol",
+        "import": "Impor INI",
+        "reset": "Atur ulang",
+        "group0": "Tombol utama",
+        "group1": "Tombol atas",
+        "group2": "Tombol arah",
+        "group3": "Stik kiri",
+        "group4": "Stik kanan",
+        "group5": "Sentuh dan alat",
+        "select": "Pilih…",
+        "add": "+ Tambah input",
+        "capture": "Rekam",
+        "remove": "Hapus",
+        "builtin": "Bawaan: {inputs}",
+        "custom": "Input khusus menggantikan input bawaan.",
+        "noResults": "Kontrol tidak ditemukan.",
+        "download": "Unduh INI",
+        "copy": "Salin konfigurasi",
+        "previewEmpty": "Tambahkan input untuk memulai.",
+        "backControls": "Kembali ke kontrol",
+        "switchGroup": "Ganti grup",
+        "moveFocus": "Pindahkan fokus",
+        "helpIntro": "Jawaban singkat untuk memulai.",
+        "configIntro": "Periksa input, lalu salin atau unduh berkas.",
+        "captureTitle": "Tekan tombol untuk {action}",
+        "cancelCapture": "Batalkan rekaman",
+        "keepEditing": "Lanjutkan mengedit",
+        "discard": "Buang perubahan",
+        "faq0Question": "Bagaimana menetapkan tombol?",
+        "faq0Answer": "Pilih grup dan Tambah input, lalu Rekam atau gunakan daftar. Satu aksi dapat memiliki beberapa input.",
+        "faq1Question": "Di mana berkas INI diletakkan?",
+        "faq1Answer": "Letakkan anyps5-input.ini di samping berkas program game yang dihasilkan. Untuk lokasi lain, gunakan ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Mengapa tombol tidak direkam?",
+        "faq2Answer": "Pintasan browser atau sistem mungkin menangkapnya. Pilih dari daftar. Escape membatalkan rekaman; tetapkan Escape melalui daftar.",
+        "faq3Question": "Apakah perubahan disimpan otomatis?",
+        "faq3Answer": "Perubahan hanya di memori: salin atau unduh sebelum memuat ulang. Hanya bahasa yang disimpan. Aksi yang tidak diatur tetap memakai bawaan.",
+        "searchOptions": "Cari opsi",
+        "noOptions": "Tidak ada opsi yang cocok."
+    },
+    "vi": {
+        "controls": "Điều khiển",
+        "configuration": "Cấu hình",
+        "help": "Trợ giúp",
+        "settings": "Cài đặt",
+        "language": "Ngôn ngữ",
+        "close": "Đóng",
+        "eyebrow": "Phụ kiện / Điều khiển tùy chỉnh",
+        "intro": "Chọn điều khiển rồi gán phím hoặc nút chuột.",
+        "search": "Tìm điều khiển",
+        "import": "Nhập INI",
+        "reset": "Đặt lại",
+        "group0": "Nút chính",
+        "group1": "Nút phía trên",
+        "group2": "Phím hướng",
+        "group3": "Cần trái",
+        "group4": "Cần phải",
+        "group5": "Cảm ứng và công cụ",
+        "select": "Chọn…",
+        "add": "+ Thêm đầu vào",
+        "capture": "Ghi phím",
+        "remove": "Xóa",
+        "builtin": "Mặc định: {inputs}",
+        "custom": "Đầu vào tùy chỉnh thay thế đầu vào mặc định.",
+        "noResults": "Không tìm thấy điều khiển.",
+        "download": "Tải INI",
+        "copy": "Sao chép cấu hình",
+        "previewEmpty": "Thêm đầu vào để bắt đầu.",
+        "backControls": "Trở về điều khiển",
+        "switchGroup": "Đổi nhóm",
+        "moveFocus": "Di chuyển tiêu điểm",
+        "helpIntro": "Câu trả lời nhanh để bắt đầu.",
+        "configIntro": "Kiểm tra đầu vào rồi sao chép hoặc tải tệp.",
+        "captureTitle": "Nhấn phím cho {action}",
+        "cancelCapture": "Hủy ghi phím",
+        "keepEditing": "Tiếp tục chỉnh sửa",
+        "discard": "Bỏ thay đổi",
+        "faq0Question": "Làm sao gán phím?",
+        "faq0Answer": "Chọn nhóm và Thêm đầu vào, rồi dùng Ghi phím hoặc danh sách. Một hành động có thể có nhiều đầu vào.",
+        "faq1Question": "Đặt tệp INI ở đâu?",
+        "faq1Answer": "Đặt anyps5-input.ini cạnh tệp chạy trò chơi được tạo. Dùng ANYPS5_INPUT_CONFIG cho đường dẫn khác.",
+        "faq2Question": "Tại sao không ghi được phím?",
+        "faq2Answer": "Trình duyệt hoặc hệ thống có thể chặn phím tắt. Chọn từ danh sách. Escape hủy ghi phím; hãy gán Escape từ danh sách.",
+        "faq3Question": "Thay đổi có tự lưu không?",
+        "faq3Answer": "Thay đổi chỉ ở trong bộ nhớ: sao chép hoặc tải xuống trước khi tải lại. Chỉ ngôn ngữ được lưu. Hành động chưa cấu hình giữ mặc định.",
+        "searchOptions": "Tìm tùy chọn",
+        "noOptions": "Không có tùy chọn phù hợp."
+    },
+    "th": {
+        "controls": "การควบคุม",
+        "configuration": "การกำหนดค่า",
+        "help": "ช่วยเหลือ",
+        "settings": "การตั้งค่า",
+        "language": "ภาษา",
+        "close": "ปิด",
+        "eyebrow": "อุปกรณ์เสริม / ปรับแต่งการควบคุม",
+        "intro": "เลือกการควบคุม แล้วกำหนดปุ่มแป้นพิมพ์หรือเมาส์",
+        "search": "ค้นหาการควบคุม",
+        "import": "นำเข้า INI",
+        "reset": "รีเซ็ต",
+        "group0": "ปุ่มหลัก",
+        "group1": "ปุ่มด้านบน",
+        "group2": "ปุ่มทิศทาง",
+        "group3": "สติ๊กซ้าย",
+        "group4": "สติ๊กขวา",
+        "group5": "สัมผัสและเครื่องมือ",
+        "select": "เลือก…",
+        "add": "+ เพิ่มอินพุต",
+        "capture": "บันทึกปุ่ม",
+        "remove": "ลบ",
+        "builtin": "ค่าเริ่มต้น: {inputs}",
+        "custom": "อินพุตที่กำหนดเองจะแทนที่ค่าเริ่มต้น",
+        "noResults": "ไม่พบการควบคุม",
+        "download": "ดาวน์โหลด INI",
+        "copy": "คัดลอกการกำหนดค่า",
+        "previewEmpty": "เพิ่มอินพุตเพื่อเริ่มต้น",
+        "backControls": "กลับไปการควบคุม",
+        "switchGroup": "เปลี่ยนกลุ่ม",
+        "moveFocus": "ย้ายโฟกัส",
+        "helpIntro": "คำตอบสั้นๆ เพื่อช่วยเริ่มต้น",
+        "configIntro": "ตรวจสอบอินพุต แล้วคัดลอกหรือดาวน์โหลดไฟล์",
+        "captureTitle": "กดปุ่มสำหรับ {action}",
+        "cancelCapture": "ยกเลิกการบันทึก",
+        "keepEditing": "แก้ไขต่อ",
+        "discard": "ทิ้งการเปลี่ยนแปลง",
+        "faq0Question": "กำหนดปุ่มอย่างไร?",
+        "faq0Answer": "เลือกกลุ่มและเพิ่มอินพุต แล้วใช้บันทึกปุ่มหรือรายการ หนึ่งการกระทำมีได้หลายอินพุต",
+        "faq1Question": "วางไฟล์ INI ที่ไหน?",
+        "faq1Answer": "วาง anyps5-input.ini ข้างไฟล์โปรแกรมเกมที่สร้างขึ้น ใช้ ANYPS5_INPUT_CONFIG สำหรับตำแหน่งอื่น",
+        "faq2Question": "ทำไมบางปุ่มจึงบันทึกไม่ได้?",
+        "faq2Answer": "ทางลัดของเบราว์เซอร์หรือระบบอาจดักปุ่มไว้ เลือกจากรายการแทน Escape ยกเลิกการบันทึก จึงต้องกำหนดจากรายการ",
+        "faq3Question": "บันทึกการเปลี่ยนแปลงอัตโนมัติไหม?",
+        "faq3Answer": "การเปลี่ยนแปลงอยู่ในหน่วยความจำเท่านั้น คัดลอกหรือดาวน์โหลดก่อนโหลดใหม่ บันทึกเฉพาะภาษา การกระทำที่ยังไม่ตั้งค่าจะใช้ค่าเริ่มต้น",
+        "searchOptions": "ค้นหาตัวเลือก",
+        "noOptions": "ไม่พบตัวเลือกที่ตรงกัน"
+    },
+    "sw": {
+        "controls": "Vidhibiti",
+        "configuration": "Usanidi",
+        "help": "Msaada",
+        "settings": "Mipangilio",
+        "language": "Lugha",
+        "close": "Funga",
+        "eyebrow": "Vifaa / Vidhibiti maalum",
+        "intro": "Chagua kidhibiti kisha weka ingizo la kibodi au kipanya.",
+        "search": "Tafuta vidhibiti",
+        "import": "Ingiza INI",
+        "reset": "Weka upya",
+        "group0": "Vibonye vikuu",
+        "group1": "Vibonye vya juu",
+        "group2": "Vibonye vya mwelekeo",
+        "group3": "Kijiti cha kushoto",
+        "group4": "Kijiti cha kulia",
+        "group5": "Mguso na zana",
+        "select": "Chagua…",
+        "add": "+ Ongeza ingizo",
+        "capture": "Rekodi",
+        "remove": "Ondoa",
+        "builtin": "Chaguo-msingi: {inputs}",
+        "custom": "Ingizo maalum linachukua nafasi ya ingizo la kawaida.",
+        "noResults": "Hakuna vidhibiti vilivyopatikana.",
+        "download": "Pakua INI",
+        "copy": "Nakili usanidi",
+        "previewEmpty": "Ongeza ingizo ili kuanza.",
+        "backControls": "Rudi kwenye vidhibiti",
+        "switchGroup": "Badili kundi",
+        "moveFocus": "Hamisha fokasi",
+        "helpIntro": "Majibu mafupi ya kukusaidia kuanza.",
+        "configIntro": "Kagua ingizo kisha nakili au pakua faili.",
+        "captureTitle": "Bonyeza kitufe kwa {action}",
+        "cancelCapture": "Ghairi kurekodi",
+        "keepEditing": "Endelea kuhariri",
+        "discard": "Tupa mabadiliko",
+        "faq0Question": "Ninawekaje kitufe?",
+        "faq0Answer": "Chagua kundi na Ongeza ingizo, kisha Rekodi au tumia orodha. Kitendo kimoja kinaweza kuwa na ingizo nyingi.",
+        "faq1Question": "Ninaweka wapi faili la INI?",
+        "faq1Answer": "Weka anyps5-input.ini karibu na faili la programu ya mchezo lililozalishwa. Tumia ANYPS5_INPUT_CONFIG kwa njia nyingine.",
+        "faq2Question": "Kwa nini kitufe hakirekodiwi?",
+        "faq2Answer": "Njia ya mkato ya kivinjari au mfumo inaweza kukizuia. Chagua kwenye orodha. Escape hughairi kurekodi; kiweke kupitia orodha.",
+        "faq3Question": "Mabadiliko huhifadhiwa kiotomatiki?",
+        "faq3Answer": "Mabadiliko hubaki kwenye kumbukumbu: nakili au pakua kabla ya kupakia upya. Lugha pekee huhifadhiwa. Vitendo visivyosanidiwa hutumia chaguo-msingi.",
+        "searchOptions": "Tafuta chaguo",
+        "noOptions": "Hakuna chaguo linalolingana."
+    },
+    "nl": {
+        "controls": "Bediening",
+        "configuration": "Configuratie",
+        "help": "Hulp",
+        "settings": "Instellingen",
+        "language": "Taal",
+        "close": "Sluiten",
+        "eyebrow": "Accessoires / Eigen bediening",
+        "intro": "Kies een actie en wijs toetsenbord- of muisinvoer toe.",
+        "search": "Bediening zoeken",
+        "import": "INI importeren",
+        "reset": "Herstellen",
+        "group0": "Actieknoppen",
+        "group1": "Schouderknoppen",
+        "group2": "Richtingsknoppen",
+        "group3": "Linker stick",
+        "group4": "Rechter stick",
+        "group5": "Aanraakvlak en hulpmiddelen",
+        "select": "Selecteren…",
+        "add": "+ Invoer toevoegen",
+        "capture": "Vastleggen",
+        "remove": "Verwijderen",
+        "builtin": "Standaard: {inputs}",
+        "custom": "Eigen invoer vervangt de standaardinvoer.",
+        "noResults": "Geen passende bediening gevonden.",
+        "download": "INI downloaden",
+        "copy": "Configuratie kopiëren",
+        "previewEmpty": "Voeg invoer toe om te beginnen.",
+        "backControls": "Terug naar bediening",
+        "switchGroup": "Groep wisselen",
+        "moveFocus": "Focus verplaatsen",
+        "helpIntro": "Korte antwoorden om te beginnen.",
+        "configIntro": "Controleer de invoer en kopieer of download het bestand.",
+        "captureTitle": "Druk op een toets voor {action}",
+        "cancelCapture": "Vastleggen annuleren",
+        "keepEditing": "Verder bewerken",
+        "discard": "Wijzigingen weggooien",
+        "faq0Question": "Hoe wijs ik een toets toe?",
+        "faq0Answer": "Kies een groep en Invoer toevoegen, dan Vastleggen of de lijst. Eén actie kan meerdere invoeren hebben.",
+        "faq1Question": "Waar plaats ik het INI-bestand?",
+        "faq1Answer": "Zet anyps5-input.ini naast het gegenereerde spelprogramma. Gebruik ANYPS5_INPUT_CONFIG voor een ander pad.",
+        "faq2Question": "Waarom wordt een toets niet vastgelegd?",
+        "faq2Answer": "Een browser- of systeemsneltoets kan hem onderscheppen. Kies uit de lijst. Escape annuleert vastleggen; wijs Escape via de lijst toe.",
+        "faq3Question": "Worden wijzigingen automatisch opgeslagen?",
+        "faq3Answer": "Wijzigingen staan alleen in het geheugen: kopieer of download vóór herladen. Alleen de taal wordt opgeslagen. Ongewijzigde acties houden hun standaardwaarden.",
+        "searchOptions": "Opties zoeken",
+        "noOptions": "Geen passende opties."
+    },
+    "pl": {
+        "controls": "Sterowanie",
+        "configuration": "Konfiguracja",
+        "help": "Pomoc",
+        "settings": "Ustawienia",
+        "language": "Język",
+        "close": "Zamknij",
+        "eyebrow": "Akcesoria / Własne sterowanie",
+        "intro": "Wybierz akcję i przypisz klawisz lub przycisk myszy.",
+        "search": "Szukaj sterowania",
+        "import": "Importuj INI",
+        "reset": "Resetuj",
+        "group0": "Główne przyciski",
+        "group1": "Górne przyciski",
+        "group2": "Przyciski kierunkowe",
+        "group3": "Lewy drążek",
+        "group4": "Prawy drążek",
+        "group5": "Dotyk i narzędzia",
+        "select": "Wybierz…",
+        "add": "+ Dodaj wejście",
+        "capture": "Zarejestruj",
+        "remove": "Usuń",
+        "builtin": "Domyślne: {inputs}",
+        "custom": "Własne wejścia zastępują domyślne.",
+        "noResults": "Nie znaleziono pasującej akcji.",
+        "download": "Pobierz INI",
+        "copy": "Kopiuj konfigurację",
+        "previewEmpty": "Dodaj wejście, aby zacząć.",
+        "backControls": "Wróć do sterowania",
+        "switchGroup": "Zmień grupę",
+        "moveFocus": "Przenieś fokus",
+        "helpIntro": "Krótkie odpowiedzi na początek.",
+        "configIntro": "Sprawdź wejścia i skopiuj lub pobierz plik.",
+        "captureTitle": "Naciśnij klawisz dla {action}",
+        "cancelCapture": "Anuluj rejestrację",
+        "keepEditing": "Edytuj dalej",
+        "discard": "Odrzuć zmiany",
+        "faq0Question": "Jak przypisać klawisz?",
+        "faq0Answer": "Wybierz grupę i Dodaj wejście, potem Zarejestruj lub listę. Jedna akcja może mieć kilka wejść.",
+        "faq1Question": "Gdzie umieścić plik INI?",
+        "faq1Answer": "Umieść anyps5-input.ini obok wygenerowanego pliku wykonywalnego gry. Inny adres podaj w ANYPS5_INPUT_CONFIG.",
+        "faq2Question": "Dlaczego klawisz nie jest rejestrowany?",
+        "faq2Answer": "Skrót przeglądarki lub systemu może go przechwycić. Wybierz z listy. Escape anuluje rejestrację; przypisz go z listy.",
+        "faq3Question": "Czy zmiany zapisują się automatycznie?",
+        "faq3Answer": "Zmiany są tylko w pamięci: skopiuj lub pobierz przed odświeżeniem. Zapisywany jest tylko język. Nieustawione akcje zachowują wartości domyślne.",
+        "searchOptions": "Szukaj opcji",
+        "noOptions": "Brak pasujących opcji."
+    }
+};
+
+export function translate(locale, key, values = {}) {
+    const text = messages[locale]?.[key] ?? messages.en[key] ?? key;
+    return text.replace(/\{(\w+)\}/gu, (match, name) => String(values[name] ?? match));
+}
+
+export function diagnostic(locale, message) {
+    if (locale !== 'ar-EG') return message;
+    return message
+        .replace('Configuration must be a list of bindings.', 'الإعدادات لازم تكون قائمة روابط أزرار.')
+        .replace('Unknown or empty action.', 'الحركة مش معروفة أو فاضية.')
+        .replace('Input type must be KEY, MOUSE or WHEEL.', 'نوع الإدخال لازم يكون KEY أو MOUSE أو WHEEL.')
+        .replace(/(\w+) cannot use (\w+)\./gu, '$1 مينفعش يستخدم $2.')
+        .replace(/Unknown or empty (\w+) value\./gu, 'قيمة $1 مش معروفة أو فاضية.')
+        .replace('This SDL key name cannot be represented in the current INI comment syntax.', 'اسم الزرار ده مينفعش يتحفظ بالصيغة الحالية لملف INI.')
+        .replace(/duplicate (.+) will be omitted\./gu, 'الربط $1 متكرر وهيتحفظ مرة واحدة.')
+        .replace(' controls ', ' بيشغّل ')
+        .replaceAll(' (built-in)', ' (افتراضي)')
+        .replaceAll(' and ', ' و ')
+        .replace('Expected Action = TYPE:VALUE.', 'الصيغة المطلوبة: Action = TYPE:VALUE.')
+        .replace('Duplicate binding ignored.', 'الربط المتكرر تم تجاهله.')
+        .replace('This physical key cannot be captured in the current INI format. Select an SDL key from the list.', 'الزرار ده مينفعش يتسجل بالصيغة الحالية لملف INI. اختار زرار SDL من القائمة.')
+        .replace('Composition and dead keys are ambiguous. Select an SDL key from the list.', 'زرار تركيب الحروف مش واضح في التسجيل. اختار زرار SDL من القائمة.');
+}
+
+export function initialLocale(savedLocale) {
+    return locales.some(item => item.code === savedLocale) ? savedLocale : 'en';
+}
diff --git a/tools/input-mapper/index.html b/tools/input-mapper/index.html
new file mode 100644
index 0000000000..ee5a61c712
--- /dev/null
+++ b/tools/input-mapper/index.html
@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="color-scheme" content="dark">
+    <title>AnyPS5 · Input mapper</title>
+    <link rel="stylesheet" href="styles.css">
+    <script type="module" src="app.js"></script>
+</head>
+<body>
+    <div class="ambient" aria-hidden="true"><div class="ambient-glow"></div><div class="particles"></div><div class="particles distant"></div></div>
+    <a class="skip-link" href="#content" data-i18n="skip">Skip to content</a>
+    <header>
+        <a class="brand" href="https://github.com/boykopovar/AnyPS5">AnyPS5</a>
+        <nav class="system-nav" aria-label="Main navigation" data-i18n-label="mainNav"><a class="current" href="#controls" data-view="controls" data-i18n="controls">Controls</a><a href="#configuration" data-view="configuration" data-i18n="configuration">Configuration</a><a href="#help" data-view="help" data-i18n="help">Help</a></nav>
+        <div class="system-tools">
+            <button id="focus-search" class="icon-button" type="button" aria-label="Find an action" data-i18n-label="find"><span class="search-icon" aria-hidden="true"></span></button>
+            <button id="settings" class="icon-button" type="button" aria-label="Language" data-i18n-label="language"><span class="translation-icon" aria-hidden="true"><span>A</span><span>ع</span></span></button>
+            <time id="clock" aria-label="Local time" data-i18n-label="clock"></time>
+        </div>
+    </header>
+    <main id="content" tabindex="-1">
+        <nav id="categories" aria-label="Control groups" data-i18n-label="groups"></nav>
+        <div class="intro">
+            <p class="eyebrow" data-i18n="eyebrow">Accessories / Custom controls</p>
+            <h1 id="group-title">Face buttons</h1>
+            <p id="view-intro" data-i18n="intro">Choose a control, then assign your keyboard or mouse inputs.</p>
+        </div>
+        <div id="toolbar" class="toolbar">
+            <label class="search"><span class="sr-only" data-i18n="find">Find an action</span><input id="search" type="search" placeholder="Search controls" data-i18n-placeholder="search" autocomplete="off"></label>
+            <div class="tools">
+                <button id="import" type="button" data-i18n="import">Import INI</button>
+                <input id="file" type="file" accept=".ini,text/plain" hidden>
+                <button id="reset" type="button" data-i18n="reset">Reset</button>
+            </div>
+        </div>
+        <div id="mappings" tabindex="-1" aria-label="Controls" data-i18n-label="controls"></div>
+        <section id="configuration" class="configuration-panel" aria-label="Configuration output" data-i18n-label="output" tabindex="-1" hidden>
+                <div class="output-heading"><h2 data-i18n="configuration">Configuration</h2><span id="count" class="tag">0 / 27</span></div>
+                <label for="preview">anyps5-input.ini</label>
+                <textarea id="preview" readonly spellcheck="false" placeholder="Add a binding to begin." data-i18n-placeholder="previewEmpty" dir="ltr"></textarea>
+                <div class="export-actions">
+                    <button id="download" class="primary" type="button" data-i18n="download">Download INI</button>
+                    <button id="copy" type="button" data-i18n="copy">Copy configuration</button>
+                    <button id="back-controls" type="button" data-i18n="backControls">Back to controls</button>
+                </div>
+        </section>
+        <section id="help" tabindex="-1" aria-label="Help" data-i18n-label="help" hidden></section>
+        <div id="validation" aria-live="polite"></div>
+        <p id="status" role="status"></p>
+        <section id="import-report" hidden aria-label="Import diagnostics" tabindex="-1"></section>
+    </main>
+    <footer><span>© Amr Yasser</span><span class="navigation-hint"><kbd>←</kbd><kbd>→</kbd> <span data-i18n="switchGroup">Switch group</span><span class="footer-divider"></span><kbd>Tab</kbd> <span data-i18n="moveFocus">Move focus</span></span></footer>
+    <dialog id="capture-dialog" aria-labelledby="capture-title" aria-describedby="capture-help">
+        <h2 id="capture-title">Press a key</h2>
+        <p id="capture-help" data-i18n="captureHelp">Capture uses physical key positions. Escape cancels capture; choose Escape from the list to assign it. Some browser and system shortcuts require manual selection.</p>
+        <p id="capture-status" role="status"></p>
+        <button id="cancel-capture" type="button" data-i18n="cancelCapture" autofocus>Cancel capture</button>
+    </dialog>
+    <dialog id="replace-dialog" aria-labelledby="replace-title" aria-describedby="replace-help">
+        <h2 id="replace-title" data-i18n="replaceTitle">Discard unsaved changes?</h2>
+        <p id="replace-help" data-i18n="replaceHelp">Copy or download your configuration first if you want to keep it.</p>
+        <form method="dialog">
+            <button type="submit" value="cancel" data-i18n="keepEditing" autofocus>Keep editing</button>
+            <button type="submit" value="discard" data-i18n="discard">Discard changes</button>
+        </form>
+    </dialog>
+    <div id="language-control" hidden></div>
+    <dialog id="picker-dialog" aria-labelledby="picker-title">
+        <div class="picker-heading"><h2 id="picker-title"></h2><button id="picker-close" type="button">Close</button></div>
+        <input id="picker-search" type="search" autocomplete="off" spellcheck="false" dir="auto">
+        <div id="picker-options" role="listbox"></div>
+        <p id="picker-empty" class="hint" hidden></p>
+    </dialog>
+    <noscript>This configurator needs JavaScript enabled.</noscript>
+</body>
+</html>
diff --git a/tools/input-mapper/keys.js b/tools/input-mapper/keys.js
new file mode 100644
index 0000000000..5c44d49036
--- /dev/null
+++ b/tools/input-mapper/keys.js
@@ -0,0 +1,230 @@
+export const keyNames = [
+    "A",
+    "B",
+    "C",
+    "D",
+    "E",
+    "F",
+    "G",
+    "H",
+    "I",
+    "J",
+    "K",
+    "L",
+    "M",
+    "N",
+    "O",
+    "P",
+    "Q",
+    "R",
+    "S",
+    "T",
+    "U",
+    "V",
+    "W",
+    "X",
+    "Y",
+    "Z",
+    "1",
+    "2",
+    "3",
+    "4",
+    "5",
+    "6",
+    "7",
+    "8",
+    "9",
+    "0",
+    "Return",
+    "Escape",
+    "Backspace",
+    "Tab",
+    "Space",
+    "-",
+    "=",
+    "[",
+    "]",
+    "\\",
+    "#",
+    ";",
+    "'",
+    "`",
+    ",",
+    ".",
+    "/",
+    "CapsLock",
+    "F1",
+    "F2",
+    "F3",
+    "F4",
+    "F5",
+    "F6",
+    "F7",
+    "F8",
+    "F9",
+    "F10",
+    "F11",
+    "F12",
+    "PrintScreen",
+    "ScrollLock",
+    "Pause",
+    "Insert",
+    "Home",
+    "PageUp",
+    "Delete",
+    "End",
+    "PageDown",
+    "Right",
+    "Left",
+    "Down",
+    "Up",
+    "Numlock",
+    "Keypad /",
+    "Keypad *",
+    "Keypad -",
+    "Keypad +",
+    "Keypad Enter",
+    "Keypad 1",
+    "Keypad 2",
+    "Keypad 3",
+    "Keypad 4",
+    "Keypad 5",
+    "Keypad 6",
+    "Keypad 7",
+    "Keypad 8",
+    "Keypad 9",
+    "Keypad 0",
+    "Keypad .",
+    "Application",
+    "Power",
+    "Keypad =",
+    "F13",
+    "F14",
+    "F15",
+    "F16",
+    "F17",
+    "F18",
+    "F19",
+    "F20",
+    "F21",
+    "F22",
+    "F23",
+    "F24",
+    "Execute",
+    "Help",
+    "Menu",
+    "Select",
+    "Stop",
+    "Again",
+    "Undo",
+    "Cut",
+    "Copy",
+    "Paste",
+    "Find",
+    "Mute",
+    "VolumeUp",
+    "VolumeDown",
+    "Keypad ,",
+    "Keypad = (AS400)",
+    "AltErase",
+    "SysReq",
+    "Cancel",
+    "Clear",
+    "Prior",
+    "Separator",
+    "Out",
+    "Oper",
+    "Clear / Again",
+    "CrSel",
+    "ExSel",
+    "Keypad 00",
+    "Keypad 000",
+    "ThousandsSeparator",
+    "DecimalSeparator",
+    "CurrencyUnit",
+    "CurrencySubUnit",
+    "Keypad (",
+    "Keypad )",
+    "Keypad {",
+    "Keypad }",
+    "Keypad Tab",
+    "Keypad Backspace",
+    "Keypad A",
+    "Keypad B",
+    "Keypad C",
+    "Keypad D",
+    "Keypad E",
+    "Keypad F",
+    "Keypad XOR",
+    "Keypad ^",
+    "Keypad %",
+    "Keypad <",
+    "Keypad >",
+    "Keypad &",
+    "Keypad &&",
+    "Keypad |",
+    "Keypad ||",
+    "Keypad :",
+    "Keypad #",
+    "Keypad Space",
+    "Keypad @",
+    "Keypad !",
+    "Keypad MemStore",
+    "Keypad MemRecall",
+    "Keypad MemClear",
+    "Keypad MemAdd",
+    "Keypad MemSubtract",
+    "Keypad MemMultiply",
+    "Keypad MemDivide",
+    "Keypad +/-",
+    "Keypad Clear",
+    "Keypad ClearEntry",
+    "Keypad Binary",
+    "Keypad Octal",
+    "Keypad Decimal",
+    "Keypad Hexadecimal",
+    "Left Ctrl",
+    "Left Shift",
+    "Left Alt",
+    "Left GUI",
+    "Right Ctrl",
+    "Right Shift",
+    "Right Alt",
+    "Right GUI",
+    "ModeSwitch",
+    "AudioNext",
+    "AudioPrev",
+    "AudioStop",
+    "AudioPlay",
+    "AudioMute",
+    "MediaSelect",
+    "WWW",
+    "Mail",
+    "Calculator",
+    "Computer",
+    "AC Search",
+    "AC Home",
+    "AC Back",
+    "AC Forward",
+    "AC Stop",
+    "AC Refresh",
+    "AC Bookmarks",
+    "BrightnessDown",
+    "BrightnessUp",
+    "DisplaySwitch",
+    "KBDIllumToggle",
+    "KBDIllumDown",
+    "KBDIllumUp",
+    "Eject",
+    "Sleep",
+    "App1",
+    "App2",
+    "AudioRewind",
+    "AudioFastForward",
+    "SoftLeft",
+    "SoftRight",
+    "Call",
+    "EndCall"
+];
+
+export const exportableKeys = keyNames.filter(name => !/[#;]/u.test(name));
diff --git a/tools/input-mapper/mapping.js b/tools/input-mapper/mapping.js
new file mode 100644
index 0000000000..9d29df0382
--- /dev/null
+++ b/tools/input-mapper/mapping.js
@@ -0,0 +1,34 @@
+export const groups = [
+    {name: 'Face buttons', actions: ['Cross', 'Circle', 'Triangle', 'Square']},
+    {name: 'Shoulders, triggers and stick clicks', actions: ['L1', 'R1', 'L2', 'R2', 'L3', 'R3']},
+    {name: 'Directional controls', actions: ['Up', 'Right', 'Down', 'Left']},
+    {name: 'Left analog stick', actions: ['LeftStickLeft', 'LeftStickRight', 'LeftStickUp', 'LeftStickDown']},
+    {name: 'Right analog stick', actions: ['RightStickLeft', 'RightStickRight', 'RightStickUp', 'RightStickDown']},
+    {name: 'Touch and utility', actions: ['Options', 'TouchLeft', 'TouchRight', 'ToggleMouse', 'ToggleFullscreen']}
+];
+
+export const actions = groups.flatMap(group => group.actions);
+export const padButtons = new Set(['Cross', 'Circle', 'Triangle', 'Square', 'L1', 'R1', 'L2', 'R2', 'L3', 'R3', 'Options', 'Up', 'Right', 'Down', 'Left']);
+export const mouseValues = ['Left', 'Middle', 'Right', 'X1', 'X2'];
+export const wheelValues = ['Up', 'Down'];
+
+export const defaults = {
+    Cross: ['KEY:Return', 'KEY:Space'], Circle: ['KEY:C'], Triangle: ['KEY:I'], Square: ['MOUSE:Left'],
+    L1: ['KEY:Q'], R1: ['KEY:E', 'KEY:Left Alt', 'KEY:Right Alt'], L2: [], R2: ['MOUSE:Right'],
+    L3: ['KEY:Left Shift', 'KEY:Right Shift'], R3: ['KEY:Left Ctrl', 'KEY:Right Ctrl'], Options: ['KEY:Escape'],
+    Up: ['KEY:Up', 'WHEEL:Up'], Right: ['KEY:Right'], Down: ['KEY:Down', 'WHEEL:Down'], Left: ['KEY:Left'],
+    LeftStickLeft: ['KEY:A'], LeftStickRight: ['KEY:D'], LeftStickUp: ['KEY:W'], LeftStickDown: ['KEY:S'],
+    RightStickLeft: ['KEY:F'], RightStickRight: ['KEY:H'], RightStickUp: ['KEY:T'], RightStickDown: ['KEY:G'],
+    TouchLeft: ['KEY:Backspace'], TouchRight: ['KEY:Tab'], ToggleMouse: ['MOUSE:Middle'], ToggleFullscreen: ['KEY:F11']
+};
+
+export function typesForAction(action) {
+    if (!actions.includes(action)) return [];
+    if (action === 'ToggleFullscreen') return ['KEY'];
+    return padButtons.has(action) ? ['KEY', 'MOUSE', 'WHEEL'] : ['KEY', 'MOUSE'];
+}
+
+export function canonicalValue(value, choices) {
+    if (typeof value !== 'string') return undefined;
+    return choices.find(choice => choice.toUpperCase() === value.trim().toUpperCase());
+}
diff --git a/tools/input-mapper/package.json b/tools/input-mapper/package.json
new file mode 100644
index 0000000000..064ea01892
--- /dev/null
+++ b/tools/input-mapper/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "anyps5-input-mapper",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Browser-based keyboard and mouse input configurator for AnyPS5",
+  "type": "module",
+  "license": "GPL-2.0",
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "start": "node serve.js",
+    "test": "node --test tests/*.test.js"
+  }
+}
diff --git a/tools/input-mapper/serve.js b/tools/input-mapper/serve.js
new file mode 100644
index 0000000000..ccdb20e26c
--- /dev/null
+++ b/tools/input-mapper/serve.js
@@ -0,0 +1,30 @@
+import {createServer} from 'node:http';
+import {readFile} from 'node:fs/promises';
+
+const files = new Set(['index.html', 'styles.css', 'app.js', 'mapping.js', 'keys.js', 'capture.js', 'validation.js', 'i18n.js', 'dropdown.js']);
+const mime = {html: 'text/html', css: 'text/css', js: 'text/javascript'};
+const port = Number(process.env.PORT || 4173);
+const server = createServer(async (request, response) => {
+    const path = new URL(request.url, 'http://127.0.0.1').pathname;
+    const file = path === '/' ? 'index.html' : path.slice(1);
+    if (!['GET', 'HEAD'].includes(request.method)) {
+        response.writeHead(405, {Allow: 'GET, HEAD'}).end();
+        return;
+    }
+    if (!files.has(file)) {
+        response.writeHead(404).end('Not found');
+        return;
+    }
+    try {
+        const content = await readFile(new URL(file, import.meta.url));
+        response.writeHead(200, {'Content-Type': `${mime[file.split('.').pop()]}; charset=utf-8`, 'Cache-Control': 'no-store'});
+        response.end(request.method === 'HEAD' ? undefined : content);
+    } catch {
+        response.writeHead(500).end('Cannot read static file');
+    }
+});
+server.on('error', error => {
+    console.error(error.message);
+    process.exitCode = 1;
+});
+server.listen(port, '127.0.0.1', () => console.log(`Input mapper: http://127.0.0.1:${port}`));
diff --git a/tools/input-mapper/styles.css b/tools/input-mapper/styles.css
new file mode 100644
index 0000000000..1be7b42096
--- /dev/null
+++ b/tools/input-mapper/styles.css
@@ -0,0 +1,203 @@
+:root { color-scheme: dark; font-family: "Segoe UI", Helvetica, Arial, sans-serif; font-weight: 400; color: #f4f5f7; background: #101116; --muted: #c1c4ce; --line: #ffffff1c; --ease: cubic-bezier(.2,.75,.25,1); }
+* { box-sizing: border-box; }
+* { scrollbar-width: thin; scrollbar-color: #dbe0ea70 transparent; }
+::-webkit-scrollbar { width: 4px; height: 4px; }
+::-webkit-scrollbar-track { background: transparent; }
+::-webkit-scrollbar-thumb { background: #dbe0ea70; border-radius: 20px; }
+::-webkit-scrollbar-thumb:hover { background: #eef1f8c0; }
+::-webkit-scrollbar-button { display: none; width: 0; height: 0; }
+::-webkit-scrollbar-corner { background: transparent; }
+@supports selector(::-webkit-scrollbar) { * { scrollbar-width: auto; scrollbar-color: auto; } }
+[hidden] { display: none !important; }
+html { scroll-behavior: smooth; scroll-padding-top: 30px; }
+body { margin: 0; min-height: 100vh; isolation: isolate; }
+a { color: inherit; }
+button, input, select, textarea { font: inherit; }
+button, input, select { min-height: 42px; border: 1px solid #ffffff24; border-radius: 4px; color: inherit; background: #ffffff09; padding: 9px 14px; transition: color .2s, background .2s, border-color .2s, box-shadow .25s, transform .25s var(--ease); }
+button { cursor: pointer; font-weight: 400; }
+button:hover:not(:disabled) { background: #ffffff16; border-color: #ffffff70; }
+button:active:not(:disabled) { transform: scale(.97); }
+button:disabled { cursor: not-allowed; opacity: .42; }
+:focus-visible { outline: none; box-shadow: inset 0 -2px 0 #7d9ac9; }
+button:focus-visible:not(:disabled) { background: #31415b80; }
+input:focus-visible, textarea:focus-visible { border-color: #788da9; }
+select option { color: #f4f5f7; background: #22232a; }
+.ambient { position: fixed; inset: 0; z-index: -1; overflow: hidden; pointer-events: none; background: radial-gradient(ellipse at 80% 100%, #16385278, transparent 65%), radial-gradient(ellipse at 20% 18%, #4c484b50, transparent 60%), linear-gradient(140deg, #18191e, #101116 50%, #111820); }
+.ambient-glow { position: absolute; width: 110%; height: 75%; top: -45%; left: -20%; border-radius: 50%; background: radial-gradient(ellipse, #c9b99a33, #b3bfd614 38%, transparent 68%); filter: blur(36px); animation: atmosphere 24s ease-in-out infinite alternate; }
+.particles { position: absolute; inset: -12%; opacity: .7; background-image: radial-gradient(circle at 12% 29%, #e3d5b5d0 0 1px, transparent 2px), radial-gradient(circle at 32% 68%, #e0d5b9a0 0 1px, transparent 3px), radial-gradient(circle at 68% 23%, #e8d8b6b0 0 1px, transparent 3px), radial-gradient(circle at 88% 59%, #f4ead2a0 0 1px, transparent 2px), radial-gradient(circle at 54% 48%, #a2bfda90 0 1px, transparent 2px), radial-gradient(circle at 76% 78%, #ebd9ada0 0 1px, transparent 3px); background-size: 410px 370px, 590px 530px, 670px 490px, 710px 630px, 830px 730px, 970px 810px; animation: particles 38s linear infinite alternate; }
+.particles.distant { opacity: .25; filter: blur(1px); animation-duration: 58s; animation-direction: alternate-reverse; }
+header { max-width: 1640px; margin: auto; display: flex; align-items: center; gap: 42px; padding: 34px 5.5%; }
+.brand { font-size: 20px; text-decoration: none; font-weight: 300; letter-spacing: -.5px; }
+.system-nav { display: flex; gap: 32px; }
+.system-nav a { text-decoration: none; font-size: 23px; font-weight: 300; color: #b8bac1; transition: color .2s; }
+.system-nav .current, .system-nav a:hover { color: white; }
+.system-tools { display: flex; align-items: center; gap: 24px; margin-inline-start: auto; }
+.icon-button { display: grid; place-items: center; width: 38px; min-height: 38px; border: 0; border-radius: 50%; padding: 0; background: transparent; text-decoration: none; font-size: 26px; }
+.search-icon { width: 15px; height: 15px; border: 2px solid currentColor; border-radius: 50%; position: relative; }
+.search-icon::after { content: ''; position: absolute; height: 7px; width: 2px; background: currentColor; right: -4px; bottom: -5px; transform: rotate(-45deg); }
+.translation-icon { display: flex; align-items: center; gap: 2px; direction: ltr; font-size: 18px; line-height: 1; }
+.translation-icon span { display: grid; place-items: center; width: 21px; height: 23px; border: 1px solid #aab7cb70; border-radius: 4px; }
+.translation-icon span:last-child { margin-left: -7px; margin-top: 11px; background: #252a34; }
+#clock { font-size: 22px; font-weight: 300; min-width: 58px; font-variant-numeric: tabular-nums; white-space: nowrap; }
+main { max-width: 1440px; min-height: calc(100vh - 210px); margin: auto; padding: 6px 5% 35px; }
+main:focus { outline: none; box-shadow: none; }
+#categories { display: flex; align-items: flex-start; gap: 20px; padding: 16px 8px 22px; margin-inline-start: -8px; min-height: 155px; overflow-x: auto; }
+.category { background: transparent; border: 0; padding: 0; width: 108px; flex: 0 0 108px; text-align: center; }
+.category:hover:not(:disabled), .category:focus-visible:not(:disabled) { background: transparent; color: white; }
+.category:focus-visible { outline: none; box-shadow: none; }
+.category-icon { display: grid; place-items: center; height: 92px; width: 92px; margin: 0 auto 13px; border-radius: 16px; border: 1px solid #ffffff24; background: linear-gradient(145deg, #565860a0, #272b33c0); color: #eeeeef; box-shadow: 0 8px 20px #0002; transition: transform .3s var(--ease), box-shadow .3s, background .3s; }
+.category[aria-pressed="true"] .category-icon, .category:focus-visible .category-icon { transform: scale(1.06); background: linear-gradient(145deg, #6a778db0, #354359c0); border-color: #91a4c366; box-shadow: 0 12px 30px #0004; }
+.category:hover .category-icon { transform: translateY(-3px); }
+.category[aria-pressed="true"]:hover .category-icon { transform: scale(1.06) translateY(-2px); }
+.category-label { display: block; font-size: 12px; color: #babdc6; line-height: 1.4; }
+.category[aria-pressed="true"] .category-label { color: white; }
+.face-icon { position: relative; width: 60px; height: 60px; font-size: 24px; line-height: 1; font-weight: 300; }
+.face-icon span { position: absolute; display: grid; place-items: center; width: 24px; height: 24px; }
+.face-icon span:nth-child(1) { top: 0; left: 18px; }
+.face-icon span:nth-child(2) { right: 0; top: 18px; }
+.face-icon span:nth-child(3) { bottom: 0; left: 18px; }
+.face-icon span:nth-child(4) { left: 0; top: 18px; }
+.shoulder-icon { border: 2px solid currentColor; border-radius: 6px 6px 13px 13px; padding: 7px 10px; font-size: 17px; }
+.direction-icon { position: relative; width: 42px; height: 42px; background: currentColor; clip-path: polygon(34% 0,66% 0,66% 34%,100% 34%,100% 66%,66% 66%,66% 100%,34% 100%,34% 66%,0 66%,0 34%,34% 34%); }
+.stick-icon { display: grid; place-items: center; border: 2px solid currentColor; border-radius: 50%; width: 43px; height: 43px; font-size: 18px; box-shadow: 0 4px 0 1px #ffffff45; }
+.touch-icon { width: 50px; height: 33px; border: 2px solid currentColor; border-radius: 7px; background: radial-gradient(circle, #ffffff60 1px, transparent 1.5px) 0 0 / 7px 7px; }
+.intro { margin: 8px 0 26px; animation: enter .6s var(--ease) both; }
+.eyebrow { color: #b9bbc2; font-size: 13px; margin: 0 0 13px; }
+h1 { font-size: clamp(34px, 4vw, 48px); font-weight: 300; letter-spacing: -.9px; line-height: 1.15; margin: 0; }
+.intro > p:last-child { color: var(--muted); font-size: 15px; margin: 13px 0 0; }
+.toolbar, .tools, .output-heading { display: flex; gap: 12px; align-items: center; }
+.toolbar { justify-content: space-between; margin-bottom: 22px; }
+.search { width: min(350px, 55%); }
+.search input { width: 100%; border-radius: 30px; padding: 10px 20px; background: #ffffff08; }
+input::placeholder { color: #b6b9c4; }
+.tools button { border-radius: 30px; padding: 9px 22px; }
+.group, .configuration-panel, .faq { background: #181a22b0; border: 1px solid var(--line); border-radius: 6px; backdrop-filter: blur(20px); box-shadow: 0 18px 45px #0002; }
+.group { margin-bottom: 20px; animation: enter .35s var(--ease); }
+.group h2 { font-size: 12px; font-weight: 400; color: #bdc2ce; margin: 0; padding: 18px 24px; border-bottom: 1px solid var(--line); }
+.action { padding: 19px 24px; border-bottom: 1px solid #ffffff10; transition: background .25s; }
+.action:last-child { border-bottom: 0; }
+.action:hover { background: #ffffff06; }
+.action:focus-within { background: #ffffff0c; }
+.action-heading { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.action-title { display: flex; align-items: center; gap: 15px; }
+.action-symbol { display: grid; place-items: center; width: 30px; height: 30px; font-size: 29px; line-height: 1; font-weight: 300; color: #eaedf5; }
+.action h3 { margin: 0; font-size: 18px; font-weight: 300; }
+.action-heading button { border: 0; min-height: 34px; font-size: 12px; border-radius: 30px; padding: 7px 14px; background: #ffffff0a; }
+.hint { font-size: 12px; color: var(--muted); line-height: 1.65; overflow-wrap: anywhere; }
+.action > .hint { margin: 7px 0 0; margin-inline-start: 45px; }
+.binding { display: grid; grid-template-columns: 110px minmax(0, 1fr) auto auto; gap: 10px; margin-top: 17px; animation: enter .25s var(--ease); }
+.dropdown { min-width: 0; }
+.dropdown-trigger { display: flex; align-items: center; gap: 10px; width: 100%; min-height: 44px; padding: 10px 13px; font-size: 13px; text-align: start; border-radius: 9px; background: #0e131e66; }
+.dropdown-trigger::after { content: ''; width: 6px; height: 6px; flex-shrink: 0; border-right: 1.5px solid #a7b2c5; border-bottom: 1.5px solid #a7b2c5; transform: rotate(45deg); margin-inline-start: auto; margin-top: -4px; }
+.dropdown-value { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.dropdown-trigger[aria-expanded="true"] { background: #27344999; border-color: #677c9a; }
+.binding button { font-size: 12px; padding: 8px 11px; }
+[aria-invalid="true"] { border-color: #ff9a9a; }
+.configuration-panel { padding: 32px; max-width: 960px; margin: auto; animation: enter .35s var(--ease); }
+.output-heading { justify-content: space-between; }
+.output-heading h2 { font-size: 22px; font-weight: 300; margin: 0; }
+.tag { font-size: 11px; color: #b6bcc9; white-space: nowrap; }
+.configuration-panel label { display: block; margin: 20px 0 10px; color: #d0d3db; font-size: 12px; direction: ltr; }
+textarea { width: 100%; height: 340px; resize: vertical; padding: 18px; border: 1px solid #ffffff18; border-radius: 4px; background: #090b1290; color: #edf0f8; font: 14px/1.9 Consolas, ui-monospace, monospace; text-align: left; }
+.export-actions { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 14px; margin-top: 20px; }
+.export-actions button { border-radius: 30px; }
+.primary { background: #f0f1f5; color: #171920; border-color: #f0f1f5; }
+.primary:hover:not(:disabled), .primary:focus-visible:not(:disabled) { background: #d8e0ee; color: #171920; box-shadow: none; }
+.error { color: #ffb5b5; }
+.warning { color: #e8cf9b; }
+#validation { font-size: 12px; line-height: 1.6; }
+#validation ul { padding-inline-start: 18px; }
+#count { direction: ltr; unicode-bidi: isolate; }
+#help { max-width: 960px; margin: auto; }
+.faq { margin-bottom: 14px; }
+.faq summary { cursor: pointer; padding: 22px 26px; font-size: 18px; font-weight: 300; }
+.faq[open] summary { border-bottom: 1px solid var(--line); }
+.faq p { padding: 0 26px 12px; color: var(--muted); line-height: 1.9; }
+#picker-dialog { position: fixed; inset: auto; margin: 0; padding: 18px; border: 1px solid #70809c45; border-radius: 16px; background: linear-gradient(145deg, #242a36fa, #131a27fc); max-width: calc(100% - 32px); height: min(var(--picker-height, 480px), calc(100dvh - 32px)); max-height: calc(100dvh - 32px); box-shadow: 0 24px 80px #0008; }
+#picker-dialog[open] { display: grid; grid-template-rows: auto auto minmax(0, 1fr); gap: 14px; }
+#picker-dialog::backdrop { background: #080b1540; backdrop-filter: blur(3px); }
+.picker-heading { display: flex; gap: 12px; align-items: center; justify-content: space-between; min-width: 0; }
+.picker-heading h2 { font-size: 17px; line-height: 1.5; overflow-wrap: anywhere; }
+.picker-heading button { min-height: 36px; margin: 0; padding: 6px 12px; border: 0; background: #ffffff08; font-size: 12px; flex-shrink: 0; }
+#picker-search { width: 100%; min-width: 0; border-radius: 10px; padding: 11px 14px; font-size: 16px; }
+#picker-options { min-height: 0; overflow-y: auto; overscroll-behavior: contain; padding: 2px 3px; }
+.picker-option { display: block; width: 100%; min-height: 44px; margin: 0 0 3px; border: 0; border-radius: 8px; padding: 12px 14px; background: transparent; text-align: start; font-size: 14px; line-height: 1.5; overflow-wrap: anywhere; }
+.picker-option[aria-selected="true"] { background: #3547629c; color: #e4edff; }
+.picker-option:focus-visible { background: #3b506fa6; box-shadow: none; }
+#picker-empty { position: absolute; top: 160px; inset-inline: 18px; text-align: center; }
+html[dir="rtl"] h1 { letter-spacing: 0; }
+html[dir="rtl"] .intro > p:last-child { line-height: 1.9; }
+html[dir="rtl"] .brand, footer > span:first-child { direction: ltr; unicode-bidi: isolate; }
+#status { color: #dae3f6; font-size: 13px; line-height: 1.6; }
+#import-report { margin-top: 22px; padding: 24px; border: 1px solid var(--line); background: #171b25c0; border-radius: 6px; overflow-wrap: anywhere; }
+#import-report h2 { font-size: 23px; font-weight: 300; }
+dialog { width: min(520px, calc(100% - 32px)); max-height: calc(100dvh - 32px); overflow-y: auto; color: inherit; background: linear-gradient(140deg, #30323bef, #181d28f5); border: 1px solid #ffffff3c; border-radius: 6px; padding: 32px; box-shadow: 0 20px 100px #0008; }
+dialog[open] { animation: dialog-enter .3s var(--ease); }
+dialog h2 { font-size: 28px; font-weight: 300; margin: 0; }
+dialog p { line-height: 1.7; font-size: 14px; color: var(--muted); }
+dialog button { border-radius: 30px; margin-top: 12px; }
+dialog form { display: flex; gap: 12px; flex-wrap: wrap; }
+dialog::backdrop { background: #080b15a0; backdrop-filter: blur(12px); }
+footer { display: flex; justify-content: space-between; align-items: center; gap: 18px; padding: 20px 5.5% 30px; max-width: 1640px; margin: auto; color: #b1b6c2; font-size: 12px; }
+.navigation-hint { display: flex; gap: 7px; align-items: center; }
+kbd { border: 1px solid #ffffff50; border-radius: 4px; padding: 1px 5px; font: inherit; color: #e3e5eb; }
+.footer-divider { width: 1px; height: 12px; background: #ffffff30; margin: 0 8px; }
+.skip-link { position: fixed; top: -80px; left: 16px; padding: 12px; z-index: 2; background: #242836; }
+.skip-link:focus { top: 12px; }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip-path: inset(50%); white-space: nowrap; border: 0; }
+@keyframes atmosphere { to { transform: translate(15%, 20%) scale(1.15); opacity: .7; } }
+@keyframes particles { from { transform: translate3d(0, 0, 0); } to { transform: translate3d(-35px, -65px, 0); } }
+@keyframes enter { from { opacity: 0; transform: translateY(10px); } to { opacity: 1; transform: translateY(0); } }
+@keyframes dialog-enter { from { opacity: 0; transform: translateY(16px) scale(.98); } to { opacity: 1; transform: translateY(0) scale(1); } }
+@media (max-width: 1100px) { header { gap: 26px; } #categories { gap: 14px; } .category { width: 96px; flex-basis: 96px; } .category-icon { width: 82px; height: 82px; } }
+@media (max-width: 760px) {
+    header { display: grid; grid-template-columns: 1fr auto; gap: 18px 12px; padding: 22px 5% 14px; }
+    .brand { font-size: 18px; }
+    .system-tools { margin: 0; gap: 12px; }
+    .system-nav { grid-column: 1 / -1; grid-row: 2; display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 3px; background: #ffffff04; border-radius: 12px; padding: 4px; }
+    .system-nav a { min-width: 0; padding: 10px 6px; font-size: clamp(12px, 3.7vw, 16px); text-align: center; border-radius: 8px; overflow-wrap: anywhere; }
+    .system-nav .current { background: #3b4b6233; }
+    #clock { font-size: 15px; }
+    main { min-height: calc(100vh - 225px); padding-inline: 5%; }
+    #categories { gap: 10px; padding: 12px 8px 16px; min-height: 119px; scroll-snap-type: x proximity; }
+    .category { flex-basis: 80px; width: 80px; scroll-snap-align: center; }
+    .category-icon { width: 66px; height: 66px; border-radius: 13px; margin-bottom: 10px; }
+    .category-label { font-size: 10px; min-height: 28px; }
+    .face-icon { transform: scale(.8); }
+    .intro { margin: 9px 0 22px; }
+    h1 { font-size: clamp(28px, 7.5vw, 36px); }
+    .intro > p:last-child { font-size: 13px; line-height: 1.7; }
+    .eyebrow { font-size: 11px; margin-bottom: 10px; }
+    .toolbar { flex-wrap: wrap; gap: 10px; }
+    .search, .tools { width: 100%; }
+    .search input { font-size: 16px; min-height: 44px; }
+    .tools button { flex: 1; min-height: 44px; padding: 10px 14px; font-size: 13px; }
+    .group h2 { padding: 15px 16px; font-size: 11px; }
+    .action { padding: 17px 16px; }
+    .action-heading { flex-wrap: wrap; gap: 10px; }
+    .action-title { gap: 10px; min-width: 0; flex: 1 1 140px; }
+    .action h3 { font-size: 16px; overflow-wrap: anywhere; }
+    .action-heading button { min-height: 38px; max-width: 100%; }
+    .action-symbol { width: 25px; flex-shrink: 0; }
+    .action > .hint { margin-inline-start: 0; font-size: 11px; }
+    .binding { grid-template-columns: 104px minmax(0, 1fr); gap: 10px; margin-top: 14px; }
+    .binding > button { min-height: 44px; border-radius: 9px; }
+    .dropdown-trigger { font-size: 14px; }
+    .configuration-panel { padding: 18px; }
+    textarea { height: clamp(220px, 40dvh, 340px); font-size: 13px; }
+    .export-actions { grid-template-columns: 1fr; gap: 10px; }
+    .export-actions button { min-height: 44px; }
+    .faq summary { padding: 18px; font-size: 16px; }
+    .faq p { padding-inline: 18px; font-size: 14px; }
+    dialog { padding: 22px; border-radius: 16px; }
+    dialog h2 { font-size: 23px; }
+    footer { justify-content: center; padding-block: 22px; }
+    .navigation-hint { display: none; }
+}
+@media (max-width: 600px) {
+    #picker-dialog { inset-inline: 8px; top: auto; bottom: 8px; width: calc(100% - 16px); max-width: calc(100% - 16px); height: min(var(--picker-height, 480px), 76dvh); max-height: calc(100dvh - 16px); padding: 18px 16px calc(16px + env(safe-area-inset-bottom)); border-radius: 22px; }
+    #picker-dialog::backdrop { background: #05081080; backdrop-filter: blur(7px); }
+    .picker-option { min-height: 46px; font-size: 15px; }
+}
+@media (max-width: 360px) { #clock { display: none; } .system-tools { gap: 16px; } .binding { grid-template-columns: 94px minmax(0, 1fr); } .action-title { flex-basis: 120px; } }
+@media (prefers-reduced-motion: reduce) { html { scroll-behavior: auto; } *, *::before, *::after { animation: none !important; transition: none !important; } }
diff --git a/tools/input-mapper/tests/i18n.test.js b/tools/input-mapper/tests/i18n.test.js
new file mode 100644
index 0000000000..65d98f0140
--- /dev/null
+++ b/tools/input-mapper/tests/i18n.test.js
@@ -0,0 +1,39 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {diagnostic, initialLocale, locales, messages, translate} from '../i18n.js';
+import {parseIni, serialize} from '../validation.js';
+
+test('every selectable language supplies the main interface and every FAQ', () => {
+    assert.equal(locales[0].code, 'ar-EG');
+    assert.equal(new Set(locales.map(item => item.code)).size, locales.length);
+    const required = ['controls', 'configuration', 'help', 'settings', 'language', 'close', 'intro', 'search', 'import', 'reset', 'select', 'add', 'capture', 'remove', 'download', 'copy', 'backControls', 'helpIntro', 'configIntro'];
+    for (let index = 0; index < 6; index++) required.push(`group${index}`);
+    for (let index = 0; index < 4; index++) required.push(`faq${index}Question`, `faq${index}Answer`);
+    for (const locale of locales) {
+        assert.doesNotThrow(() => new Intl.DateTimeFormat(locale.code));
+        assert.equal(locale.direction, ['ar-EG', 'ur', 'fa'].includes(locale.code) ? 'rtl' : 'ltr');
+        for (const key of required) assert.ok(messages[locale.code][key], `${locale.code}: ${key}`);
+    }
+});
+
+test('first visits use English while valid saved language preferences are retained', () => {
+    for (const saved of [undefined, null, '', 'unsupported']) assert.equal(initialLocale(saved), 'en');
+    for (const locale of locales) assert.equal(initialLocale(locale.code), locale.code);
+});
+
+test('language substitution preserves canonical inputs and exported INI bytes', () => {
+    const source = 'Cross = KEY:F\nCross = KEY:Space\nToggleMouse = MOUSE:X1\n';
+    const entries = parseIni(source).entries;
+    for (const locale of locales) {
+        assert.ok(translate(locale.code, 'builtin', {inputs: 'KEY:F, KEY:Space'}).includes('KEY:F, KEY:Space'));
+        assert.equal(serialize(entries), source);
+    }
+    assert.equal(translate('ar-EG', 'captured', {value: 'F', action: 'Cross'}), 'تم تسجيل F لـ Cross.');
+    assert.equal(translate('unsupported', 'help'), 'Help');
+});
+
+test('Egyptian diagnostics retain action tokens and unknown technical details', () => {
+    assert.equal(diagnostic('ar-EG', 'Cross: Unknown or empty KEY value.'), 'Cross: قيمة KEY مش معروفة أو فاضية.');
+    assert.equal(diagnostic('ar-EG', 'Unexpected diagnostic'), 'Unexpected diagnostic');
+    assert.equal(diagnostic('fr', 'Cross: Unknown or empty KEY value.'), 'Cross: Unknown or empty KEY value.');
+});
diff --git a/tools/input-mapper/tests/mapping.test.js b/tools/input-mapper/tests/mapping.test.js
new file mode 100644
index 0000000000..6554c52a9e
--- /dev/null
+++ b/tools/input-mapper/tests/mapping.test.js
@@ -0,0 +1,132 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFileSync} from 'node:fs';
+import {actions, defaults, mouseValues, padButtons, typesForAction} from '../mapping.js';
+import {exportableKeys, keyNames} from '../keys.js';
+import {captureKey} from '../capture.js';
+import {parseIni, serialize, validate} from '../validation.js';
+
+const binding = (action, type = 'KEY', value = 'F') => ({action, type, value});
+
+test('action names and pad button categories agree with the current native parser', () => {
+    const source = readFileSync(new URL('../../../core/libs/prx/libSceVideoOut/src/InputMapping.cpp', import.meta.url), 'utf8');
+    const definitions = [...source.matchAll(/InputAction\{"(\w+)", Pad::InputControl::(\w+),/gu)];
+    assert.deepEqual([...actions].sort(), definitions.map(match => match[1]).sort());
+    assert.deepEqual([...padButtons].sort(), definitions.filter(match => match[2] === 'Button').map(match => match[1]).sort());
+    assert.match(source, /SDL_GetScancodeFromName\(keyName\.c_str\(\)\)/u);
+    assert.match(source, /if \(action\.control == Pad::InputControl::ToggleFullscreen\)/u);
+    assert.match(source, /if \(action\.control != Pad::InputControl::Button\)/u);
+});
+
+test('built-in conflict catalogue agrees with the current native bindings', () => {
+    const source = readFileSync(new URL('../../../core/libs/prx/libScePad/include/InputMapping.hpp', import.meta.url), 'utf8');
+    const special = {RETURN: 'Return', SPACE: 'Space', ESCAPE: 'Escape', BACKSPACE: 'Backspace', TAB: 'Tab', UP: 'Up', RIGHT: 'Right', DOWN: 'Down', LEFT: 'Left', LALT: 'Left Alt', RALT: 'Right Alt', LSHIFT: 'Left Shift', RSHIFT: 'Right Shift', LCTRL: 'Left Ctrl', RCTRL: 'Right Ctrl'};
+    const native = Object.fromEntries(actions.map(action => [action, []]));
+    for (const match of source.matchAll(/InputBinding\{SDL_SCANCODE_(\w+), MouseButton::(\w+), InputControl::(\w+)(?:, PadButton::(\w+))?(?:, (-?\d+))?\}/gu)) {
+        const [, key, mouse, control, button, wheel] = match;
+        const action = control === 'Button' ? button : control;
+        const value = key !== 'UNKNOWN' ? `KEY:${special[key] || key}` : mouse !== 'None' ? `MOUSE:${mouse}` : `WHEEL:${wheel === '1' ? 'Up' : 'Down'}`;
+        native[action].push(value);
+    }
+    assert.deepEqual(native, defaults);
+});
+
+test('every action serializes with a supported key', () => {
+    const input = actions.map(action => binding(action));
+    assert.equal(serialize(input), actions.map(action => `${action} = KEY:F\n`).join(''));
+});
+
+test('multiple inputs are alternatives and omitted actions stay omitted', () => {
+    assert.equal(serialize([binding('Cross'), binding('Cross', 'KEY', 'Space')]), 'Cross = KEY:F\nCross = KEY:Space\n');
+    assert.equal(serialize([]), '');
+    assert.equal(serialize([binding('R2', 'MOUSE', 'Right')]), 'R2 = MOUSE:Right\n');
+});
+
+test('case and whitespace normalize; duplicate bindings warn and serialize once', () => {
+    const input = [binding(' cross ', ' key ', ' f '), binding('Cross')];
+    assert.equal(serialize(input), 'Cross = KEY:F\n');
+    assert.equal(validate(input).warnings.filter(warning => warning.message.includes('duplicate')).length, 1);
+});
+
+test('invalid and incomplete bindings block export', () => {
+    for (const input of [binding('Unknown'), binding('Cross', 'GAMEPAD'), binding('Cross', 'KEY', 'Enter'), binding('Cross', 'KEY', 'KeyF'), binding('Cross', 'KEY', ''), binding('Cross', 'KEY', 'F\nR2 = MOUSE:Left'), null, {}]) {
+        assert.ok(validate([input]).errors.length);
+        assert.throws(() => serialize([input]));
+    }
+    assert.ok(validate({}).errors.length);
+});
+
+test('all exportable SDL names validate and unsafe comment names are rejected', () => {
+    for (const key of exportableKeys) assert.equal(validate([binding('Cross', 'KEY', key)]).errors.length, 0, key);
+    for (const key of [';', '#', 'Keypad #']) assert.ok(validate([binding('Cross', 'KEY', key)]).errors.length, key);
+    assert.equal(new Set(keyNames).size, keyNames.length);
+});
+
+test('mouse values and action restrictions match the current INI format', () => {
+    for (const action of actions) {
+        for (const value of mouseValues) {
+            assert.equal(validate([binding(action, 'MOUSE', value)]).errors.length === 0, action !== 'ToggleFullscreen');
+        }
+    }
+    assert.ok(validate([binding('Cross', 'MOUSE', 'Button1')]).errors.length);
+});
+
+test('wheel directions only map to pad buttons', () => {
+    for (const action of actions) {
+        for (const value of ['Up', 'Down']) {
+            assert.equal(validate([binding(action, 'WHEEL', value)]).errors.length === 0, padButtons.has(action));
+        }
+        assert.deepEqual(typesForAction(action).includes('WHEEL'), padButtons.has(action));
+    }
+    assert.ok(validate([binding('Cross', 'WHEEL', 'Left')]).errors.length);
+});
+
+test('conflicts warn without blocking, including omitted built-in actions', () => {
+    const input = [binding('Cross'), binding('Square')];
+    const result = validate(input);
+    assert.equal(result.errors.length, 0);
+    assert.ok(result.warnings.some(warning => warning.message.includes('Cross and Square and RightStickLeft (built-in)')));
+    assert.doesNotThrow(() => serialize(input));
+    const overridden = validate([binding('Cross'), binding('RightStickLeft', 'KEY', 'J')]);
+    assert.equal(overridden.warnings.length, 0);
+});
+
+test('serialization is deterministic in action order and preserves alternative order', () => {
+    const input = [binding('ToggleMouse', 'MOUSE', 'X1'), binding('Cross', 'KEY', 'Space'), binding('Cross')];
+    assert.equal(serialize(input), 'Cross = KEY:Space\nCross = KEY:F\nToggleMouse = MOUSE:X1\n');
+    assert.deepEqual(input, [binding('ToggleMouse', 'MOUSE', 'X1'), binding('Cross', 'KEY', 'Space'), binding('Cross')]);
+});
+
+test('import supports BOM, CRLF, inline comments, extra equals and colons in key names', () => {
+    const result = parseIni('\uFEFF# config\r\n cross = key : space ; note\r\nCross=KEY:Space\r\nR2=mouse:right\r\nL1=KEY:=\r\nL2=KEY:Keypad :\r\n');
+    assert.deepEqual(result.errors, []);
+    assert.equal(result.warnings.length, 1);
+    assert.deepEqual(result.entries, [binding('Cross', 'KEY', 'Space'), binding('R2', 'MOUSE', 'Right'), binding('L1', 'KEY', '='), binding('L2', 'KEY', 'Keypad :')]);
+});
+
+test('import rejects sections, unsupported extensions and malformed lines with line numbers', () => {
+    const result = parseIni('[Bindings]\nCross=NONE\nCross=KEY:4\nToggleFullscreen=MOUSE:Left\nLeftStickUp=WHEEL:Up\nCross=KEY:;\nCross=KEY:KeyF\nCross=KEY:\n');
+    assert.deepEqual(result.errors.map(error => error.line), [1, 2, 4, 5, 6, 7, 8]);
+    assert.deepEqual(result.entries, [binding('Cross', 'KEY', '4')]);
+    assert.throws(() => parseIni(null), TypeError);
+});
+
+test('round trip is stable for every safe key and supported mouse/wheel source', () => {
+    const input = [...exportableKeys.map(value => binding('Cross', 'KEY', value)), ...mouseValues.map(value => binding('Square', 'MOUSE', value)), binding('R2', 'WHEEL', 'Down')];
+    const text = serialize(input);
+    const imported = parseIni(text);
+    assert.equal(imported.errors.length, 0);
+    assert.equal(serialize(imported.entries), text);
+});
+
+test('capture maps physical positions and distinguishes modifiers and keypad', () => {
+    const cases = {KeyA: 'A', Digit1: '1', Enter: 'Return', NumpadEnter: 'Keypad Enter', Numpad1: 'Keypad 1', ControlLeft: 'Left Ctrl', AltRight: 'Right Alt', ArrowUp: 'Up', F24: 'F24', Equal: '=', Backslash: '\\'};
+    for (const [code, value] of Object.entries(cases)) assert.deepEqual(captureKey({code, key: 'ignored'}), {value});
+    assert.equal(captureKey({code: 'KeyQ', key: 'a'}).value, 'Q');
+});
+
+test('capture rejects missing identifiers, composition and unsafe punctuation', () => {
+    for (const event of [{code: 'Unidentified'}, {key: 'a'}, {code: 'IntlBackslash'}, {code: 'Semicolon'}, {code: 'KeyA', isComposing: true}, {code: 'Quote', key: 'Dead'}, {code: 'KeyA', key: 'Process'}]) {
+        assert.ok(captureKey(event).error);
+    }
+});
diff --git a/tools/input-mapper/validation.js b/tools/input-mapper/validation.js
new file mode 100644
index 0000000000..ce4c7a8bb9
--- /dev/null
+++ b/tools/input-mapper/validation.js
@@ -0,0 +1,93 @@
+import {actions, canonicalValue, defaults, mouseValues, typesForAction, wheelValues} from './mapping.js';
+import {keyNames} from './keys.js';
+
+export function validate(entries) {
+    const errors = [];
+    const warnings = [];
+    const bindings = [];
+    const seen = new Set();
+    if (!Array.isArray(entries)) return {errors: [{message: 'Configuration must be a list of bindings.'}], warnings, bindings};
+    entries.forEach((entry, index) => {
+        const action = canonicalValue(entry?.action, actions);
+        const type = canonicalValue(entry?.type, ['KEY', 'MOUSE', 'WHEEL']);
+        let message;
+        if (!action) message = 'Unknown or empty action.';
+        else if (!type) message = 'Input type must be KEY, MOUSE or WHEEL.';
+        else if (!typesForAction(action).includes(type)) message = `${action} cannot use ${type}.`;
+        const choices = type === 'KEY' ? keyNames : type === 'MOUSE' ? mouseValues : wheelValues;
+        const value = canonicalValue(entry?.value, choices);
+        if (!message && !value) message = `Unknown or empty ${type} value.`;
+        if (!message && /[#;\r\n]/u.test(value)) message = 'This SDL key name cannot be represented in the current INI comment syntax.';
+        if (message) {
+            errors.push({index, message: `${entry?.action || 'Binding'}: ${message}`});
+            return;
+        }
+        const binding = {action, type, value};
+        const identity = `${action}:${type}:${value}`;
+        if (seen.has(identity)) warnings.push({index, message: `${action}: duplicate ${type}:${value} will be omitted.`});
+        else bindings.push(binding);
+        seen.add(identity);
+    });
+    const configured = new Set(bindings.map(binding => binding.action));
+    const sources = new Map();
+    const effective = bindings.map(binding => ({action: binding.action, source: `${binding.type}:${binding.value}`, builtin: false}));
+    for (const action of actions) {
+        if (!configured.has(action)) {
+            for (const source of defaults[action]) effective.push({action, source, builtin: true});
+        }
+    }
+    for (const binding of effective) {
+        const owners = sources.get(binding.source) || [];
+        owners.push(binding);
+        sources.set(binding.source, owners);
+    }
+    for (const [source, owners] of sources) {
+        if (owners.length > 1 && owners.some(owner => !owner.builtin)) {
+            warnings.push({message: `${source} controls ${owners.map(owner => `${owner.action}${owner.builtin ? ' (built-in)' : ''}`).join(' and ')}.`});
+        }
+    }
+    return {errors, warnings, bindings};
+}
+
+export function serialize(entries) {
+    const result = validate(entries);
+    if (result.errors.length) throw new Error(result.errors.map(error => error.message).join('\n'));
+    const lines = [];
+    for (const action of actions) {
+        for (const binding of result.bindings.filter(binding => binding.action === action)) {
+            lines.push(`${action} = ${binding.type}:${binding.value}`);
+        }
+    }
+    return lines.length ? `${lines.join('\n')}\n` : '';
+}
+
+export function parseIni(text) {
+    if (typeof text !== 'string') throw new TypeError('INI content must be text.');
+    const entries = [];
+    const errors = [];
+    const warnings = [];
+    const identities = new Set();
+    text.replace(/^\uFEFF/u, '').split('\n').forEach((line, index) => {
+        const content = line.split(/[#;]/u, 1)[0].trim();
+        if (!content) return;
+        const separator = content.indexOf('=');
+        const source = content.slice(separator + 1);
+        const colon = source.indexOf(':');
+        if (separator === -1 || colon === -1) {
+            errors.push({line: index + 1, message: 'Expected Action = TYPE:VALUE.'});
+            return;
+        }
+        const entry = {action: content.slice(0, separator), type: source.slice(0, colon), value: source.slice(colon + 1)};
+        const result = validate([entry]);
+        if (result.errors.length) {
+            errors.push(...result.errors.map(error => ({line: index + 1, message: error.message})));
+            return;
+        }
+        const binding = result.bindings[0];
+        const identity = JSON.stringify(binding);
+        if (identities.has(identity)) warnings.push({line: index + 1, message: 'Duplicate binding ignored.'});
+        else entries.push(binding);
+        identities.add(identity);
+    });
+    return {entries, errors, warnings};
+}

From 8644428aa70946fe6e2da67b6ebe7a759a8b0c85 Mon Sep 17 00:00:00 2001
From: Amr Yasser <154547867+AMRYB@users.noreply.github.com>
Date: Sun, 11 Oct 2026 20:35:50 +0300
Subject: [PATCH 007/218] ci(input): run mapper tests and clarify hosting
 documentation

---
 .github/workflows/input-mapper.yml | 24 ++++++++++++++++++++++++
 docs/user/INPUT_MAPPING.md         |  4 +---
 2 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/input-mapper.yml

diff --git a/.github/workflows/input-mapper.yml b/.github/workflows/input-mapper.yml
new file mode 100644
index 0000000000..73783169c6
--- /dev/null
+++ b/.github/workflows/input-mapper.yml
@@ -0,0 +1,24 @@
+name: Input mapper
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  input-mapper:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          package-manager-cache: false
+      - run: npm --prefix tools/input-mapper test
diff --git a/docs/user/INPUT_MAPPING.md b/docs/user/INPUT_MAPPING.md
index 9a051c8898..5e974ab0e6 100644
--- a/docs/user/INPUT_MAPPING.md
+++ b/docs/user/INPUT_MAPPING.md
@@ -131,8 +131,6 @@ Earlier versions sampled the mouse every 33 ms and tilted the stick at least hal
 
 An invalid line reports the file and line number and stops input initialization. If the configured file does not exist or cannot be read, AnyPS5 reports an error. With no `anyps5-input.ini` and no `ANYPS5_INPUT_CONFIG`, the built-in mapping is used.
 
-
-
 ## Web configurator
 
 The [input mapper](../../tools/input-mapper/index.html) edits keyboard, mouse and wheel overrides in the browser. It supports alternate bindings, physical-key capture, search, INI import, preview, copy and download. Invalid imports preserve the current configuration. Invalid bindings block export; duplicate and shared inputs, including retained built-in bindings, produce warnings. Removing every binding for an action restores its built-in inputs.
@@ -155,4 +153,4 @@ The translation button selects one of 22 interface and FAQ languages. First visi
 
 Keyboard capture converts physical browser key codes to SDL scancode names. Escape cancels capture; select Escape manually to assign it. Composition, ambiguous keys and some browser or system shortcuts require manual selection. Names containing `#` or `;` cannot be exported because those characters start INI comments. The key catalogue follows SDL commit `4b69833bc54abf3dd3288d4aa7afbba527775e5b`. The source-contract tests compare actions, restrictions and defaults with the current native input code.
 
-For static hosting, serve `index.html`, `styles.css`, `app.js`, `mapping.js`, `keys.js`, `capture.js`, `validation.js`, `i18n.js` and `dropdown.js` from one directory. For the existing GitHub Pages deployment, these files can be copied into `out/input-mapper/` after the Progress workflow generates `out`. The progress dashboard remains at `out/index.html`; publication and a dashboard link are left for maintainer review.
+For static hosting, serve `index.html`, `styles.css`, `app.js`, `mapping.js`, `keys.js`, `capture.js`, `validation.js`, `i18n.js` and `dropdown.js` from one directory. The configurator is not published on the project's GitHub Pages site yet.

From c75d7bfdedb8118e04d84ca5436d1ec958ae446c Mon Sep 17 00:00:00 2001
From: Amr Yasser <154547867+AMRYB@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:01:45 +0300
Subject: [PATCH 008/218] fix(input): sync web mapper with current native
 actions

---
 .github/workflows/input-mapper.yml       |  5 +++++
 tools/input-mapper/index.html            |  2 +-
 tools/input-mapper/mapping.js            |  9 ++++----
 tools/input-mapper/tests/mapping.test.js | 26 ++++++++++++++++++++++--
 4 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/input-mapper.yml b/.github/workflows/input-mapper.yml
index 73783169c6..55120c5b54 100644
--- a/.github/workflows/input-mapper.yml
+++ b/.github/workflows/input-mapper.yml
@@ -5,6 +5,11 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+    paths:
+      - '.github/workflows/input-mapper.yml'
+      - 'tools/input-mapper/**'
+      - 'core/libs/prx/libScePad/include/**'
+      - 'core/libs/prx/libSceVideoOut/src/InputMapping.cpp'
 
 permissions:
   contents: read
diff --git a/tools/input-mapper/index.html b/tools/input-mapper/index.html
index ee5a61c712..3b340b95e6 100644
--- a/tools/input-mapper/index.html
+++ b/tools/input-mapper/index.html
@@ -37,7 +37,7 @@
         </div>
         <div id="mappings" tabindex="-1" aria-label="Controls" data-i18n-label="controls"></div>
         <section id="configuration" class="configuration-panel" aria-label="Configuration output" data-i18n-label="output" tabindex="-1" hidden>
-                <div class="output-heading"><h2 data-i18n="configuration">Configuration</h2><span id="count" class="tag">0 / 27</span></div>
+                <div class="output-heading"><h2 data-i18n="configuration">Configuration</h2><span id="count" class="tag">0 / 31</span></div>
                 <label for="preview">anyps5-input.ini</label>
                 <textarea id="preview" readonly spellcheck="false" placeholder="Add a binding to begin." data-i18n-placeholder="previewEmpty" dir="ltr"></textarea>
                 <div class="export-actions">
diff --git a/tools/input-mapper/mapping.js b/tools/input-mapper/mapping.js
index 9d29df0382..fe476f10f5 100644
--- a/tools/input-mapper/mapping.js
+++ b/tools/input-mapper/mapping.js
@@ -4,7 +4,7 @@ export const groups = [
     {name: 'Directional controls', actions: ['Up', 'Right', 'Down', 'Left']},
     {name: 'Left analog stick', actions: ['LeftStickLeft', 'LeftStickRight', 'LeftStickUp', 'LeftStickDown']},
     {name: 'Right analog stick', actions: ['RightStickLeft', 'RightStickRight', 'RightStickUp', 'RightStickDown']},
-    {name: 'Touch and utility', actions: ['Options', 'TouchLeft', 'TouchRight', 'ToggleMouse', 'ToggleFullscreen']}
+    {name: 'Touch and utility', actions: ['Options', 'TouchLeft', 'TouchRight', 'StickModifier', 'Shake', 'ToggleMouse', 'ToggleFullscreen', 'TogglePerformanceOverlay', 'Screenshot']}
 ];
 
 export const actions = groups.flatMap(group => group.actions);
@@ -14,17 +14,18 @@ export const wheelValues = ['Up', 'Down'];
 
 export const defaults = {
     Cross: ['KEY:Return', 'KEY:Space'], Circle: ['KEY:C'], Triangle: ['KEY:I'], Square: ['MOUSE:Left'],
-    L1: ['KEY:Q'], R1: ['KEY:E', 'KEY:Left Alt', 'KEY:Right Alt'], L2: [], R2: ['MOUSE:Right'],
+    L1: ['KEY:Q'], R1: ['KEY:E', 'KEY:Left Alt', 'KEY:Right Alt'], L2: ['KEY:R', 'MOUSE:X1'], R2: ['MOUSE:Right'],
     L3: ['KEY:Left Shift', 'KEY:Right Shift'], R3: ['KEY:Left Ctrl', 'KEY:Right Ctrl'], Options: ['KEY:Escape'],
     Up: ['KEY:Up', 'WHEEL:Up'], Right: ['KEY:Right'], Down: ['KEY:Down', 'WHEEL:Down'], Left: ['KEY:Left'],
     LeftStickLeft: ['KEY:A'], LeftStickRight: ['KEY:D'], LeftStickUp: ['KEY:W'], LeftStickDown: ['KEY:S'],
     RightStickLeft: ['KEY:F'], RightStickRight: ['KEY:H'], RightStickUp: ['KEY:T'], RightStickDown: ['KEY:G'],
-    TouchLeft: ['KEY:Backspace'], TouchRight: ['KEY:Tab'], ToggleMouse: ['MOUSE:Middle'], ToggleFullscreen: ['KEY:F11']
+    TouchLeft: ['KEY:Backspace'], TouchRight: ['KEY:Tab'], StickModifier: [], Shake: ['KEY:X'],
+    ToggleMouse: ['KEY:F7', 'MOUSE:Middle'], ToggleFullscreen: ['KEY:F11'], TogglePerformanceOverlay: ['KEY:F10'], Screenshot: ['KEY:F12']
 };
 
 export function typesForAction(action) {
     if (!actions.includes(action)) return [];
-    if (action === 'ToggleFullscreen') return ['KEY'];
+    if (['ToggleFullscreen', 'TogglePerformanceOverlay', 'Screenshot'].includes(action)) return ['KEY'];
     return padButtons.has(action) ? ['KEY', 'MOUSE', 'WHEEL'] : ['KEY', 'MOUSE'];
 }
 
diff --git a/tools/input-mapper/tests/mapping.test.js b/tools/input-mapper/tests/mapping.test.js
index 6554c52a9e..8c34cceb70 100644
--- a/tools/input-mapper/tests/mapping.test.js
+++ b/tools/input-mapper/tests/mapping.test.js
@@ -14,7 +14,8 @@ test('action names and pad button categories agree with the current native parse
     assert.deepEqual([...actions].sort(), definitions.map(match => match[1]).sort());
     assert.deepEqual([...padButtons].sort(), definitions.filter(match => match[2] === 'Button').map(match => match[1]).sort());
     assert.match(source, /SDL_GetScancodeFromName\(keyName\.c_str\(\)\)/u);
-    assert.match(source, /if \(action\.control == Pad::InputControl::ToggleFullscreen\)/u);
+    const keyboardOnly = [...source.matchAll(/if \(action\.control == Pad::InputControl::(\w+)\) \{\s*throw std::runtime_error\("\w+ can only use a keyboard key"\);/gu)].map(match => match[1]);
+    assert.deepEqual(actions.filter(action => typesForAction(action).length === 1).sort(), keyboardOnly.sort());
     assert.match(source, /if \(action\.control != Pad::InputControl::Button\)/u);
 });
 
@@ -65,7 +66,7 @@ test('all exportable SDL names validate and unsafe comment names are rejected',
 test('mouse values and action restrictions match the current INI format', () => {
     for (const action of actions) {
         for (const value of mouseValues) {
-            assert.equal(validate([binding(action, 'MOUSE', value)]).errors.length === 0, action !== 'ToggleFullscreen');
+            assert.equal(validate([binding(action, 'MOUSE', value)]).errors.length === 0, !['ToggleFullscreen', 'TogglePerformanceOverlay', 'Screenshot'].includes(action));
         }
     }
     assert.ok(validate([binding('Cross', 'MOUSE', 'Button1')]).errors.length);
@@ -81,6 +82,27 @@ test('wheel directions only map to pad buttons', () => {
     assert.ok(validate([binding('Cross', 'WHEEL', 'Left')]).errors.length);
 });
 
+test('new utility actions import and round trip without accepting unsupported sources', () => {
+    const source = 'StickModifier = MOUSE:X2\nShake = MOUSE:Left\nTogglePerformanceOverlay = KEY:F9\nScreenshot = KEY:F8\n';
+    const imported = parseIni(source);
+    assert.deepEqual(imported.errors, []);
+    assert.equal(serialize(imported.entries), source);
+    for (const action of ['StickModifier', 'Shake', 'TogglePerformanceOverlay', 'Screenshot']) {
+        assert.ok(validate([binding(action, 'WHEEL', 'Up')]).errors.length);
+    }
+    for (const action of ['TogglePerformanceOverlay', 'Screenshot']) {
+        assert.deepEqual(parseIni(`${action} = MOUSE:Left`).errors.map(error => error.line), [1]);
+    }
+});
+
+test('updated built-in inputs warn until their owning action is overridden', () => {
+    for (const [action, type, value] of [['L2', 'KEY', 'R'], ['L2', 'MOUSE', 'X1'], ['ToggleMouse', 'KEY', 'F7'], ['Shake', 'KEY', 'X'], ['Screenshot', 'KEY', 'F12'], ['TogglePerformanceOverlay', 'KEY', 'F10']]) {
+        const input = binding('Cross', type, value);
+        assert.ok(validate([input]).warnings.some(warning => warning.message.includes(`${action} (built-in)`)));
+        assert.equal(validate([input, binding(action, 'KEY', 'J')]).warnings.length, 0);
+    }
+});
+
 test('conflicts warn without blocking, including omitted built-in actions', () => {
     const input = [binding('Cross'), binding('Square')];
     const result = validate(input);

From 447a36e942e369755077e54d355dcb946b7b584c Mon Sep 17 00:00:00 2001
From: cadenasynyster <8373765+cadenasynyster@users.noreply.github.com>
Date: Tue, 20 Oct 2026 23:12:41 +0200
Subject: [PATCH 009/218] fix(libc): report ELOOP from rename through a Windows
 symlink loop

A rename whose source or destination directory is a self-referencing symbolic link returned ENOTDIR or ENOENT on Windows; FreeBSD returns ELOOP.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GtXavMkgCTCdmRpweviHcQ
---
 core/libs/prx/libc/src/Rename.cpp   | 14 ++++++++++++++
 core/libs/tests/GuestFilesystem.cpp |  6 ++++++
 2 files changed, 20 insertions(+)

diff --git a/core/libs/prx/libc/src/Rename.cpp b/core/libs/prx/libc/src/Rename.cpp
index 973c142ff6..0e7f64e5d7 100644
--- a/core/libs/prx/libc/src/Rename.cpp
+++ b/core/libs/prx/libc/src/Rename.cpp
@@ -41,6 +41,16 @@ std::error_code RenameNative_nid_no_patch(const std::filesystem::path& source, c
     return error;
 }
 
+#ifdef _WIN32
+static bool BelowSymbolicLinkLoop(const std::filesystem::path& directory) {
+    const auto handle = CreateFileW(directory.c_str(), FILE_READ_ATTRIBUTES, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        nullptr, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) return GetLastError() == ERROR_CANT_RESOLVE_FILENAME;
+    CloseHandle(handle);
+    return false;
+}
+#endif
+
 static int RenamePath_nid_no_patch(const std::filesystem::path& source, const std::filesystem::path& destination) {
     constexpr int GuestEnoent = 2;
     constexpr int GuestEnotdir = 20;
@@ -120,6 +130,10 @@ extern "C" int RenameGuestPath_nid_no_patch(const char* from, const char* to) {
             std::error_code status;
             if (HasNonDirectoryPrefix_nid_no_patch(source) || (std::filesystem::exists(source, status) && HasNonDirectoryPrefix_nid_no_patch(destination))) error = 20;
         }
+#ifdef _WIN32
+        constexpr int GuestEloop = 62;
+        if ((error == 2 || error == 20) && (BelowSymbolicLinkLoop(source.parent_path()) || BelowSymbolicLinkLoop(destination.parent_path()))) error = GuestEloop;
+#endif
         if (error) { errno = error; return -1; }
         RecordWrittenPath_nid_no_patch(source);
         RecordWrittenPath_nid_no_patch(destination);
diff --git a/core/libs/tests/GuestFilesystem.cpp b/core/libs/tests/GuestFilesystem.cpp
index 07b86670f3..1eaa8196a8 100644
--- a/core/libs/tests/GuestFilesystem.cpp
+++ b/core/libs/tests/GuestFilesystem.cpp
@@ -967,6 +967,12 @@ int main() {
         Require(stat_nid_postfix(fileLink.string().c_str(), &followed) == 0 && (followed.st_mode & 0170000) == 0100000);
         Require(followed.st_ino == status.st_ino && linkStatus.st_ino != status.st_ino && linkStatus.st_dev == status.st_dev);
         Require(stat_nid_postfix(directoryLink.string().c_str(), &followed) == 0 && (followed.st_mode & 0170000) == 0040000);
+        const auto renameThroughLoop = statLoop.string() + "\\inside";
+        const auto renameTarget = (root / "rename-target").string();
+        Require(sceKernelRename(renameThroughLoop.c_str(), renameTarget.c_str()) == static_cast<int>(0x8002003eu));
+        Require(rename_nid_postfix(renameThroughLoop.c_str(), renameTarget.c_str()) == -1 && *__error_nid_postfix() == 62);
+        Require(sceKernelRename(present.string().c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x8002003eu));
+        Require(rename_nid_postfix(present.string().c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 62);
         Require(stat_nid_postfix(fileLink.string().c_str(), &status) == 0 && status.st_size == 5);
         FileStat absoluteStatus{};
         Require(lstat_nid_postfix(absoluteLink.string().c_str(), &absoluteStatus) == 0);

From 1a0c43b69f26260f38ecf9bfc35b7ebfb1ddac04 Mon Sep 17 00:00:00 2001
From: Yunus Shaikh <75296019+EagleBearerYS@users.noreply.github.com>
Date: Wed, 21 Oct 2026 08:53:18 +0000
Subject: [PATCH 010/218] perf(agc): retain link-time optimization info only
 where a link is optimized

Every graphics pipeline library was created with
VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT, and
libraries live until the device is destroyed. Only the background
relink reads that info, and it exists only when the device's links are
optimized: not on the NVIDIA proprietary driver and not with
APS5_NO_PIPELINE_LTO set. A library now asks for the info only when
its link will be optimized, and whether it will be is part of the
library cache key, so a link that is optimized never names a library
made without the info, even when a context forces
pipelineLinkTimeOptimization on a device whose other contexts do not.
Draws, journal replays and shader library prebuilds all create their
libraries through this one path.

The pipeline readback tests count the libraries created with the flag
next to their pixel checks, and a new recorder mode checks that a
context without optimized links makes libraries without the info and
that a context with them makes its own.
---
 core/libs/prx/libSceAgcDriver/CMakeLists.txt  |  6 +-
 .../Graphics/src/PipelineLibrary.cpp          |  5 +-
 .../prx/libSceAgcDriver/tests/Recorder.cpp    | 95 +++++++++++++++++++
 .../execution/PipelineOptimizedReadback.cpp   | 16 +++-
 4 files changed, 117 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index f6f2e95e22..14b9de7595 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -1380,8 +1380,12 @@ if(BUILD_TESTING)
     set_tests_properties(agc_pipeline_library_off PROPERTIES ENVIRONMENT "APS5_NO_GPL=1")
     add_test(NAME agc_pipeline_library_fast_only COMMAND agc_driver_recorder_tests --pipeline-library-only)
     set_tests_properties(agc_pipeline_library_fast_only PROPERTIES ENVIRONMENT "APS5_NO_PIPELINE_LTO=1" SKIP_RETURN_CODE 77)
+    add_test(NAME agc_pipeline_library_lto_info COMMAND agc_driver_recorder_tests --pipeline-library-lto-info-only)
+    add_test(NAME agc_pipeline_library_lto_info_fast_only COMMAND agc_driver_recorder_tests --pipeline-library-lto-info-only)
+    set_tests_properties(agc_pipeline_library_lto_info agc_pipeline_library_lto_info_fast_only PROPERTIES SKIP_RETURN_CODE 77)
+    set_tests_properties(agc_pipeline_library_lto_info_fast_only PROPERTIES ENVIRONMENT "APS5_NO_PIPELINE_LTO=1")
     if(WIN32)
-        set_tests_properties(agc_pipeline_library agc_pipeline_library_off agc_pipeline_library_fast_only PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(agc_pipeline_library agc_pipeline_library_off agc_pipeline_library_fast_only agc_pipeline_library_lto_info agc_pipeline_library_lto_info_fast_only PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
     set_tests_properties(agc_pipeline_cache agc_pipeline_cache_file PROPERTIES SKIP_RETURN_CODE 77)
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
index 7670cde694..f1309d8e0f 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/PipelineLibrary.cpp
@@ -185,7 +185,8 @@ VkPipeline LinkPipelineFromLibraries(const Context& context, const VkGraphicsPip
     std::vector<VkPipeline> libraries;
     for (std::size_t part = 0; part < flags.size(); ++part) {
         if (part == 0 && mesh) continue;
-        const auto key = Combined(*partKeys[part], *contextKeys[part]);
+        auto key = Combined(*partKeys[part], *contextKeys[part]);
+        key.push_back(static_cast<std::byte>(optimize));
         auto& cache = device.parts[part];
         if (const auto found = cache.find(key); found != cache.end()) {
             libraries.push_back(found->second);
@@ -195,7 +196,7 @@ VkPipeline LinkPipelineFromLibraries(const Context& context, const VkGraphicsPip
         VkGraphicsPipelineLibraryCreateInfoEXT library{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_LIBRARY_CREATE_INFO_EXT, flags[part] == VK_GRAPHICS_PIPELINE_LIBRARY_FRAGMENT_OUTPUT_INTERFACE_BIT_EXT ? &rendering : &shaderRendering};
         library.flags = flags[part];
         VkGraphicsPipelineCreateInfo create{VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO, &library};
-        create.flags = VK_PIPELINE_CREATE_LIBRARY_BIT_KHR | VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT;
+        create.flags = optimize ? VK_PIPELINE_CREATE_LIBRARY_BIT_KHR | VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT : VK_PIPELINE_CREATE_LIBRARY_BIT_KHR;
         create.pDynamicState = info.pDynamicState;
         create.layout = partLayouts[part];
         switch (flags[part]) {
diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
index 9c1ae9ae14..d9060628d0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
@@ -9676,6 +9676,97 @@ void denormalClearTests(const Device& device, Recorder& recorder) {
     recorder.Sync();
 }
 
+class LibraryCreateFlags {
+public:
+    explicit LibraryCreateFlags(const Context& context) : resolver(context.deviceProc), device(context.device) {
+        create = function<PFN_vkCreateGraphicsPipelines>("vkCreateGraphicsPipelines");
+        active = this;
+    }
+    ~LibraryCreateFlags() { active = nullptr; }
+    LibraryCreateFlags(const LibraryCreateFlags&) = delete;
+    LibraryCreateFlags& operator=(const LibraryCreateFlags&) = delete;
+    PFN_vkGetDeviceProcAddr Resolver() const { return resolve; }
+    std::uint32_t Libraries() const { return libraries.load(); }
+    std::uint32_t Retaining() const { return retaining.load(); }
+
+private:
+    template<typename TFunction>
+    TFunction function(const char* name) const { return reinterpret_cast<TFunction>(resolver(device, name)); }
+    static VKAPI_ATTR VkResult VKAPI_CALL createPipelines(VkDevice device, VkPipelineCache cache, std::uint32_t count, const VkGraphicsPipelineCreateInfo* infos, const VkAllocationCallbacks* callbacks, VkPipeline* pipelines) {
+        const auto result = active->create(device, cache, count, infos, callbacks, pipelines);
+        for (std::uint32_t index = 0; index < count; ++index) {
+            if (pipelines[index] == VK_NULL_HANDLE || (infos[index].flags & VK_PIPELINE_CREATE_LIBRARY_BIT_KHR) == 0) continue;
+            active->libraries.fetch_add(1);
+            if ((infos[index].flags & VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT) != 0) active->retaining.fetch_add(1);
+        }
+        return result;
+    }
+    static VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL resolve(VkDevice device, const char* name) {
+        if (std::strcmp(name, "vkCreateGraphicsPipelines") == 0) return reinterpret_cast<PFN_vkVoidFunction>(createPipelines);
+        return active->resolver(device, name);
+    }
+    PFN_vkGetDeviceProcAddr resolver;
+    VkDevice device;
+    PFN_vkCreateGraphicsPipelines create = nullptr;
+    std::atomic<std::uint32_t> libraries{0};
+    std::atomic<std::uint32_t> retaining{0};
+    static inline LibraryCreateFlags* active = nullptr;
+};
+
+void pipelineLibraryLtoInfoTests(const Device& device) {
+    std::lock_guard gpu(GpuMutex());
+    const auto& context = device.GetContext();
+    LibraryCreateFlags created(context);
+    struct Cleanup {
+        VkDevice device;
+        ~Cleanup() { ClearCachedPipelines(device); }
+    } cleanup{context.device};
+    ClearCachedPipelines(context.device);
+    if (!context.graphicsPipelineLibrary) {
+        std::cout << "graphics pipeline libraries unavailable or disabled: no library retains link-time optimization info\n";
+        return;
+    }
+    ShaderRecompiler::RecompileResult vertex, fragment;
+    vertex.variantId = 41;
+    fragment.variantId = 42;
+    vertex.spirv = std::vector<std::uint32_t>(std::begin(TRIANGLE_vert_SPV), std::end(TRIANGLE_vert_SPV));
+    fragment.spirv = std::vector<std::uint32_t>(std::begin(TRIANGLE_frag_SPV), std::end(TRIANGLE_frag_SPV));
+    const std::array shaders{CompiledShader{ShaderRecompiler::ShaderStage::Vertex, &vertex, 0}, CompiledShader{ShaderRecompiler::ShaderStage::Fragment, &fragment, 0}};
+    State state{};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.hasColorTarget = true;
+    state.color.format = VK_FORMAT_R8G8B8A8_UNORM;
+    state.colors.push_back(state.color);
+    state.blend.colorWriteMask = 15;
+    state.blends.push_back(state.blend);
+    ShaderResources resources(context, shaders, state.color, static_cast<std::uint32_t>(state.colors.size()), 0, 0);
+    VertexInputLayout input;
+    auto fast = context;
+    fast.deviceProc = created.Resolver();
+    fast.pipelineLinkTimeOptimization = false;
+    auto optimizing = fast;
+    optimizing.pipelineLinkTimeOptimization = true;
+    const bool lto = std::getenv("APS5_NO_PIPELINE_LTO") == nullptr;
+    const auto fastPipeline = CachedPipeline(fast, state, input, resources, shaders, VK_IMAGE_LAYOUT_GENERAL);
+    const auto fastLibraries = created.Libraries();
+    Require(fastLibraries != 0, "the pipeline was not linked from libraries created through the traced device");
+    Require(created.Retaining() == 0, std::to_string(created.Retaining()) + " of the " + std::to_string(fastLibraries) + " libraries made for a context without optimized links were created to retain link-time optimization info");
+    WaitForOptimizedPipelines(context.device);
+    Require(!fastPipeline->Optimized(), "a pipeline of a context without optimized links was optimized in the background");
+    const auto optimizedPipeline = CachedPipeline(optimizing, state, input, resources, shaders, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL);
+    Require(optimizedPipeline != fastPipeline, "the two attachment layouts shared one cached pipeline");
+    const auto libraries = created.Libraries() - fastLibraries;
+    if (lto) {
+        Require(libraries == fastLibraries, "a link that will be optimized made " + std::to_string(libraries) + " libraries, expected " + std::to_string(fastLibraries) + ": it reused libraries made without link-time optimization info");
+        Require(created.Retaining() == libraries, std::to_string(created.Retaining()) + " of the " + std::to_string(libraries) + " libraries of a link that will be optimized were created to retain link-time optimization info");
+    } else {
+        Require(libraries == 0 && created.Retaining() == 0, "with APS5_NO_PIPELINE_LTO set, forcing pipelineLinkTimeOptimization changed the libraries or their create flags");
+    }
+    WaitForOptimizedPipelines(context.device);
+    Require(optimizedPipeline->Optimized() == lto, lto ? "the pipeline linked from libraries that retain link-time optimization info was not optimized in the background" : "a pipeline was optimized with APS5_NO_PIPELINE_LTO set");
+    std::cout << "Pipeline library link-time optimization info tests passed: " << fastLibraries << " libraries without the info, " << created.Retaining() << " with it\n";
+}
+
 void pipelineLibraryTests(const Device& device) {
     std::lock_guard gpu(GpuMutex());
     const auto& context = device.GetContext();
@@ -10023,6 +10114,10 @@ int main(int argc, char** argv) {
             }
             return sparseRunImportTests(device, true) ? 0 : 77;
         }
+        if (argc == 2 && std::string_view(argv[1]) == "--pipeline-library-lto-info-only") {
+            pipelineLibraryLtoInfoTests(device);
+            return 0;
+        }
         if (argc == 2 && std::string_view(argv[1]) == "--pipeline-library-only") {
             pipelineLibraryTests(device);
             return 0;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp
index f2b56411c0..2ff511dcd1 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PipelineOptimizedReadback.cpp
@@ -64,6 +64,8 @@ struct PipelineTrace {
     std::mutex mutex;
     std::condition_variable released;
     bool allowOptimization = false;
+    std::uint32_t libraries = 0;
+    std::uint32_t retaining = 0;
     std::vector<VkPipeline> fast;
     std::vector<VkPipeline> optimized;
     VkCommandBuffer boundCommands = VK_NULL_HANDLE;
@@ -90,7 +92,12 @@ VKAPI_ATTR VkResult VKAPI_CALL CreatePipelines(VkDevice device, VkPipelineCache
     const auto result = Trace->create(device, cache, count, infos, allocator, pipelines);
     std::lock_guard lock(Trace->mutex);
     for (std::uint32_t index = 0; index < count; ++index) {
-        if (pipelines[index] == VK_NULL_HANDLE || (infos[index].flags & VK_PIPELINE_CREATE_LIBRARY_BIT_KHR) != 0) continue;
+        if (pipelines[index] == VK_NULL_HANDLE) continue;
+        if ((infos[index].flags & VK_PIPELINE_CREATE_LIBRARY_BIT_KHR) != 0) {
+            ++Trace->libraries;
+            if ((infos[index].flags & VK_PIPELINE_CREATE_RETAIN_LINK_TIME_OPTIMIZATION_INFO_BIT_EXT) != 0) ++Trace->retaining;
+            continue;
+        }
         auto& handles = (infos[index].flags & VK_PIPELINE_CREATE_LINK_TIME_OPTIMIZATION_BIT_EXT) != 0 ? Trace->optimized : Trace->fast;
         handles.push_back(pipelines[index]);
     }
@@ -217,12 +224,17 @@ void Run(AgcDriver::VulkanDevice& device, Context context, PipelineTrace& trace,
         CheckPixels(masked, phase);
     };
     render(false, "fast link");
+    {
+        std::lock_guard lock(trace.mutex);
+        Require(trace.libraries != 0, "the readback pipeline's libraries were not created through the traced device");
+        Require(trace.retaining == (optimize ? trace.libraries : 0u), std::to_string(trace.retaining) + " of the " + std::to_string(trace.libraries) + " libraries were created to retain link-time optimization info, expected " + (optimize ? "all of them" : "none, since no optimized link will be made"));
+    }
     trace.ReleaseOptimization();
     WaitForOptimizedPipelines(context.device);
     Require(PipelineLibraryCountersOf(context.device).linked == 1, "the readback pipeline was not linked from graphics libraries");
     Require(trace.optimized.size() == (optimize ? 1u : 0u), "the optimized pipeline creation count differs from the requested mode");
     render(optimize, "completed link");
-    std::printf("pipeline readback passed: fast draws %u, optimized draws %u, optimized creations %zu\n", optimize ? 1u : 2u, optimize ? 1u : 0u, trace.optimized.size());
+    std::printf("pipeline readback passed: fast draws %u, optimized draws %u, optimized creations %zu, libraries %u (%u retaining link-time optimization info)\n", optimize ? 1u : 2u, optimize ? 1u : 0u, trace.optimized.size(), trace.libraries, trace.retaining);
 }
 
 }

From d16be88e392b50dd76ebe730b26efba3773da70d Mon Sep 17 00:00:00 2001
From: Niko <nikobilger2000@gmail.com>
Date: Tue, 20 Oct 2026 21:22:21 +0200
Subject: [PATCH 011/218] feat(libSceAudioOut): return 0 from
 sceAudioOutSetMainOutput like the firmware stub

sceAudioOutSetMainOutput threw "not implemented". In firmware 12.70
the export is `xor eax,eax; ret` (PS5-Audio-Passthrough-Research,
docs/FINDINGS.md line 25 at cf3c921): it reads no argument, changes
nothing and returns 0. It now does the same, defined in AudioOut.cpp
next to the Sys output calls.

Its parameters stay unknown and other firmware versions are
unverified. The debt file records this under Silent stubs, which
check_conventions requires for an export that returns a constant,
in place of the function's unknown-signature line.

The audio_out_sys test checks that the call does not throw and
returns 0; on main both checks fail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceAudioOut/src/AudioOut.cpp      | 4 ++++
 core/libs/prx/libSceAudioOut/src/Unimplemented.cpp | 5 -----
 core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp | 5 +++++
 docs/dev/debt/libSceAudioOut.md                    | 5 ++++-
 4 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/core/libs/prx/libSceAudioOut/src/AudioOut.cpp b/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
index 0eda307e26..d8b840b194 100644
--- a/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
+++ b/core/libs/prx/libSceAudioOut/src/AudioOut.cpp
@@ -656,6 +656,10 @@ int APS5_VABI sceAudioOutSysOpen(int userId, std::uint32_t mode) {
     return allocatePort(PORT_TYPE_SYS, SYS_PORT_SAMPLES, SYS_PORT_FRAME_RATE, Format::S16_8Ch);
 }
 
+int APS5_VABI sceAudioOutSetMainOutput() {
+    return 0;
+}
+
 int APS5_VABI sceAudioOutSetMixLevelPadSpk(int handle, int mixLevel) {
     std::lock_guard<std::mutex> lock(g_mutex);
     Port* port = getPort(handle);
diff --git a/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp b/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
index 02abcf4fd9..25e2952c61 100644
--- a/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
+++ b/core/libs/prx/libSceAudioOut/src/Unimplemented.cpp
@@ -150,11 +150,6 @@ int APS5_VABI sceAudioOutGetFocusEnablePid(void) {
     return 0;
 }
 
-int APS5_VABI sceAudioOutSetMainOutput(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceAudioOutSetVolumeDown(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp b/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
index eb5878fc18..c3634525b7 100644
--- a/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
+++ b/core/libs/prx/libSceAudioOut/tests/AudioOutSys.cpp
@@ -11,6 +11,7 @@ int APS5_VABI sceAudioOutSysConfigureOutput(int type, std::uint64_t flags, std::
 int APS5_VABI sceAudioOutSysClose(int handle);
 int APS5_VABI sceAudioOutExOpen(int userId, std::uint32_t mode);
 int APS5_VABI sceAudioOutOutput(int handle, const void* ptr);
+int APS5_VABI sceAudioOutSetMainOutput();
 }
 
 static constexpr int SYSTEM_USER = 0xFF;
@@ -53,6 +54,10 @@ int main() {
     Require(Throws([] { sceAudioOutSysConfigureOutput(1, 0, 4, 1, 0); }), "another mode throws");
     Require(Throws([] { sceAudioOutSysConfigureOutput(1, 0, 5, 2, 0); }), "another target throws");
 
+    int mainOutput = -1;
+    Require(!Throws([&mainOutput] { mainOutput = sceAudioOutSetMainOutput(); }), "sceAudioOutSetMainOutput does not throw");
+    Require(mainOutput == 0, "sceAudioOutSetMainOutput returns 0");
+
     Require(sceAudioOutSysClose(truehd) == 0, "close the first Sys port");
     Require(Throws([truehd] { sceAudioOutSysClose(truehd); }), "a closed Sys port throws");
     const int ex = sceAudioOutExOpen(SYSTEM_USER, 0);
diff --git a/docs/dev/debt/libSceAudioOut.md b/docs/dev/debt/libSceAudioOut.md
index f6e6901f1f..08ee56210a 100644
--- a/docs/dev/debt/libSceAudioOut.md
+++ b/docs/dev/debt/libSceAudioOut.md
@@ -1,5 +1,9 @@
 # libSceAudioOut technical debt
 
+### Silent stubs
+
+- [sceAudioOutSetMainOutput](../../../core/libs/prx/libSceAudioOut/src/AudioOut.cpp) (libSceAudioOut) - returns 0 and does nothing, as the console function does on firmware 12.70: [PS5-Audio-Passthrough-Research](https://github.com/sainsaji/PS5-Audio-Passthrough-Research/blob/cf3c921d79bf00db4847f31b68a7bd95a8037cd7/docs/FINDINGS.md#L25) reads that export as `xor eax,eax; ret`. The export reads no argument, so its parameters stay unknown; other firmware versions are unverified
+
 ### Unknown function info
 
 - [sceAudioOut2ContextAdvance and sceAudioOut2ContextPush](../../../core/libs/prx/libSceAudioOut/src/AudioOut2Context.cpp) (libSceAudioOut) - with an SDL device, Advance snapshots each port's PCM and gain; Push consumes completed grains in order and a blocking Push waits for Advance when none is ready. Inferred from PPSA26358, which rewrites the same 512-frame, 12-channel float buffer on a producer thread and pushes on another thread. Console buffer ownership, snapshot timing and empty-queue errors are unverified. Completed grains remain queued until Push consumes them, so memory use grows with an unconsumed PCM backlog. The console backlog limit is unverified. A nonblocking Push without a completed grain throws; this is a runtime restriction, not a console measurement. Context destruction concurrent with active calls remains unsupported. Without an SDL device the existing wall-clock path remains.
@@ -53,7 +57,6 @@
 - [sceAudioOutSetCaesarVolume](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetHeadphoneOutMode](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutGetFocusEnablePid](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
-- [sceAudioOutSetMainOutput](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetVolumeDown](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetChatBalance](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature
 - [sceAudioOutSetRecMode](../../../core/libs/prx/libSceAudioOut/src/Unimplemented.cpp) (libSceAudioOut) - unknown signature

From a356b6a75a8f3ac7474ce9c8c3471561fb690b32 Mon Sep 17 00:00:00 2001
From: Yunus Shaikh <75296019+EagleBearerYS@users.noreply.github.com>
Date: Tue, 20 Oct 2026 22:06:50 -0700
Subject: [PATCH 012/218] fix(agc): put a retired import's unchanged ranges
 back in the write watch

On Windows a host import under 1 MiB leaves the write watch when it is
made, and comes back only when its deferred settle read completes.
retireImport drops the pending settle and never restores the watch, so
an import retired before it settled left its range outside the write
watch for good. Once no import fit the budget, an address-based build
could neither import such a range nor heap mirror it (CollectWrites
returned 0), and copied it.

Since aligned block imports (#6457), this happens to every 64 KiB piece
a title maps one at a time: the piece is imported by the map, and when
its neighbour is registered its run grows into a larger aligned block,
so refreshImports retires the piece's import ("the range was mapped
again", though the range is unchanged). Resident Evil Village
(PPSA01556) on main 6696def6e6 aborted in its intro at 0:43 to 6:37
with "an address-based build copies 185 MiB of 2960 registered ranges,
past 64 MiB (APS5_ADDRESS_COPY_MAX_MIB); the largest: 0x20c0c20000+
0x10000 (0.1 MiB committed, outside the write-watched arena) ...". An
import trace showed each copied page imported by the map, retired when
its run grew, and never imported or watched again.

refreshImports and the budget eviction now note the ranges of each
unwatched import they retire that are still registered as the same
range, and rewatch them once the import is gone: as a settled import
does, except where another unwatched import or a live storage texture
still covers them. Rewatch stamps the range as written, so the next
build reads it in full. Ranges the guest mapped again or released keep
the existing path.

Tested: agc_driver_graphics gains retiredImportWatchTests (Windows):
a 64 KiB piece imported on its own, then its neighbour registered and
the budget cut below one piece. The piece must be back in the write
watch and both pieces heap mirrored. Without the fix the piece stays
unwatched and is copied.

Co-authored-by: keravyn-ops <342686842+keravyn-ops@users.noreply.github.com>
---
 .../Graphics/src/GuestBufferMemory.cpp        | 29 +++++++++
 .../libSceAgcDriver/tests/BdaResources.cpp    | 59 +++++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
index 610c437369..1ee7013dee 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp
@@ -1454,8 +1454,32 @@ bool evictingRefusalCurrent(const HostImports& state, const EvictingRefusal& ref
     return refusal.epoch == state.epoch && refusal.liveBytes == state.liveBytes && budget <= refusal.budget && refusal.window == importWindow.load(std::memory_order_relaxed) && state.useCounter < refusal.ready && (state.buildFloor <= refusal.floor || state.useCounter < refusal.readyHeld);
 }
 
+void noteRetiredUnwatched(std::vector<std::pair<std::uint64_t, std::uint64_t>>& spans, const HostImport& entry, const GuestAllocations::Lease& lease) {
+    if (!entry.unwatched) return;
+    for (const auto& range : entry.ranges) {
+        if (leasedRangeOwner(lease, range->address) != range) continue;
+        const auto begin = std::max(range->address, entry.base);
+        const auto end = std::min(range->address + range->bytes, entry.base + entry.bytes);
+        if (begin < end) spans.emplace_back(begin, end);
+    }
+}
+
+void rewatchRetired(const HostImports& state, std::vector<std::pair<std::uint64_t, std::uint64_t>> spans) {
+    std::erase_if(spans, [&](const auto& span) {
+        auto it = state.imports.upper_bound(span.first);
+        if (it != state.imports.begin()) --it;
+        for (; it != state.imports.end() && it->first < span.second; ++it) {
+            if (it->second.unwatched && span.first < it->first + it->second.bytes) return true;
+        }
+        const std::array<std::pair<std::uint64_t, std::uint64_t>, 1> one{{span}};
+        return StorageTexture::AnyLiveOverlaps(one);
+    });
+    if (!spans.empty()) GuestMemory::Rewatch(spans);
+}
+
 std::uint64_t retireLeastRecent(const Context& context, HostImports& state, const GuestAllocations::Lease& lease, std::uint64_t wanted) {
     std::uint64_t freed = 0;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> unwatched;
     while (freed < wanted) {
         auto oldest = state.imports.end();
         for (auto it = state.imports.begin(); it != state.imports.end(); ++it) {
@@ -1463,8 +1487,10 @@ std::uint64_t retireLeastRecent(const Context& context, HostImports& state, cons
         }
         if (oldest == state.imports.end()) break;
         freed += oldest->second.pinnedBytes;
+        noteRetiredUnwatched(unwatched, oldest->second, lease);
         retireImport(context.device, state, oldest, lease);
     }
+    rewatchRetired(state, std::move(unwatched));
     return freed;
 }
 
@@ -2019,6 +2045,7 @@ void refreshImports(const Context& context, HostImports& state, const GuestAlloc
         state.imports.insert(std::move(node));
     }
     const auto budget = effectiveBudget(context, state);
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> unwatched;
     for (auto it = state.imports.begin(); it != state.imports.end();) {
         if (sameRange(it->second, lease, budget)) {
             if (it->second.unwatched) GuestMemory::Unwatch(it->first, it->second.bytes);
@@ -2028,9 +2055,11 @@ void refreshImports(const Context& context, HostImports& state, const GuestAlloc
         static const bool trace = std::getenv("APS5_TRACE_HOST_IMPORT") != nullptr;
         if (trace && leasedRangeOwner(lease, it->first, it->first + it->second.bytes) != nullptr) std::fprintf(stderr, "[gpu] host import of 0x%llx+0x%llx retired: the range was mapped again\n", static_cast<unsigned long long>(it->first), static_cast<unsigned long long>(it->second.bytes));
         const auto next = std::next(it);
+        noteRetiredUnwatched(unwatched, it->second, lease);
         retireImport(context.device, state, it, lease);
         it = next;
     }
+    rewatchRetired(state, std::move(unwatched));
     for (auto it = state.failed.begin(); it != state.failed.end();) it = sameRange(it->second, lease, budget) ? std::next(it) : state.failed.erase(it);
     for (auto it = state.failedJoins.begin(); it != state.failedJoins.end();) it = sameRun(it->second, joinedRun(lease, it->second.base, it->second.base + it->second.bytes)) ? std::next(it) : state.failedJoins.erase(it);
     for (auto it = state.failedBlocks.begin(); it != state.failedBlocks.end();) it = sameRun(it->second, exactRun(lease, it->first.first, it->first.second)) ? std::next(it) : state.failedBlocks.erase(it);
diff --git a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
index ceacffde72..46e0eeebc6 100644
--- a/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/BdaResources.cpp
@@ -2110,6 +2110,64 @@ void importedHeapMirrorTests(const Context& context, const BdaTestAccess& access
     GuestArena::GuestArenaRelease_nid_postfix(block, bytes);
 }
 
+void retiredImportWatchTests(const Context& context) {
+#ifdef _WIN32
+    if (!GuestArena::GuestArenaAvailable_nid_postfix() || !GuestArena::GuestArenaWriteWatched_nid_postfix()) {
+        std::cout << "guest arena unavailable or not write-watched: the write watch of retired imports not tested\n";
+        return;
+    }
+    constexpr std::size_t piece = 65536;
+    constexpr std::size_t bytes = 2 * piece;
+    void* block = GuestArena::GuestArenaAllocate_nid_postfix(bytes, bytes);
+    GuestArena::GuestArenaCommit_nid_postfix(block, bytes, PAGE_READWRITE, bytes);
+    std::memset(block, 0x5a, bytes);
+    auto* guest = static_cast<std::uint8_t*>(block);
+    const auto address = reinterpret_cast<std::uintptr_t>(block);
+    auto importing = context;
+    importing.hostImportAlignment = piece;
+    SetHostImportWindow(bytes);
+    SetHostImportDeferredSettles(false);
+    ClearHostImports(importing.device);
+    const auto decided = PrepareImportWatch(importing);
+    SetImportWatch(importing, ImportWatch::Unwatch);
+    const auto registry = [&](std::size_t offset, bool add) {
+        auto* mutation = GuestAllocations::GuestAllocationsBegin_nid_postfix();
+        if (add) GuestAllocations::GuestAllocationsAdd_nid_postfix(mutation, guest + offset, piece, true, true, true);
+        else GuestAllocations::GuestAllocationsRemove_nid_postfix(mutation, guest + offset);
+        GuestAllocations::GuestAllocationsEnd_nid_postfix(mutation);
+    };
+    const auto build = [&] {
+        GuestBufferMemory leased(importing);
+        leased.AcquireRegistered();
+        leased.Upload(true);
+        leased.WriteBack();
+    };
+    registry(0, true);
+    build();
+    Require(HostImportCovers(importing, address, piece), "the first 64 KiB piece was not imported on its own");
+    Require(!AgcDriver::GuestMemory::Watched(address, piece), "an unwatched 64 KiB import kept its piece in the write watch");
+    registry(piece, true);
+    SetHostImportBudget(4096);
+    const auto before = MirrorCounters();
+    build();
+    Require(!HostImportCovers(importing, address, piece), "the piece's import outlived the run that grew past it, or a 128 KiB block fit a 4 KiB budget");
+    Require(AgcDriver::GuestMemory::Watched(address, piece), "a 64 KiB piece whose import retired when its run grew into a block stayed outside the write watch");
+    Require(MirrorCounters().heapMirrors == before.heapMirrors + 2, "a 64 KiB piece whose import retired when its run grew into a block was copied, not heap mirrored, once no import fit");
+    registry(piece, false);
+    registry(0, false);
+    build();
+    SetImportWatch(importing, decided);
+    ClearHostImports(importing.device);
+    SetHostImportBudget(0);
+    SetHostImportWindow(0);
+    SetHostImportDeferredSettles(true);
+    GuestArena::GuestArenaReset_nid_postfix(block, bytes);
+    GuestArena::GuestArenaRelease_nid_postfix(block, bytes);
+#else
+    static_cast<void>(context);
+#endif
+}
+
 void importedFreshTests(const Context& context) {
 #ifndef _WIN32
     if (!GuestWriteWatch::GuestWriteWatchAvailable_nid_postfix()) {
@@ -3441,6 +3499,7 @@ void RunBdaResourceTests(const Context& context, const BdaTestAccess& access) {
     importReportRefusalMemoryTests(context, access);
     heapMirrorTests(context, access);
     importedHeapMirrorTests(context, access);
+    retiredImportWatchTests(context);
     importWatchTests();
     importedFreshTests(context);
     gpuMappingTests(context);

From 65920e6fdc69f88b9d07c12e1568ceac08a6ead1 Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Wed, 21 Oct 2026 17:52:51 +0100
Subject: [PATCH 013/218] test(libc): cover CRT exit and TLS cleanup lifecycle

---
 core/libs/tests/GuestLibcThreads.cpp | 80 ++++++++++++++++++++++++++++
 docs/dev/debt/libc.md                |  4 ++
 2 files changed, 84 insertions(+)

diff --git a/core/libs/tests/GuestLibcThreads.cpp b/core/libs/tests/GuestLibcThreads.cpp
index 001558be39..5e296a0e5d 100644
--- a/core/libs/tests/GuestLibcThreads.cpp
+++ b/core/libs/tests/GuestLibcThreads.cpp
@@ -1,13 +1,20 @@
+#include "SceTypes.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <array>
 #include <atomic>
+#include <barrier>
 #include <chrono>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
+#include <limits>
 #include <stdexcept>
 #include <thread>
 
 extern "C" {
+int APS5_VABI scePthreadCreate(Pthread*, const PthreadAttr*, PthreadEntry, void*, const char*);
+int APS5_VABI scePthreadJoin(Pthread, void**);
+void APS5_VABI _Thrd_exit_nid_postfix(int);
 int APS5_VABI _Mtx_init_nid_postfix(void** handle, int type);
 void APS5_VABI _Mtx_destroy_nid_postfix(void** handle);
 int APS5_VABI _Mtx_lock_nid_postfix(void** handle);
@@ -263,6 +270,78 @@ static unsigned APS5_VABI TestPadGo(GuestPad* base) {
     return 42;
 }
 
+static void RequireExit(bool value, const char* message) {
+    if (!value) {
+        std::fprintf(stderr, "CRT exit lifecycle: %s\n", message);
+        std::abort();
+    }
+}
+
+struct CrtExitState {
+    int code = 0;
+    int key = -1;
+    std::barrier<>* ready = nullptr;
+    void* parent = nullptr;
+    void* self = nullptr;
+    std::atomic<unsigned> destructors{0};
+    std::atomic<bool> returned{false};
+};
+
+static void APS5_VABI CrtExitDestructor(void* value) {
+    auto& state = *static_cast<CrtExitState*>(value);
+    RequireExit(_Thrd_current_nid_postfix() == state.self, "identity during destructor");
+    RequireExit(_Tss_get_nid_postfix(state.key) == nullptr, "value cleared before destructor");
+    if (state.destructors.fetch_add(1) == 0)
+        RequireExit(_Tss_set_nid_postfix(state.key, &state) == 0, "reinstall value for another cleanup pass");
+}
+
+static void* APS5_VABI CrtExitEntry(void* value) {
+    auto& state = *static_cast<CrtExitState*>(value);
+    state.self = _Thrd_current_nid_postfix();
+    RequireExit(state.self && _Thrd_equal_nid_postfix(state.self, state.self) == 1, "current identity");
+    RequireExit(_Thrd_equal_nid_postfix(state.self, state.parent) == 0, "different parent identity");
+    RequireExit(_Tss_get_nid_postfix(state.key) == nullptr, "child starts with empty value");
+    RequireExit(_Tss_set_nid_postfix(state.key, &state) == 0, "set child value");
+    state.ready->arrive_and_wait();
+    RequireExit(_Tss_get_nid_postfix(state.key) == &state, "child value isolation");
+    _Thrd_exit_nid_postfix(state.code);
+    state.returned = true;
+    return nullptr;
+}
+
+static void ThreadExitLifecycle() {
+    constexpr std::array<int, 5> codes{0, 42, -1, std::numeric_limits<int>::min(), std::numeric_limits<int>::max()};
+    constexpr std::array<std::uintptr_t, 5> expected{0, 42, 0xffffffffu, 0x80000000u, 0x7fffffffu};
+    std::barrier ready(6);
+    std::array<CrtExitState, 5> states;
+    std::array<Pthread, 5> threads{};
+    int key = -1, parentValue = 31;
+    void* parent = _Thrd_current_nid_postfix();
+    RequireExit(_Tss_create_nid_postfix(&key, CrtExitDestructor) == 0, "create destructor key");
+    RequireExit(_Tss_set_nid_postfix(key, &parentValue) == 0, "set parent value");
+    for (unsigned i = 0; i < states.size(); ++i) {
+        states[i].code = codes[i];
+        states[i].key = key;
+        states[i].ready = &ready;
+        states[i].parent = parent;
+        RequireExit(scePthreadCreate(&threads[i], nullptr, CrtExitEntry, &states[i], "CRT exit audit") == 0, "create child");
+    }
+    RequireExit(_Tss_get_nid_postfix(key) == &parentValue, "parent isolated before release");
+    ready.arrive_and_wait();
+    for (unsigned i = 0; i < states.size(); ++i) {
+        void* result = nullptr;
+        RequireExit(scePthreadJoin(threads[i], &result) == 0, "join exiting child");
+        RequireExit(reinterpret_cast<std::uintptr_t>(result) == expected[i], "full zero-extended exit result");
+        RequireExit(!states[i].returned, "exit must not return");
+        RequireExit(states[i].destructors == 2, "reinstalled destructor runs twice before join returns");
+        RequireExit(states[i].self == threads[i], "created and current identity match");
+    }
+    RequireExit(_Tss_get_nid_postfix(key) == &parentValue, "parent isolated after children exit");
+    RequireExit(_Tss_delete_nid_postfix(key) == 0, "delete key");
+    RequireExit(_Tss_get_nid_postfix(key) == nullptr, "deleted key value unavailable");
+    std::puts("PASS CRT lifecycle: five concurrent exit codes, full return width, identity, parent/child isolation, two destructor passes, key deletion");
+}
+
 static void PadLaunchAndJoin() {
     unsigned (APS5_VABI* vtable[1])(GuestPad*) = {TestPadGo};
     TestPad unregPad{};
@@ -375,6 +454,7 @@ static void ForwardedCalls() {
 }
 
 int main() {
+    ThreadExitLifecycle();
     KernelKeys();
     ForwardedCalls();
     MutexBasics();
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index 581f589299..dd5684d3b9 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -1,5 +1,9 @@
 # libc technical debt
 
+### Silent stubs
+
+- [_Mtx_current_owns](../../../core/libs/prx/libc/src/Threads.cpp) (libSceLibcInternal, implemented in libc, NID `VYQwFs4CC4Y`) returns 1 and ignores its argument. This follows the PS5 12.00 body reading reported in [PR8859](https://github.com/boykopovar/AnyPS5/pull/8859), rather than inspecting host mutex ownership. The firmware observation is attributed to that contributor; other firmware versions and the argument's console type remain unverified.
+
 ### Unknown function info
 
 - [strtonum](../../../core/libs/prx/libc/src/StringExtensions.cpp) (libc) is unverified on the console. Its signature, decimal parsing, inclusive bounds, error strings, error precedence and errno preservation follow [FreeBSD 11.4 strtonum.c](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/lib/libc/stdlib/strtonum.c). Parsing uses the host `strtoll` with base 10.

From 05bd606cf78b3a013a923ce7e06b397d3bbe8d26 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:17:12 +0200
Subject: [PATCH 014/218] docs(agc): drop the duplicate pending-results debt
 entry left by the merge

---
 docs/dev/debt/libSceAgcDriver.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index b195d88cd2..6c8d150f31 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -109,7 +109,6 @@
 - [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched or whose page walk fails), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending saves its bytes through the unwatch hook, which also runs when a failed collect takes a range out of the watch. A range that leaves the watch without the hook running over it leaves its pending results without saved bytes; storing such results throws. A unit whose results were stored while its blocks were watched keeps only a generation; when its blocks leave the watch while nothing is pending, the hook saves nothing, and results that land in it afterwards have neither saved bytes nor a watch, so storing them throws too.
 - Windows host-pointer imports of the guest mapping itself are compared instead of write-watched, except writable imports of private `MEM_WRITE_WATCH` memory when the import probe keeps the write watch and a settle queue exists: those of 1 MiB or more stay watched, and smaller ones return to the watch once their settle has completed, unless a storage image overlaps them (see Pages under an import window): a driver can mark imported pages dirty after the synchronous import window. Shared memory imported through a separate writable alias retains protection-based tracking on the guest views; driver access to the import alias does not disarm those views. [GuestMemory](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) excludes every overlapping 64 KiB tracker block while its backing is retained. A full block replaced by fresh private backing regains tracking and gets a new generation; protection changes, partial replacements and shared remappings do not restore it. Excluded blocks keep their write-watch marks as a hint only (`UntrackedHint`): a storage image or a sampled texture snapshot over them compares its bytes again after a mark in its range, a driver store, a mapping change or a recorded GPU write instead of at every collect epoch or lookup, and a mark the driver makes without a CPU store costs one comparison. This preserves CPU edits through byte comparisons but limits snapshot reuse on excluded blocks to draws of one collect epoch and disables unit shadows for them; restoring tracking on import retirement without replacing the backing remains unimplemented.
 - [Pages under an import window](../../../core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp) (libSceAgcDriver) whose write protection was resolved while a host import that leaves its range watched was made are compared with the bytes they held before the import and count as stored over only when those differ. A CPU store of the bytes already there within the window cannot be told apart from an import that resolves the write protection without storing, as the NVIDIA driver (610.57.04) does for every imported page, so such a store does not win over pending results. Where host-pointer and dma-buf imports differ in whether they stay watched, a failed host-pointer import and the dma-buf import after it are two windows, and the pages the failed one resolved count as stored over. On Windows, the NVIDIA driver (617.42) marks every page of a host import of private `MEM_WRITE_WATCH` memory written, asynchronously, until a GPU use of the import completes; a 4-byte read of it on the settle queue ends that even while main-queue work that used the import first is still running, and an earlier import of the same pages whose first use runs after that read marks none of them (`agc_import_settle_first_use`, `agc_import_settle_earlier_import`). Such an import stays watched only after a 4-byte read of it on the settle queue has completed inside the window. Each one waits for that read, which keeps its window open for one round trip on the settle queue, so a same-value CPU store from another thread in that time counts as unchanged too. An import made where no settle queue exists is compared instead. An import of under 1 MiB is not settled inside its window, because the settle blocks the importing thread and a title that imports a 64 KiB buffer around every submission lost about 19 % of its frame rate to that wait (Dripl1x, #6060). It is compared until its read, submitted in a batch by a later import lookup under `GpuMutex` while the imports match the registry, has completed; a later lookup then returns its whole blocks to the write watch, each stamped as a CPU store, so whatever was derived from them while they were compared reads as changed once. Its blocks stay compared while storage results are pending over them, and those of an import retired before that stay compared.
-- [Pending storage-image results over memory outside the write watch](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver) leave to the CPU the 64 KiB blocks whose bytes differ from the ones saved at the upload, the fill, the image copy, the previous store or the moment their range left the watch (`Unwatch`, or a host import that does not stay watched or whose page walk fails), and the blocks the watch saw the CPU write before that moment. A store made on the GPU saves its bytes through a host-visible copy that becomes the saved bytes when its batch completes; a store or a refresh that needs them earlier waits for that batch. A unit without a write generation saves the guest bytes when results land in it outside the watch. One whose range leaves the watch while its results are pending, and ranges that leave the watch through the failed collect of a driver store or, on Linux, because their direct memory is mapped a second time, have no saved bytes; storing such results throws.
 - [Settled dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a dma-buf import of 1 MiB or more is read by a 4-byte copy on the settle queue right after it is made (`settleImport`), so the kernel maps its pages for the GPU there and not in the first submission that uses it (about 2 s for a 3 GiB import on RADV). The import's buffer is shared with the settle queue's family. An import made at map time settles on the guest thread that maps the range, inside its map call, so that thread waits while the kernel maps the pages: 0.47 to 2.2 s for the 3 GiB range of Hades (PPSA03355) and 0.49 to 4.3 s for the 4.5 GiB range of ASTRO BOT (PPSA21567) on RADV. Both titles map these ranges at start-up; a title that maps large ranges during gameplay stalls its mapping thread for as long. An import made from a submission settles under the GPU mutex, so its frame still pays for it; a smaller import, and every import on a device with no settle queue (one without a copy-capable queue besides the main one), pays in its first submission. A range imported through a host pointer, as lavapipe imports shared memory, is not settled
 - [Sparse dma-buf imports](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver): on Linux a shared-backed range larger than one 64 MiB udmabuf buffer is imported as one sparse buffer bound to the 64 MiB buffers, on a queue of its own when the device has a second family that binds sparse memory. The path is decided before anything is imported, and a failure after that throws. A range whose offset in the backing file is not a multiple of 64 KiB starts its sparse buffer at the 64 KiB block below it (`HostImport::lead`). A range takes the single udmabuf import instead, which udmabuf's `size_limit_mb` refuses above 64 MiB by default so the range is copied, when the buffer's sparse block size is larger than 64 KiB (it is 64 KiB on RADV), when the sparse buffer does not accept every memory type a chunk import can have, when the backing file ends inside its last chunk, or when it is imported at map time on a device with no second family (the bind then needs the GPU mutex); the NVIDIA proprietary driver imports no dma-buf memory
 - [Unnormalized S# coordinates](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestSamplerResource.cpp) (libSceAgcDriver) - `FORCE_UNNORMALIZED` uses a Vulkan `unnormalizedCoordinates` sampler, so the S# LOD range, LOD bias and mip filter are not applied, which is exact only on a one-level view.

From bae91578fe7a414b6a00749231fbe7bd4353dacd Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:48:39 +0200
Subject: [PATCH 015/218] test(agc): drop the unwalked-import storage test
 whose partly unwatched range now stays watched

---
 core/libs/prx/libSceAgcDriver/CMakeLists.txt  |  4 --
 .../prx/libSceAgcDriver/tests/Recorder.cpp    | 47 +++++--------------
 2 files changed, 13 insertions(+), 38 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index ab0803d7cf..4a6440642d 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -1497,10 +1497,6 @@ if(BUILD_TESTING)
         set_tests_properties(agc_storage_kept_unit_settle PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
-    if(NOT WIN32)
-        add_test(NAME agc_storage_unwalked_import COMMAND agc_driver_recorder_tests --unwalked-import-only)
-        set_tests_properties(agc_storage_unwalked_import PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 30)
-    endif()
     add_test(NAME agc_storage_baseline_settled COMMAND agc_driver_recorder_tests --settled-baseline-only)
     add_test(NAME agc_storage_clear_hand_over COMMAND agc_driver_recorder_tests --clear-hand-over-only)
     set_tests_properties(agc_storage_clear_hand_over PROPERTIES SKIP_RETURN_CODE 77)
diff --git a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
index 46233dc94f..97f02e7f2f 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Recorder.cpp
@@ -5352,51 +5352,41 @@ void importWatchTests(const Device& device) {
 #endif
 }
 
-template <bool StaysWatched>
-bool staleGenerationTests(const Device& device, Recorder& recorder) {
+void staleGenerationTests(const Device& device, Recorder& recorder) {
     const auto& base = device.GetContext();
 #ifdef _WIN32
     static_cast<void>(recorder);
     static_cast<void>(base);
     std::cout << "a range leaving the watch: Linux write watch only\n";
-    return false;
 #else
     if (base.hostImportAlignment == 0) {
         std::cout << "host imports unavailable: a range leaving the watch not tested\n";
-        return false;
+        return;
     }
     constexpr std::uint32_t side = 256;
     constexpr std::size_t surfaceBytes = side * side * 4;
     constexpr std::size_t keyCount = surfaceBytes / 256;
-    constexpr std::size_t lead = StaysWatched ? 65536 : 0;
-    constexpr std::size_t bytes = lead + surfaceBytes + 65536;
+    constexpr std::size_t bytes = surfaceBytes + 65536;
     void* block = AllocateWatched(bytes, 65536);
     if (block == nullptr) {
         std::cout << "no write watching: a range leaving the watch not tested\n";
-        return false;
+        return;
     }
     struct Release {
         void* block;
         ~Release() { ReleaseWatched(block, bytes); }
     } release{block};
     const auto decided = PrepareImportWatch(base);
-    SetImportWatch(base, StaysWatched ? ImportWatch::Watch : ImportWatch::Unwatch);
+    SetImportWatch(base, ImportWatch::Unwatch);
     struct Restore {
         const Context& context;
         ImportWatch decided;
         ~Restore() { SetImportWatch(context, decided); }
     } restore{base, decided};
-    struct Budget {
-        bool set;
-        ~Budget() {
-            if (set) SetHostImportBudget(0);
-        }
-    } budget{StaysWatched};
-    auto* texels = static_cast<std::uint8_t*>(block) + lead;
+    auto* texels = static_cast<std::uint8_t*>(block);
     std::memset(texels, 0x55, surfaceBytes);
     std::memset(texels + surfaceBytes, 0x00, keyCount);
-    const auto blockAddress = reinterpret_cast<std::uint64_t>(block);
-    const auto address = blockAddress + lead;
+    const auto address = reinterpret_cast<std::uint64_t>(block);
     {
         GuestAllocations::Mutation mutation;
         mutation.Add(block, bytes, true, true, true);
@@ -5412,7 +5402,7 @@ bool staleGenerationTests(const Device& device, Recorder& recorder) {
             }
             HostImportFor(context, address, bytes);
         }
-    } unregister{base, block, blockAddress};
+    } unregister{base, block, address};
     TextureDetiler detiler(base);
     auto context = base;
     context.detiler = &detiler;
@@ -5430,8 +5420,7 @@ bool staleGenerationTests(const Device& device, Recorder& recorder) {
     resource.dstSelW = 7;
     resource.dccAddress = address + surfaceBytes;
     {
-        Require(AgcDriver::GuestMemory::Watched(blockAddress, bytes), "(s) the block is not watched before the storage image takes its generation");
-        if constexpr (StaysWatched) SetHostImportBudget(1);
+        Require(AgcDriver::GuestMemory::Watched(address, bytes), "(s) the block is not watched before the storage image takes its generation");
         auto image = StorageTexture::Create(context, detiler, resource, 0);
         const VkImageSubresourceRange range{VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, 0, 1};
         const auto commands = recorder.Commands();
@@ -5442,20 +5431,13 @@ bool staleGenerationTests(const Device& device, Recorder& recorder) {
         context.Function<PFN_vkCmdClearColorImage>("vkCmdClearColorImage")(commands, image->Image(), VK_IMAGE_LAYOUT_GENERAL, &red, 1, &range);
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_SHADER_READ_BIT | VK_ACCESS_SHADER_WRITE_BIT | VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
         image->MarkDirty();
-        if constexpr (StaysWatched) {
-            SetHostImportBudget(0);
-            Require(!image->GuestSnapshotValid(), "(s) the pending results had saved guest bytes while their memory was watched");
-            AgcDriver::GuestMemory::Unwatch(blockAddress, lead);
-            Require(!AgcDriver::GuestMemory::Watched(blockAddress, lead) && AgcDriver::GuestMemory::Watched(address, bytes - lead), "(s) the block before the surface did not leave the watch alone");
-        }
-        const auto* import = HostImportFor(base, blockAddress, bytes);
+        const auto* import = HostImportFor(base, address, bytes);
         if (import == nullptr) {
             std::cout << "host import of the stale generation block refused: a range leaving the watch not tested\n";
             recorder.Sync();
-            return false;
+            return;
         }
-        Require(!AgcDriver::GuestMemory::Watched(blockAddress, bytes), "(s) the imported range stayed watched");
-        if constexpr (StaysWatched) Require(image->GuestSnapshotValid(), "(s) the results pending when a walk gave up the watch saved no guest bytes");
+        Require(!AgcDriver::GuestMemory::Watched(address, bytes), "(s) the imported range stayed watched");
         image->Refresh();
         Buffer readback(context, surfaceBytes, VK_BUFFER_USAGE_TRANSFER_DST_BIT);
         const auto copyCommands = recorder.Commands();
@@ -5479,7 +5461,6 @@ bool staleGenerationTests(const Device& device, Recorder& recorder) {
         for (std::size_t i = 0; i < surfaceBytes; ++i) Require(texels[i] == expected[i % 4], "(s) results pending when their memory left the watch did not reach it");
     }
     recorder.Sync();
-    return true;
 #endif
 }
 
@@ -10290,7 +10271,6 @@ int main(int argc, char** argv) {
             settledBaselineTests(device, recorder);
             return 0;
         }
-        if (argc == 2 && std::string_view(argv[1]) == "--unwalked-import-only") return staleGenerationTests<true>(device, recorder) ? 0 : 77;
         if (argc == 2 && std::string_view(argv[1]) == "--completion-labels-only") {
             completionCountTests(device, recorder);
             afterRecordedWorkTests(device, recorder);
@@ -10544,8 +10524,7 @@ int main(int argc, char** argv) {
         keptUnitSettleTests(device, recorder);
         settledBaselineTests(device, recorder);
         importWatchTests(device);
-        staleGenerationTests<false>(device, recorder);
-        staleGenerationTests<true>(device, recorder);
+        staleGenerationTests(device, recorder);
         importWindowTests(device, recorder);
         dataWordPositionsTests();
         dataRefreshTests(device, recorder);

From 175b8128a9f5171111f477591adb5af93fbd07e2 Mon Sep 17 00:00:00 2001
From: Ondra97 <47064087+Ondra97@users.noreply.github.com>
Date: Thu, 22 Oct 2026 06:41:27 +0200
Subject: [PATCH 016/218] fix(ult): preserve sync objects if finalization
 allocation fails

---
 core/libs/prx/libSceUlt/CMakeLists.txt    | 11 ++++
 core/libs/prx/libSceUlt/Export.cpp        |  2 +-
 core/libs/tests/UltFinalizeAllocation.cpp | 80 +++++++++++++++++++++++
 docs/dev/debt/libSceUlt.md                |  1 +
 4 files changed, 93 insertions(+), 1 deletion(-)
 create mode 100644 core/libs/tests/UltFinalizeAllocation.cpp

diff --git a/core/libs/prx/libSceUlt/CMakeLists.txt b/core/libs/prx/libSceUlt/CMakeLists.txt
index ea7e2f4a31..bf76efeb16 100644
--- a/core/libs/prx/libSceUlt/CMakeLists.txt
+++ b/core/libs/prx/libSceUlt/CMakeLists.txt
@@ -41,6 +41,17 @@ if(BUILD_TESTING)
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceUlt>")
         endif()
     endforeach()
+    add_test_executable(guest_ult_finalize_allocation_tests ${LIBS_INCLUDE_DIR}/tests/UltFinalizeAllocation.cpp Export.cpp src/ReaderWriterLock.cpp)
+    target_include_directories(guest_ult_finalize_allocation_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_ult_finalize_allocation_tests PRIVATE libc libkernel)
+    configure_windows_unwind(guest_ult_finalize_allocation_tests)
+    add_test(NAME guest_ult_finalize_allocation COMMAND guest_ult_finalize_allocation_tests)
+    set_tests_properties(guest_ult_finalize_allocation PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_ult_finalize_allocation PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+
     add_test_executable(guest_ult_sync_tests ${LIBS_INCLUDE_DIR}/tests/GuestUltSync.cpp)
     target_include_directories(guest_ult_sync_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_ult_sync_tests PRIVATE libSceUlt libc)
diff --git a/core/libs/prx/libSceUlt/Export.cpp b/core/libs/prx/libSceUlt/Export.cpp
index 63344b81f8..1a678113f2 100644
--- a/core/libs/prx/libSceUlt/Export.cpp
+++ b/core/libs/prx/libSceUlt/Export.cpp
@@ -152,6 +152,7 @@ int APS5_VABI sceUltFinalize() {
             return ULT_ERROR_BUSY;
         }
         semaphores.reserve(gSemaphores.size());
+        mutexes.reserve(gMutexes.size());
         for (auto& entry : gSemaphores) {
             auto& state = entry.second;
             std::lock_guard<std::mutex> stateLock(state->_mutex);
@@ -159,7 +160,6 @@ int APS5_VABI sceUltFinalize() {
             semaphores.push_back(state);
         }
         gSemaphores.clear();
-        mutexes.reserve(gMutexes.size());
         for (auto& entry : gMutexes) {
             auto& state = entry.second;
             std::lock_guard<std::mutex> stateLock(state->_mutex);
diff --git a/core/libs/tests/UltFinalizeAllocation.cpp b/core/libs/tests/UltFinalizeAllocation.cpp
new file mode 100644
index 0000000000..1e33589a89
--- /dev/null
+++ b/core/libs/tests/UltFinalizeAllocation.cpp
@@ -0,0 +1,80 @@
+#include "SceTypes.hpp"
+#include "prx/libSceUlt/SceUltTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <new>
+
+extern "C" {
+int APS5_VABI sceUltInitialize();
+int APS5_VABI sceUltFinalize();
+int APS5_VABI sceUltSemaphoreCreate(void*, const char*, std::uint32_t, void*, const void*, std::uint32_t);
+int APS5_VABI sceUltSemaphoreTryAcquire(void*, std::int32_t);
+int APS5_VABI sceUltSemaphoreRelease(void*, std::int32_t);
+int APS5_VABI sceUltMutexCreate(void*, const char*, void*, const UltMutexOptParam*, std::uint32_t);
+int APS5_VABI sceUltMutexTryLock(void*);
+int APS5_VABI sceUltMutexUnlock(void*);
+}
+
+static int allocationBudget = -1;
+static unsigned allocationAttempts = 0;
+
+void* operator new(std::size_t size) {
+    if (allocationBudget >= 0) {
+        ++allocationAttempts;
+        if (allocationBudget == 0) throw std::bad_alloc();
+        --allocationBudget;
+    }
+    if (void* memory = std::malloc(size ? size : 1)) return memory;
+    throw std::bad_alloc();
+}
+
+void operator delete(void* memory) noexcept { std::free(memory); }
+void operator delete(void* memory, std::size_t) noexcept { ::operator delete(memory); }
+
+struct alignas(8) Object { std::uint8_t bytes[256]{}; };
+
+static void Require(bool passed, const char* message) {
+    if (!passed) {
+        std::fprintf(stderr, "%s\n", message);
+        std::abort();
+    }
+}
+
+int main() {
+    Require(sceUltInitialize() == ULT_OK, "initialization failed");
+    unsigned failures = 0;
+    unsigned rejectedCases = 0;
+    for (int budget = 0; budget < 8; ++budget) {
+        Object semaphore{};
+        Object mutex{};
+        Require(sceUltSemaphoreCreate(&semaphore, "semaphore", 1, nullptr, nullptr, 0) == ULT_OK, "semaphore creation failed");
+        Require(sceUltMutexCreate(&mutex, "mutex", nullptr, nullptr, 0) == ULT_OK, "mutex creation failed");
+        allocationAttempts = 0;
+        allocationBudget = budget;
+        bool rejected = false;
+        int outcome = ULT_OK;
+        try { outcome = sceUltFinalize(); }
+        catch (const std::bad_alloc&) { rejected = true; }
+        allocationBudget = -1;
+
+        rejectedCases += rejected;
+        const int semaphoreResult = sceUltSemaphoreTryAcquire(&semaphore, 1);
+        const int mutexResult = sceUltMutexTryLock(&mutex);
+        if (semaphoreResult == ULT_OK) Require(sceUltSemaphoreRelease(&semaphore, 1) == ULT_OK, "semaphore release failed");
+        if (mutexResult == ULT_OK) Require(sceUltMutexUnlock(&mutex) == ULT_OK, "mutex unlock failed");
+        const int expected = rejected ? ULT_OK : ULT_ERROR_STATE;
+        if (outcome != ULT_OK || semaphoreResult != expected || mutexResult != expected) {
+            std::fprintf(stderr, "budget=%d rejected=%d attempts=%u semaphore=%d mutex=%d\n",
+                         budget, rejected, allocationAttempts, semaphoreResult, mutexResult);
+            ++failures;
+        }
+        if (rejected) Require(sceUltFinalize() == ULT_OK, "finalization retry failed");
+        Require(sceUltSemaphoreTryAcquire(&semaphore, 1) == ULT_ERROR_STATE, "finalized semaphore is still live");
+        Require(sceUltMutexTryLock(&mutex) == ULT_ERROR_STATE, "finalized mutex is still live");
+    }
+    std::printf("finalization allocation budgets: 8 cases, %u rejections, %u incorrect lifecycles\n", rejectedCases, failures);
+    return failures == 0 ? 0 : 1;
+}
diff --git a/docs/dev/debt/libSceUlt.md b/docs/dev/debt/libSceUlt.md
index 12002369d2..9d4da09a0c 100644
--- a/docs/dev/debt/libSceUlt.md
+++ b/docs/dev/debt/libSceUlt.md
@@ -11,6 +11,7 @@
 - [sceUltMutexTryLock, the reader-writer lock and sceUltUlthreadGetSelf, sceUltUlthreadYield and sceUltUlthreadExit](../../../core/libs/prx/libSceUlt/src/ReaderWriterLock.cpp) (libSceUlt) - the signatures follow the PS Vita libult in [RPCS3](https://github.com/RPCS3/rpcs3/blob/13aa88c3c4d66ea8799e987f7d762d90943ab17b/rpcs3/Emu/PSP2/Modules/sceUlt.cpp) (a 256-byte lock and 128-byte option structures), not a PS5 binary. The rules are assumed: readers may take the lock while a writer waits, a thread that holds the write lock gets `ULT_ERROR_STATE` for any further lock instead of waiting on itself, a reader asking for the write lock waits on its own read lock, and the try forms return `ULT_ERROR_BUSY`. Outside an ulthread, `sceUltUlthreadGetSelf`, `sceUltUlthreadYield` and `sceUltUlthreadExit` return `ULT_ERROR_STATE`; inside one they act on the guest thread it runs on, since ulthreads are not scheduled cooperatively here
 ### Functional
 
+- [sceUltFinalize](../../../core/libs/prx/libSceUlt/Export.cpp) - allocator-failure behavior is unverified on a PS5. The host may throw `std::bad_alloc` while reserving temporary wake lists; guest waiting-pool exhaustion and native finalization errors are not modeled.
 - [libSceUlt queues](../../../core/libs/prx/libSceUlt/Export.cpp) use preallocated host storage instead of the supplied guest work area; the guest object layouts remain incomplete. Waiting-queue pool thread limits and waiter priority ordering are not implemented. Finalization wakes blocked queue callers with `ULT_ERROR_STATE`.
 - [sceUltWaitingQueueResourcePoolDestroy](../../../core/libs/prx/libSceUlt/Export.cpp) refuses with `ULT_ERROR_STATE` only when a thread is currently waiting on a pool-backed mutex, semaphore or queue, matching the PS5 libSceUlt disassembly (0x473a in or55417wcDk); bound but idle objects do not block pool destruction. Waiting-queue pool guest work area node accounting is not implemented.
 - The following pending declarations have unverified signatures and behavior; they are parameterless import-resolution declarations and throw through `NotImplemented_nid_no_patch`: [`_sceUltConditionVariableOptParamInitialize`](../../../core/libs/prx/libSceUlt/Export.cpp).

From 3b60592ce420925673c2605fe26d54511e02c388 Mon Sep 17 00:00:00 2001
From: Ondra97 <47064087+Ondra97@users.noreply.github.com>
Date: Thu, 22 Oct 2026 08:53:06 +0200
Subject: [PATCH 017/218] test(libSceUlt): disarm allocation fault before
 throwing

---
 core/libs/tests/UltFinalizeAllocation.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/libs/tests/UltFinalizeAllocation.cpp b/core/libs/tests/UltFinalizeAllocation.cpp
index 1e33589a89..575d3da836 100644
--- a/core/libs/tests/UltFinalizeAllocation.cpp
+++ b/core/libs/tests/UltFinalizeAllocation.cpp
@@ -24,7 +24,10 @@ static unsigned allocationAttempts = 0;
 void* operator new(std::size_t size) {
     if (allocationBudget >= 0) {
         ++allocationAttempts;
-        if (allocationBudget == 0) throw std::bad_alloc();
+        if (allocationBudget == 0) {
+            allocationBudget = -1;
+            throw std::bad_alloc();
+        }
         --allocationBudget;
     }
     if (void* memory = std::malloc(size ? size : 1)) return memory;

From 4fb4187bd327a33cb139959d596c46782c3ac08d Mon Sep 17 00:00:00 2001
From: ArjenS-LA <arjensingh@outlook.com>
Date: Thu, 22 Oct 2026 00:02:38 -0700
Subject: [PATCH 018/218] fix(libkernel): classify Windows directory links by
 app0 scope

---
 core/libs/prx/libkernel/CMakeLists.txt        |   7 +
 .../File/src/DirectoryDescriptor.cpp          |  61 +++++-
 .../tests/GuestWindowsDirectoryLinkTypes.cpp  | 202 ++++++++++++++++++
 docs/dev/debt/libkernel.md                    |   1 +
 4 files changed, 266 insertions(+), 5 deletions(-)
 create mode 100644 core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp

diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt
index 635db8b212..0d5ba7dce4 100644
--- a/core/libs/prx/libkernel/CMakeLists.txt
+++ b/core/libs/prx/libkernel/CMakeLists.txt
@@ -1689,6 +1689,13 @@ if(BUILD_TESTING)
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
     endif()
     if(WIN32)
+        add_test_executable(guest_windows_directory_link_types_tests ${LIBS_INCLUDE_DIR}/tests/GuestWindowsDirectoryLinkTypes.cpp)
+        target_include_directories(guest_windows_directory_link_types_tests PRIVATE ${LIBS_INCLUDE_DIR})
+        target_link_libraries(guest_windows_directory_link_types_tests PRIVATE libkernel libc)
+        configure_windows_unwind(guest_windows_directory_link_types_tests)
+        add_test(NAME guest_windows_directory_link_types COMMAND guest_windows_directory_link_types_tests)
+        set_tests_properties(guest_windows_directory_link_types PROPERTIES TIMEOUT 15 ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
         add_test_executable(guest_directory_buffer_tests ${LIBS_INCLUDE_DIR}/tests/GuestDirectoryBuffer.cpp)
         target_include_directories(guest_directory_buffer_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(guest_directory_buffer_tests PRIVATE libkernel libc)
diff --git a/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp b/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp
index e140a6b0f4..58e97e8c80 100644
--- a/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp
+++ b/core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp
@@ -10,6 +10,7 @@
 
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libkernel/File/include/NativeStat.hpp"
 
 #include <cerrno>
 #include <cstdint>
@@ -30,8 +31,10 @@
 
 namespace {
 
+constexpr std::uint8_t GuestUnknownType = 0;
 constexpr std::uint8_t GuestDirectoryType = 4;
 constexpr std::uint8_t GuestRegularType = 8;
+constexpr std::uint8_t GuestSymbolicLinkType = 10;
 
 struct DirectoryState {
     std::mutex mutex;
@@ -50,18 +53,66 @@ std::shared_ptr<DirectoryState> Find(int fd) {
     return found == g_directories.end() ? nullptr : found->second;
 }
 
+bool InsideApp0(const std::filesystem::path& directory) {
+    const auto root = ResolveDiskPath_nid_no_patch("/app0");
+    const auto handle = CreateFileW(root.c_str(), FILE_READ_ATTRIBUTES,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, nullptr, OPEN_EXISTING,
+        FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    if (handle == INVALID_HANDLE_VALUE) return false;
+    const int descriptor = ::_open_osfhandle(reinterpret_cast<std::intptr_t>(handle), _O_RDONLY | _O_BINARY);
+    if (descriptor < 0) {
+        CloseHandle(handle);
+        return false;
+    }
+    const auto app0 = File::WindowsDescriptorPath_nid_no_patch(descriptor);
+    ::_close(descriptor);
+    if (!app0) return false;
+    auto entry = directory.begin();
+    for (const auto& component : *app0) {
+        if (entry == directory.end()) return false;
+        const auto& left = entry->native();
+        const auto& right = component.native();
+        if (CompareStringOrdinal(left.c_str(), static_cast<int>(left.size()),
+                right.c_str(), static_cast<int>(right.size()), TRUE) != CSTR_EQUAL) return false;
+        ++entry;
+    }
+    return true;
+}
+
+std::uint8_t EntryType(const std::filesystem::path& path, bool followLinks) {
+    FileStat status{};
+    if (!File::FillLinkStat(path, &status))
+        return GuestUnknownType;
+    if (followLinks && (status.st_mode & 0170000) == 0120000) {
+        FileStat target{};
+        const int savedErrno = errno;
+        const bool found = File::TryFillFileStat(path, &target);
+        errno = savedErrno;
+        if (found && ((target.st_mode & 0170000) == 0040000 || (target.st_mode & 0170000) == 0100000))
+            status = target;
+    }
+    switch (status.st_mode & 0170000) {
+        case 0040000: return GuestDirectoryType;
+        case 0100000: return GuestRegularType;
+        case 0120000: return GuestSymbolicLinkType;
+        default: NotImplemented_nid_no_patch("getdents of a Windows file type other than a directory, regular file or symbolic link");
+    }
+}
+
 void Load(DirectoryState& state, int fd) {
     if (state.loaded) return;
     const auto path = File::WindowsDescriptorPath_nid_no_patch(fd);
     if (!path) throw std::system_error(errno, std::generic_category(), "directory descriptor path");
-    state.loaded = true;
-    state.entries.emplace_back(".", GuestDirectoryType);
-    state.entries.emplace_back("..", GuestDirectoryType);
+    const int savedErrno = errno;
+    const bool followLinks = InsideApp0(*path);
+    errno = savedErrno;
+    std::vector<std::pair<std::string, std::uint8_t>> entries{{".", GuestDirectoryType}, {"..", GuestDirectoryType}};
     std::error_code error;
     for (const auto& entry : std::filesystem::directory_iterator(*path, error)) {
-        std::error_code typeError;
-        state.entries.emplace_back(entry.path().filename().string(), entry.is_directory(typeError) ? GuestDirectoryType : GuestRegularType);
+        entries.emplace_back(entry.path().filename().string(), EntryType(entry.path(), followLinks));
     }
+    state.entries = std::move(entries);
+    state.loaded = true;
 }
 
 int OpenStreamDirectory(const wchar_t* path) {
diff --git a/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
new file mode 100644
index 0000000000..4278bdaf41
--- /dev/null
+++ b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
@@ -0,0 +1,202 @@
+#include "SceTypes.hpp"
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel/File/include/FileFlags.hpp"
+#include <windows.h>
+#include <winioctl.h>
+#include <array>
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <fstream>
+#include <map>
+#include <string>
+#include <vector>
+
+extern "C" {
+int APS5_VABI sceKernelOpen(const char*, int, std::uint16_t);
+int APS5_VABI sceKernelClose(int);
+int APS5_VABI sceKernelGetdents(int, char*, int);
+int APS5_VABI lstat_nid_postfix(const char*, FileStat*);
+}
+
+static void Check(bool value, int line) {
+    if (!value) {
+        std::fprintf(stderr, "Directory link type check failed at line %d\n", line);
+        std::exit(1);
+    }
+}
+
+#define Require(value) Check((value), __LINE__)
+
+static void Junction(const std::filesystem::path& link, const std::filesystem::path& target) {
+    Require(std::filesystem::create_directory(link));
+    const auto printName = std::filesystem::absolute(target).make_preferred().wstring();
+    const auto substituteName = L"\\??\\" + printName;
+    struct MountPoint {
+        ULONG tag;
+        USHORT dataLength;
+        USHORT reserved;
+        USHORT substituteOffset;
+        USHORT substituteLength;
+        USHORT printOffset;
+        USHORT printLength;
+        wchar_t names[2048];
+    } data{};
+    Require(substituteName.size() + printName.size() + 2 <= std::size(data.names));
+    data.tag = IO_REPARSE_TAG_MOUNT_POINT;
+    data.substituteLength = static_cast<USHORT>(substituteName.size() * sizeof(wchar_t));
+    data.printOffset = static_cast<USHORT>((substituteName.size() + 1) * sizeof(wchar_t));
+    data.printLength = static_cast<USHORT>(printName.size() * sizeof(wchar_t));
+    data.dataLength = static_cast<USHORT>(8 + data.printOffset + data.printLength + sizeof(wchar_t));
+    std::memcpy(data.names, substituteName.c_str(), data.substituteLength + sizeof(wchar_t));
+    std::memcpy(reinterpret_cast<char*>(data.names) + data.printOffset, printName.c_str(), data.printLength + sizeof(wchar_t));
+    const auto handle = CreateFileW(link.c_str(), GENERIC_WRITE, 0, nullptr, OPEN_EXISTING,
+        FILE_FLAG_OPEN_REPARSE_POINT | FILE_FLAG_BACKUP_SEMANTICS, nullptr);
+    Require(handle != INVALID_HANDLE_VALUE);
+    DWORD returned = 0;
+    const auto result = DeviceIoControl(handle, FSCTL_SET_REPARSE_POINT, &data, 8 + data.dataLength, nullptr, 0, &returned, nullptr);
+    Require(CloseHandle(handle) != 0);
+    Require(result != 0);
+}
+
+static void OutsideApp0() {
+    const auto root = std::filesystem::absolute("anyps5-directory-links-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directory(root));
+    Require(std::filesystem::create_directory(root / "directory"));
+    { std::ofstream file(root / "regular"); file << "data"; }
+    std::vector<std::string> links{"junction", "dangling-junction", "loop-junction"};
+    Junction(root / links[0], root / "directory");
+    Junction(root / links[1], root / "missing");
+    Junction(root / links[2], root / links[2]);
+    if (CreateSymbolicLinkW((root / "file-link").c_str(), L"regular", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        links.push_back("file-link");
+        Require(CreateSymbolicLinkW((root / "directory-link").c_str(), L"directory",
+            SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        links.push_back("directory-link");
+        Require(CreateSymbolicLinkW((root / "dangling-link").c_str(), L"missing", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        links.push_back("dangling-link");
+    } else {
+        Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+        std::fprintf(stderr, "Symbolic-link cases require Windows developer mode or symbolic-link privilege; junction cases still run\n");
+    }
+    const int descriptor = sceKernelOpen(root.string().c_str(), SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(descriptor >= 0);
+    std::map<std::string, std::uint8_t> entries;
+    std::array<char, 64> buffer{};
+    for (;;) {
+        const int bytes = sceKernelGetdents(descriptor, buffer.data(), static_cast<int>(buffer.size()));
+        Require(bytes >= 0 && bytes <= static_cast<int>(buffer.size()));
+        if (bytes == 0) break;
+        for (int offset = 0; offset < bytes;) {
+            std::uint16_t length = 0;
+            std::memcpy(&length, buffer.data() + offset + 4, sizeof(length));
+            const auto nameLength = static_cast<std::uint8_t>(buffer[offset + 7]);
+            Require(length >= 8 + nameLength + 1 && offset + length <= bytes);
+            const std::string name(buffer.data() + offset + 8, nameLength);
+            Require(entries.emplace(name, static_cast<std::uint8_t>(buffer[offset + 6])).second);
+            offset += length;
+        }
+    }
+    Require(sceKernelClose(descriptor) == 0);
+    Require(entries.size() == links.size() + 4);
+    Require(entries.at(".") == 4 && entries.at("..") == 4);
+    Require(entries.at("directory") == 4 && entries.at("regular") == 8);
+    for (const auto& name : links) {
+        if (entries.at(name) != 10)
+            std::fprintf(stderr, "%s: getdents type %u, expected DT_LNK (10)\n", name.c_str(), entries.at(name));
+        Require(entries.at(name) == 10);
+        const auto path = root / name;
+        FileStat status{};
+        Require(lstat_nid_postfix(path.string().c_str(), &status) == 0);
+        Require((status.st_mode & 0170000) == 0120000);
+    }
+    for (const auto& name : links) Require(std::filesystem::remove(root / name));
+    Require(std::filesystem::remove_all(root) == 3);
+}
+
+
+static std::map<std::string, std::uint8_t> Types(const char* path) {
+    const int descriptor = sceKernelOpen(path, SCE_KERNEL_O_RDONLY | SCE_KERNEL_O_DIRECTORY, 0);
+    Require(descriptor >= 0);
+    std::map<std::string, std::uint8_t> entries;
+    std::array<char, 64> buffer{};
+    for (;;) {
+        const int bytes = sceKernelGetdents(descriptor, buffer.data(), static_cast<int>(buffer.size()));
+        Require(bytes >= 0 && bytes <= static_cast<int>(buffer.size()));
+        if (bytes == 0) break;
+        for (int offset = 0; offset < bytes;) {
+            std::uint16_t length = 0;
+            std::memcpy(&length, buffer.data() + offset + 4, sizeof(length));
+            const auto nameLength = static_cast<std::uint8_t>(buffer[offset + 7]);
+            Require(length >= 8 + nameLength + 1 && offset + length <= bytes);
+            Require(entries.emplace(std::string(buffer.data() + offset + 8, nameLength),
+                static_cast<std::uint8_t>(buffer[offset + 6])).second);
+            offset += length;
+        }
+    }
+    Require(sceKernelClose(descriptor) == 0);
+    return entries;
+}
+
+int main() {
+    const auto previous = std::filesystem::current_path();
+    const auto root = previous / ("anyps5-app0-links-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    Require(std::filesystem::create_directories(root / "app0" / "real"));
+    Require(std::filesystem::create_directories(root / "external"));
+    Require(std::filesystem::create_directories(root / "data"));
+    Require(std::filesystem::create_directories(root / "app0-sibling"));
+    std::filesystem::current_path(root);
+    OutsideApp0();
+    std::vector<std::filesystem::path> links;
+    const auto junction = [&](const std::filesystem::path& link, const std::filesystem::path& target) {
+        Junction(root / link, root / target);
+        links.push_back(link);
+    };
+    junction("app0/packed", "external");
+    junction("app0/chain", "app0/packed");
+    junction("app0/dangling", "missing");
+    junction("app0/loop", "app0/loop");
+    junction("app0/real/nested", "external");
+    junction("external/nested", "app0/real");
+    junction("data/saved", "external");
+    junction("app0-sibling/saved", "external");
+    { std::ofstream file(root / "external/regular"); file << "data"; }
+    const bool symbolic = CreateSymbolicLinkW((root / "app0/file-link").c_str(), L"../external/regular",
+        SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0;
+    if (symbolic) {
+        links.push_back("app0/file-link");
+        Require(CreateSymbolicLinkW((root / "app0/relative").c_str(), L"../external",
+            SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
+        links.push_back("app0/relative");
+    } else {
+        Require(GetLastError() == ERROR_PRIVILEGE_NOT_HELD);
+        std::fprintf(stderr, "app0 symbolic-link subcases skipped: privilege unavailable\n");
+    }
+    auto app0 = Types("/app0");
+    std::fprintf(stderr, "app0 packed/chain/real types: %u/%u/%u (expected 4/4/4)\n", app0.at("packed"), app0.at("chain"), app0.at("real"));
+    Require(app0.at("real") == 4 && app0.at("packed") == 4 && app0.at("chain") == 4);
+    Require(app0.at("dangling") == 10 && app0.at("loop") == 10);
+    if (symbolic) Require(app0.at("file-link") == 8 && app0.at("relative") == 4);
+    Require(Types("/app0/real").at("nested") == 4);
+    Require(Types("/app0/packed").at("nested") == 10);
+    Require(Types("/data").at("saved") == 10);
+    Require(Types((root / "app0-sibling").string().c_str()).at("saved") == 10);
+    FileStat status{};
+    Require(lstat_nid_postfix("/app0/packed", &status) == 0 && (status.st_mode & 0170000) == 0120000);
+    for (auto it = links.rbegin(); it != links.rend(); ++it) Require(std::filesystem::remove(root / *it));
+    std::filesystem::rename(root / "app0", root / "application");
+    Junction(root / "app0", root / "application");
+    Junction(root / "application/packed", root / "external");
+    Require(Types("/app0").at("packed") == 4);
+    Require(std::filesystem::remove(root / "application/packed"));
+    Require(std::filesystem::remove(root / "app0"));
+    std::filesystem::current_path(previous);
+    Require(root.parent_path() == previous && root.filename().string().starts_with("anyps5-app0-links-"));
+    std::filesystem::remove_all(root);
+    std::puts("Windows directory link type tests passed");
+}
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 1f218e02a6..655556be0f 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -137,6 +137,7 @@
 - [sceKernelWriteThrottlingStatus](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) reports no write throttling: the host SSD has no write budget, so the first qword of the 32-byte status is set to `UINT32_MAX` and the rest is zeroed; returns `EFAULT` (`0x8002000e`) when passed a null status buffer pointer. PPSA17221 reads only that qword: it multiplies it by 64 KiB and compares the product with byte thresholds up to 0x4AF00000 to pick one of five tiers. When the call fails the title assumes 0x4B000001 bytes, which selects the same top tier as `UINT32_MAX`. What the value measures on hardware (a remaining budget or a rate) and the meaning of the other three qwords are unknown
 - [Windows directory descriptors](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) take one snapshot of the directory, on the first `getdents`, `getdirentries` or non-zero `lseek` (`SEEK_SET` or `SEEK_CUR`), and keep it until it is discarded; `lseek` to offset 0 only discards the snapshot, and the next read lists the directory again, so every rewind costs O(entries) on the next read. `lseek` takes the offset as an entry index and `SEEK_CUR` with offset 0 only reports the index. `SEEK_END` throws because FreeBSD defines it relative to the directory size, which is not modelled. A negative result returns `EINVAL` and a `SEEK_CUR` offset that overflows returns `EOVERFLOW`, as FreeBSD `vn_seek` reports them. Names whose UTF-8 encoding exceeds the one-byte `d_namlen` limit are not representable in this guest directory-record layout: `getdents` returns `ENAMETOOLONG` without consuming the entry. Repeated calls therefore report the same error and entries after that name cannot be reached through this descriptor; FreeBSD's `getdents` behavior for host filenames that exceed its `MAXNAMLEN` is not verified. `getdirentries` still reports 0 through `basep` instead of the position of the block it read, so only 0 and values returned by `lseek` are valid offsets; FreeBSD offsets are filesystem cookies. Descriptors retain the opened directory's native handle across renames. Enumeration reloads and `*at` operations resolve its current path, so a concurrent rename between resolution and the operation is not atomic. Enumeration of a removed directory and network-share path queries have not been verified
 - [ftruncate, truncate, sceKernelFtruncate](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) extend a file on Windows with `SetFileInformationByHandle` (`FileEndOfFileInfo`), which reserves the clusters but writes no zero bytes, and report `EFBIG` for a length the volume cannot hold (`ERROR_INVALID_PARAMETER` on a disk file; seen with a length of `INT64_MAX`, the size from which NTFS refuses it was not measured) and `ENOSPC` when the free space is smaller. FreeBSD 11.4 makes the extension a hole on a file system that has them ([`ffs_truncate`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/ufs/ffs/ffs_inode.c) writes only the last block), so a length above the free space succeeds there. A write behind the end of the file still makes NTFS write zero bytes over the gap, as the file is not sparse. None of this was measured on a console.
+- [Windows directory entry types](../../../core/libs/prx/libkernel/File/src/DirectoryDescriptor.cpp) (libkernel) - types other than regular files, directories and symbolic links, and reparse points unsupported by `lstat`, throw. If the host cannot stat an entry, its type is `DT_UNKNOWN`. Console directory-entry types have not been measured; the host `lstat` modes map to `DT_REG`, `DT_DIR` and `DT_LNK` following [FreeBSD 11.4 dirent.h](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/sys/dirent.h). A host link inside canonical app0 is reported as its target's type (directory or regular file); a link elsewhere, or a dangling one, stays a link. A directory opened through an app0 link resolves to its target's host path, so links nested inside a target outside app0 keep the link type.
 - [readv, writev, preadv, pwritev and their sceKernel forms](../../../core/libs/prx/libkernel/File/src/Stdio.cpp) (libkernel) - unreadable iovec-table errors follow FreeBSD 11.4's [`copyinuio`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/subr_uio.c#L401-L434), not console measurements. The table is copied before inspecting its entries; payload-buffer validation is unchanged. A Linux `process_vm_readv` failure other than `EFAULT` throws, including when the host denies that API.
 - [/dev/random and /dev/urandom](../../../core/libs/prx/libkernel/File/src/RandomDevice.cpp) (libkernel) opened for reading return a descriptor backed by the host null device whose reads are filled with host OS entropy (`getentropy`, `rand_s` on Windows); both paths behave the same, never block, and positioned reads ignore the offset (FreeBSD `random(4)`). Only the exact paths are recognised, `fstat`, `lseek` and `mmap` see the null device, and opening them for writing throws
 - [pthread_attr_getinheritsched, pthread_attr_setinheritsched, pthread_attr_getscope, pthread_attr_setscope, pthread_attr_getstackaddr](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) follow FreeBSD 11 libthr ([thr_attr.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libthr/thread/thr_attr.c), [thr_create.c](https://github.com/freebsd/freebsd-src/blob/5ed7eb0d97ba4436218e810f61bd059acba984c2/lib/libthr/thread/thr_create.c)), not measured on the console: the scope defaults to `PTHREAD_SCOPE_SYSTEM` (2), only it and `PTHREAD_SCOPE_PROCESS` (0) are accepted and other values return `EINVAL`, and an inherit value other than `PTHREAD_INHERIT_SCHED` (4) or `PTHREAD_EXPLICIT_SCHED` (0) returns `ENOTSUP`. `pthread_attr_getstackaddr` returns the configured stack address pointer (null by default). A null output of `pthread_attr_getinheritsched` throws, since libthr writes through it unchecked. A thread keeps the scope it was created with, taken from the creating thread under `PTHREAD_INHERIT_SCHED`, and `pthread_attr_get_np` and `scePthreadAttrGet` report it, but every guest thread is a host thread at system scope, so process scope changes nothing

From 408a656e7b2e507fbf2db7eda43033cdbc53ad9a Mon Sep 17 00:00:00 2001
From: Lindamea1 <322051987+Lindamea1@users.noreply.github.com>
Date: Tue, 20 Oct 2026 18:41:26 +0100
Subject: [PATCH 019/218] fix(agc): put a stencil replay shader's guest buffer
 offsets where its shader data is

A pixel shader whose stencil export is replayed gets a push constant
block that ends with the stencil reference word. When its shader data
is not in push constants (registration modules give a shader with an
image a shader data buffer, and data over the stage push range goes
there too), the block holds only that word, and buildPrepare took any
non-empty block to mean the guest buffer offsets are in push
constants: the draw threw "guest buffer offset lies outside the
shader's push constants". Only the stencilReferenceDword words before
the reference now count as shader data in push constants; with none,
the offsets go to the shader data buffer, where the shader reads them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Graphics/src/ShaderResources.cpp          |  5 ++--
 .../tests/execution/StencilReplay.cpp         | 23 +++++++++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
index d6d84cd4aa..d62578d410 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
@@ -1986,9 +1986,10 @@ void ShaderResources::buildPrepare(std::span<const CompiledShader> shaders, cons
                         const bool classified = element < binding.bufferWritten.size() && element < binding.bufferRead.size() && element < binding.bufferAtomic.size();
                         allocations[index].writeOnly = classified && allocations[index].guest && allocations[index].written && binding.bufferWritten[element] && !read && !atomic;
                         const auto& push = shader.program->pushConstants;
-                        if (!push.empty()) {
+                        const auto pushDataBytes = shader.program->stencilReferences.empty() ? push.size() : shader.program->stencilReferenceDword * sizeof(std::uint32_t);
+                        if (pushDataBytes != 0u) {
                             const auto position = shader.program->memoryOffsetDword * 4u + element;
-                            Require(position < push.size(), "guest buffer offset lies outside the shader's push constants");
+                            Require(position < pushDataBytes, "guest buffer offset lies outside the shader's push constants");
                             allocations[index].pushByte = static_cast<std::int32_t>(shader.pushConstantOffset + position);
                         } else {
                             allocations[index].dataByte = shader.program->memoryOffsetDword * 4u + element;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
index 3612fae6ef..2f150274b0 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
@@ -369,6 +369,29 @@ int main() {
         catch (const std::exception& error) { faultThrown = std::string(error.what()).find("BDA") != std::string::npos; }
         Require(faultThrown, "poisoned readonly SRT replay did not throw a host fault");
         Require(std::ranges::all_of(Pixels, [](std::byte value) { return value == Kept; }), "poisoned replay published guest color results before its fault");
+        alignas(256) std::array<std::uint32_t, Width + 1u> columnValues{};
+        alignas(256) std::array<float, Width> columnTexels{};
+        columnValues[0] = 0x2fu;
+        for (std::uint32_t x = 0; x < Width; ++x) {
+            columnValues[x + 1u] = 0x30u + x;
+            columnTexels[x] = 1.0f;
+        }
+        constexpr std::array<std::uint32_t, 15> bufferImageCode{
+            0x7e060f00u, 0x7e080280u, 0xf0001108u, 0x00010503u, 0xe0302000u, 0x80000603u, 0xe0302000u, 0x80030803u,
+            0xbf8c3f70u, 0x7e0e02f2u, 0xf8000082u, 0x00000600u, 0xf800180fu, 0x07050805u, 0xbf810000u,
+        };
+        const auto columnBuffer = BufferDescriptor(columnValues.data() + 1, 4u, Width);
+        const auto alignedBuffer = BufferDescriptor(columnValues.data(), 4u, Width + 1u);
+        const auto texelAddress = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(columnTexels.data()));
+        const std::array<std::uint32_t, 8> columnTexture{static_cast<std::uint32_t>(texelAddress >> 8u), static_cast<std::uint32_t>((texelAddress >> 40u) & 0xffu) | (22u << 20u) | (((Width - 1u) & 3u) << 30u), (Width - 1u) >> 2u, 0xfacu | (9u << 28u), 0u, 0u, 0u, 0u};
+        std::vector<std::uint32_t> bufferImageData(columnBuffer.begin(), columnBuffer.end());
+        bufferImageData.insert(bufferImageData.end(), columnTexture.begin(), columnTexture.end());
+        bufferImageData.insert(bufferImageData.end(), alignedBuffer.begin(), alignedBuffer.end());
+        Draw(*device, PlainPixelCode, plain, replace(0u));
+        Draw(*device, bufferImageCode, exported, replace(), 3u, 1u, false, {}, {}, Vertices, VertexCode, bufferImageData);
+        Check(all, "a replayed export beside an image draws the image's texels");
+        Draw(*device, PlainPixelCode, plain, equal(0x35u));
+        Check([](std::uint32_t x, std::uint32_t) { return x == 5u; }, "a replayed export beside an image reads its guest buffer at a 4-byte offset");
         std::puts("stencil replay tests passed");
         return 0;
     } catch (const std::exception& error) {

From 15803c7f1a3a2323459399bcaab0fe405931abbb Mon Sep 17 00:00:00 2001
From: battleblob1 <battleblob1@gmail.com>
Date: Thu, 22 Oct 2026 00:40:11 +0300
Subject: [PATCH 020/218] test(agc): replay a stencil export whose shader data
 is in a buffer

Draw takes an optional fragment push range size. The new case sets it
to the stencil reference dword, so the shader data of a pixel shader
that reads its color with s_buffer_load_dword through a buffer
descriptor in user data is in a buffer with or without the pipeline
library, and the reference is the only push constant. The replayed
draw must color every pixel from the buffer. Without the buildPrepare
fix before it, both stencil replay registrations refuse that draw with
"guest buffer offset lies outside the shader's push constants".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../tests/execution/StencilReplay.cpp              | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
index 2f150274b0..14d571cf48 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StencilReplay.cpp
@@ -88,7 +88,7 @@ ShaderRecompiler::ShaderPixelStageInfo PixelInfo(std::uint32_t shaderControl) {
     return AgcDriver::Graphics::DecodePixelStageInfo(context, {0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u});
 }
 
-void Draw(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> pixelCode, std::uint32_t shaderControl, const VkStencilOpState& stencil, std::uint32_t vertices = 3u, std::uint32_t instances = 1u, bool depthFail = false, const std::function<void(AgcDriver::Graphics::State&)>& alter = {}, const std::function<void(AgcDriver::Pm4::DrawParameters&)>& alterDraw = {}, std::span<const std::array<float, 4>> vertexData = Vertices, std::span<const std::uint32_t> vertexCode = VertexCode, std::span<const std::uint32_t> pixelData = {}, std::span<const ShaderRecompiler::MemoryRegion> pixelSrt = {}, const std::function<void(ShaderRecompiler::RecompileResult&)>& alterVertex = {}) {
+void Draw(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> pixelCode, std::uint32_t shaderControl, const VkStencilOpState& stencil, std::uint32_t vertices = 3u, std::uint32_t instances = 1u, bool depthFail = false, const std::function<void(AgcDriver::Graphics::State&)>& alter = {}, const std::function<void(AgcDriver::Pm4::DrawParameters&)>& alterDraw = {}, std::span<const std::array<float, 4>> vertexData = Vertices, std::span<const std::uint32_t> vertexCode = VertexCode, std::span<const std::uint32_t> pixelData = {}, std::span<const ShaderRecompiler::MemoryRegion> pixelSrt = {}, const std::function<void(ShaderRecompiler::RecompileResult&)>& alterVertex = {}, std::uint32_t pixelPushBytes = 0u) {
     Pixels.fill(Kept);
     auto target = device.Target();
     std::vector<std::uint32_t> capabilities(target.supportedCapabilities.begin(), target.supportedCapabilities.end());
@@ -113,11 +113,13 @@ void Draw(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> pixelC
     auto pixelUserData = pixelData.empty() ? std::vector<std::uint32_t>(8, 0u) : std::vector<std::uint32_t>(pixelData.begin(), pixelData.end());
     std::vector<ShaderRecompiler::MemoryRegion> pixelMemory{{reinterpret_cast<std::uintptr_t>(pixelCode.data()), std::as_bytes(pixelCode)}};
     pixelMemory.insert(pixelMemory.end(), pixelSrt.begin(), pixelSrt.end());
+    auto pixelLayout = PixelPushLayout(vertexPush, target);
+    if (pixelPushBytes != 0u) pixelLayout.pushConstantSizeBytes = pixelPushBytes;
     ShaderRecompiler::RecompileRequest fragment{
         {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(pixelCode.data()), pixelCode, 0, {}},
         {WaveSize, 0, pixelUserData, std::nullopt, PixelInfo(shaderControl), std::nullopt, pixelMemory},
         target,
-        PixelPushLayout(vertexPush, target)
+        pixelLayout
     };
     fragment.useCache = false;
     const auto pixelResult = ShaderRecompiler::Recompile(fragment);
@@ -350,6 +352,14 @@ int main() {
         const std::array<std::uint32_t, 1> colorData{0x3f800000u};
         Draw(*device, userColor, exported, replace(), 3u, 1u, false, {}, {}, Vertices, VertexCode, colorData);
         Check(all, "dynamic reference preserves the adjacent shader-data push payload");
+        auto bufferColor = std::vector<std::uint32_t>(alternating.begin(), alternating.end());
+        *std::find(bufferColor.begin(), bufferColor.end(), 0x7e0e02f2u) = 0x7e0e0208u;
+        bufferColor.insert(bufferColor.begin(), {0xf4200200u, 0xfa000000u, 0xbf8cc07fu});
+        alignas(256) const std::array<std::uint32_t, 4> colorBuffer{0x3f800000u, 0u, 0u, 0u};
+        const auto colorDescriptor = BufferDescriptor(colorBuffer.data(), 4u, static_cast<std::uint32_t>(colorBuffer.size()));
+        const std::array<ShaderRecompiler::MemoryRegion, 1> colorMemory{{{reinterpret_cast<std::uintptr_t>(colorBuffer.data()), std::as_bytes(std::span(colorBuffer))}}};
+        Draw(*device, bufferColor, exported, replace(), 3u, 1u, false, {}, {}, Vertices, VertexCode, colorDescriptor, colorMemory, {}, sizeof(std::uint32_t));
+        Check(all, "dynamic reference keeps guest buffer offsets in shader data outside the push constants");
         auto guarded = std::vector<std::uint32_t>(alternating.begin(), alternating.end());
         *std::find(guarded.begin(), guarded.end(), 0x7e0e02f2u) = 0x7e0e020cu;
         guarded.insert(guarded.begin(), {0xf4040280u, 0xfa000018u, 0xf4000305u, 0xfa000000u, 0xbf8cc07fu});

From 899306f8558bf50a97825befd6e46f63eeaefcce Mon Sep 17 00:00:00 2001
From: David <David.Samir.WD@gmail.com>
Date: Thu, 22 Oct 2026 14:47:21 +0100
Subject: [PATCH 021/218] test(libc): cover the remaining sizes of the
 Dinkumware typed atomics

guest_dinkumware_atomics called one or two sizes of each typed _Atomic_
function. It now also runs the other sizes: store 2 and 4, load 1,
exchange 1 and 2, strong compare-exchange 1, 4 and 8 and weak 1 and 2
(a failure writes the observed value back, then a success swaps), fetch_sub
1 and 8, fetch_and 1, 2 and 8, fetch_or 2, 4 and 8, fetch_xor 1, 2 and 4
(each returns the previous value, with wraparound), and is_lock_free 1, 2
and 8.
---
 core/libs/tests/GuestDinkumwareAtomics.cpp | 73 ++++++++++++++++++++++
 1 file changed, 73 insertions(+)

diff --git a/core/libs/tests/GuestDinkumwareAtomics.cpp b/core/libs/tests/GuestDinkumwareAtomics.cpp
index 8e45d76902..8adb814bad 100644
--- a/core/libs/tests/GuestDinkumwareAtomics.cpp
+++ b/core/libs/tests/GuestDinkumwareAtomics.cpp
@@ -5,6 +5,34 @@
 #include <cstring>
 #include <thread>
 
+extern "C" {
+void APS5_VABI _Atomic_store_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
+void APS5_VABI _Atomic_store_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
+std::uint8_t APS5_VABI _Atomic_load_1_nid_postfix(volatile std::uint8_t*, int);
+std::uint8_t APS5_VABI _Atomic_exchange_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
+std::uint16_t APS5_VABI _Atomic_exchange_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
+int APS5_VABI _Atomic_compare_exchange_strong_1_nid_postfix(volatile std::uint8_t*, std::uint8_t*, std::uint8_t, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_4_nid_postfix(volatile std::uint32_t*, std::uint32_t*, std::uint32_t, int, int);
+int APS5_VABI _Atomic_compare_exchange_strong_8_nid_postfix(volatile std::uint64_t*, std::uint64_t*, std::uint64_t, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_1_nid_postfix(volatile std::uint8_t*, std::uint8_t*, std::uint8_t, int, int);
+int APS5_VABI _Atomic_compare_exchange_weak_2_nid_postfix(volatile std::uint16_t*, std::uint16_t*, std::uint16_t, int, int);
+std::uint16_t APS5_VABI _Atomic_fetch_add_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
+std::uint8_t APS5_VABI _Atomic_fetch_sub_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
+std::uint64_t APS5_VABI _Atomic_fetch_sub_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
+std::uint8_t APS5_VABI _Atomic_fetch_and_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
+std::uint16_t APS5_VABI _Atomic_fetch_and_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
+std::uint64_t APS5_VABI _Atomic_fetch_and_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
+std::uint16_t APS5_VABI _Atomic_fetch_or_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
+std::uint32_t APS5_VABI _Atomic_fetch_or_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
+std::uint64_t APS5_VABI _Atomic_fetch_or_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
+std::uint8_t APS5_VABI _Atomic_fetch_xor_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
+std::uint16_t APS5_VABI _Atomic_fetch_xor_2_nid_postfix(volatile std::uint16_t*, std::uint16_t, int);
+std::uint32_t APS5_VABI _Atomic_fetch_xor_4_nid_postfix(volatile std::uint32_t*, std::uint32_t, int);
+int APS5_VABI _Atomic_is_lock_free_1_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_2_nid_postfix();
+int APS5_VABI _Atomic_is_lock_free_8_nid_postfix();
+}
+
 extern "C" {
 void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t*, std::uint8_t, int);
 void APS5_VABI _Atomic_store_8_nid_postfix(volatile std::uint64_t*, std::uint64_t, int);
@@ -35,6 +63,50 @@ static void Require(bool value) { if (!value) std::abort(); }
 
 constexpr int Relaxed = 0, Acquire = 2, Release = 3, AcqRel = 4, SeqCst = 5;
 
+static void CheckRemainingTyped() {
+    std::uint8_t byte = 0;
+    Require(_Atomic_load_1_nid_postfix(&byte, SeqCst) == 0);
+    Require(_Atomic_exchange_1_nid_postfix(&byte, 0xa5, SeqCst) == 0 && byte == 0xa5);
+    std::uint8_t expectedByte = 0;
+    Require(_Atomic_compare_exchange_strong_1_nid_postfix(&byte, &expectedByte, 1, SeqCst, SeqCst) == 0 && expectedByte == 0xa5 && byte == 0xa5);
+    Require(_Atomic_compare_exchange_strong_1_nid_postfix(&byte, &expectedByte, 0x3c, SeqCst, SeqCst) == 1 && byte == 0x3c);
+    expectedByte = 0;
+    Require(_Atomic_compare_exchange_weak_1_nid_postfix(&byte, &expectedByte, 1, SeqCst, Relaxed) == 0 && expectedByte == 0x3c);
+    Require(_Atomic_compare_exchange_weak_1_nid_postfix(&byte, &expectedByte, 0x0f, SeqCst, Relaxed) == 1 && byte == 0x0f);
+    Require(_Atomic_fetch_sub_1_nid_postfix(&byte, 0x10, SeqCst) == 0x0f && byte == 0xff);
+    Require(_Atomic_fetch_and_1_nid_postfix(&byte, 0x3c, Relaxed) == 0xff && byte == 0x3c);
+    Require(_Atomic_fetch_xor_1_nid_postfix(&byte, 0xff, AcqRel) == 0x3c && byte == 0xc3);
+
+    std::uint16_t half = 0;
+    _Atomic_store_2_nid_postfix(&half, 0x1234, Release);
+    Require(half == 0x1234 && _Atomic_exchange_2_nid_postfix(&half, 0xfff0, SeqCst) == 0x1234 && half == 0xfff0);
+    Require(_Atomic_fetch_add_2_nid_postfix(&half, 0x20, SeqCst) == 0xfff0 && half == 0x0010);
+    Require(_Atomic_fetch_and_2_nid_postfix(&half, 0x0018, SeqCst) == 0x0010 && half == 0x0010);
+    Require(_Atomic_fetch_or_2_nid_postfix(&half, 0x0101, SeqCst) == 0x0010 && half == 0x0111);
+    Require(_Atomic_fetch_xor_2_nid_postfix(&half, 0x0110, SeqCst) == 0x0111 && half == 0x0001);
+    std::uint16_t expectedHalf = 2;
+    Require(_Atomic_compare_exchange_weak_2_nid_postfix(&half, &expectedHalf, 9, SeqCst, Relaxed) == 0 && expectedHalf == 1);
+    Require(_Atomic_compare_exchange_weak_2_nid_postfix(&half, &expectedHalf, 9, SeqCst, Relaxed) == 1 && half == 9);
+
+    std::uint32_t word = 0;
+    _Atomic_store_4_nid_postfix(&word, 0x00ff00ffu, SeqCst);
+    Require(word == 0x00ff00ffu && _Atomic_fetch_or_4_nid_postfix(&word, 0xff000000u, SeqCst) == 0x00ff00ffu && word == 0xffff00ffu);
+    Require(_Atomic_fetch_xor_4_nid_postfix(&word, 0xffffffffu, SeqCst) == 0xffff00ffu && word == 0x0000ff00u);
+    std::uint32_t expectedWord = 0;
+    Require(_Atomic_compare_exchange_strong_4_nid_postfix(&word, &expectedWord, 1, SeqCst, SeqCst) == 0 && expectedWord == 0x0000ff00u);
+    Require(_Atomic_compare_exchange_strong_4_nid_postfix(&word, &expectedWord, 1, SeqCst, SeqCst) == 1 && word == 1);
+
+    std::uint64_t wide = 0x8000000000000001ull;
+    Require(_Atomic_fetch_sub_8_nid_postfix(&wide, 2, SeqCst) == 0x8000000000000001ull && wide == 0x7fffffffffffffffull);
+    Require(_Atomic_fetch_and_8_nid_postfix(&wide, 0xffffffff00000000ull, SeqCst) == 0x7fffffffffffffffull && wide == 0x7fffffff00000000ull);
+    Require(_Atomic_fetch_or_8_nid_postfix(&wide, 0xffull, SeqCst) == 0x7fffffff00000000ull && wide == 0x7fffffff000000ffull);
+    std::uint64_t expectedWide = 0;
+    Require(_Atomic_compare_exchange_strong_8_nid_postfix(&wide, &expectedWide, 5, SeqCst, SeqCst) == 0 && expectedWide == 0x7fffffff000000ffull);
+    Require(_Atomic_compare_exchange_strong_8_nid_postfix(&wide, &expectedWide, 5, SeqCst, SeqCst) == 1 && wide == 5);
+
+    Require(_Atomic_is_lock_free_1_nid_postfix() == 1 && _Atomic_is_lock_free_2_nid_postfix() == 1 && _Atomic_is_lock_free_8_nid_postfix() == 1);
+}
+
 static void CheckTyped() {
     std::uint8_t byte = 0;
     _Atomic_store_1_nid_postfix(&byte, 7, SeqCst);
@@ -112,6 +184,7 @@ static void CheckConcurrentGeneric() {
 }
 
 int main() {
+    CheckRemainingTyped();
     CheckTyped();
     CheckFlagsAndFences();
     CheckGeneric();

From accae4b62dd305f636bd10670844fb181a8e955a Mon Sep 17 00:00:00 2001
From: m335671 <110462702+m335671@users.noreply.github.com>
Date: Tue, 20 Oct 2026 11:10:59 +0200
Subject: [PATCH 022/218] fix(agc): re-check a dispatch resolved ahead against
 memory before adopting it

Group capture resolves the dispatches behind a gate ahead and parks the
result per packet. A CPU store or a GPU write queued on another queue
between the resolve and the adoption was not seen, so the dispatch ran
with the descriptors and data it captured before. At adoption, reject the
ahead result when a non-code region it captured has a pending write or
no longer matches memory, and take the normal path instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Execution/include/Driver.hpp              |   2 +
 .../Execution/include/Driver/Driver.hpp       |   6 +-
 .../src/Driver/Dispatch/Dispatch.cpp          |  22 ++
 .../src/Driver/Dispatch/DispatchAhead.cpp     |  12 +-
 .../Execution/src/Driver/EntryPoints.cpp      |   8 +
 .../execution/DispatchAheadAdoptCheck.cpp     | 208 ++++++++++++++++++
 6 files changed, 255 insertions(+), 3 deletions(-)
 create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp

diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
index b599b88f95..5a63f230b6 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver.hpp
@@ -20,6 +20,8 @@ extern "C" void AgcDriverShutdown_nid_postfix();
 extern "C" void AgcDriverRequestScreenshot_nid_postfix();
 extern "C" void AgcDriverSuspendPoint_nid_postfix();
 extern "C" std::uint64_t AgcDriverDispatchesAdoptedAhead_nid_postfix();
+extern "C" std::uint64_t AgcDriverDispatchesRejectedAhead_nid_postfix();
+extern "C" void AgcDriverSetAheadAdoptHook_nid_postfix(void (*hook)());
 extern "C" void AgcDriverRegisterShader_nid_postfix(const Shader* shader);
 extern "C" void AgcDriverResolveShaderAbi_nid_postfix(const Shader* shader, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
 extern "C" void AgcDriverResolveGraphicsStagesAbi_nid_postfix(std::span<const Shader* const> stages, std::span<const ShaderRegister> context, std::span<const ShaderRegister> primitive);
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
index 0e96bcc002..7c087b27c3 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp
@@ -51,6 +51,8 @@ public:
     void Shutdown();
     void WaitIdle();
     std::uint64_t DispatchesAdoptedAhead() const;
+    std::uint64_t DispatchesRejectedAhead() const;
+    void SetAheadAdoptHook(void (*hook)());
     void CheckFailure();
     void ReportFailure(std::exception_ptr error);
     void Submit(const Packet* packet, std::uint32_t queue, bool cpuFlip = false);
@@ -289,7 +291,7 @@ private:
         std::chrono::steady_clock::time_point resolvedAt{};
     };
     struct GroupCaptureStats {
-        std::uint64_t runs = 0, resolved = 0, resolvedHits = 0, adopted = 0, addressMismatches = 0, keyMismatches = 0, failures = 0, stale = 0, labelOverlaps = 0, writtenBefore = 0, deviceRejects = 0, argumentMismatches = 0;
+        std::uint64_t runs = 0, resolved = 0, resolvedHits = 0, adopted = 0, addressMismatches = 0, keyMismatches = 0, memoryMismatches = 0, failures = 0, stale = 0, labelOverlaps = 0, writtenBefore = 0, deviceRejects = 0, argumentMismatches = 0;
         double resolveMs = 0, resolveMaxMs = 0, ageMs = 0, ageMaxMs = 0;
         std::chrono::steady_clock::time_point reported = std::chrono::steady_clock::now();
     };
@@ -438,6 +440,8 @@ private:
     std::atomic<std::uint64_t> evidenceReads{0};
     std::atomic<std::uint64_t> evidenceValidations{0};
     std::atomic<std::uint64_t> dispatchesAdoptedAhead{0};
+    std::atomic<std::uint64_t> dispatchesRejectedAhead{0};
+    std::atomic<void (*)()> aheadAdoptHook{nullptr};
 
     std::mutex writtenBuffersMutex;
     std::deque<WrittenBuffer> writtenBuffers;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
index 808000d470..428dd8d3a6 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/Dispatch.cpp
@@ -16,6 +16,7 @@
 #include "Optimization/ResourceProgram.hpp"
 #include <algorithm>
 #include <cstdlib>
+#include <cstring>
 #include <optional>
 #include <stdexcept>
 #include <utility>
@@ -57,6 +58,19 @@ void ReportDispatchItems(bool profile) {
     std::fprintf(stderr, "[dispatch-item] %llu commit items (%llu recipes rebuilt on the committer); drained instead, cumulative:%s\n", static_cast<unsigned long long>(itemCommits.load(std::memory_order_relaxed)), static_cast<unsigned long long>(itemRebuilds.load(std::memory_order_relaxed)), drained.c_str());
 }
 
+bool CapturedCurrent(std::span<const ShaderRecompiler::MemoryRegion> captured, const ShaderSnapshot& code) {
+    for (const auto& region : captured) {
+        const auto address = region.guestAddress;
+        const auto bytes = region.bytes.size();
+        if (bytes == 0 || (address >= code.codeAddress && address < code.codeAddress + code.code.size() * sizeof(std::uint32_t)) || (!code.header.empty() && address >= code.headerAddress && address < code.headerAddress + code.header.size())) continue;
+        if (Driver::QueryPendingSpan(address, bytes, {}) != ShaderMemory::PendingWrite::None || !GuestMemory::Accessible(reinterpret_cast<const void*>(address), bytes)) return false;
+        GuestMemory::GuardRead(address, bytes);
+        GuestMemory::FlushGpuWrites(address, bytes);
+        if (std::memcmp(region.bytes.data(), reinterpret_cast<const void*>(address), bytes) != 0) return false;
+    }
+    return true;
+}
+
 }
 
 bool Driver::pipelineDispatch() {
@@ -281,6 +295,14 @@ void Driver::dispatch(QueueState& queue, std::span<const std::uint32_t> packet,
         fromAhead = false;
         ++groupStats.keyMismatches;
     }
+    if (fromAhead) {
+        if (const auto hook = aheadAdoptHook.load(std::memory_order_acquire)) hook();
+        if (!CapturedCurrent(ahead.captured, snapshot)) {
+            fromAhead = false;
+            ++dispatchesRejectedAhead;
+            ++groupStats.memoryMismatches;
+        }
+    }
     phaseTiming.Phase(PhaseKey);
     timing.Mark("decode_key_device_setup");
     bool readsClear = false;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
index 0b6f1f0eb0..8bf29a55b6 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchAhead.cpp
@@ -39,6 +39,14 @@ std::uint64_t Driver::DispatchesAdoptedAhead() const {
     return dispatchesAdoptedAhead.load(std::memory_order_relaxed);
 }
 
+std::uint64_t Driver::DispatchesRejectedAhead() const {
+    return dispatchesRejectedAhead.load(std::memory_order_relaxed);
+}
+
+void Driver::SetAheadAdoptHook(void (*hook)()) {
+    aheadAdoptHook.store(hook, std::memory_order_release);
+}
+
 void Driver::clearResolvedAhead() {
     auto& resolved = resolvedAhead();
     if (resolved.empty()) return;
@@ -207,9 +215,9 @@ void Driver::reportGroupCapture(std::uint32_t queue) {
     auto& stats = groupCaptureStats();
     const auto now = std::chrono::steady_clock::now();
     if (now - stats.reported < std::chrono::seconds(10)) return;
-    AgcDriver::ProfilePrint_nid_no_patch("[groupcap] queue 0x%x (10 s): %llu runs resolved %llu dispatches (%llu cache hits) in %.1f ms (max %.2f ms); %llu adopted %.2f ms after the resolve on average, max %.2f ms; mismatches: address %llu key %llu; %llu resolve failures, %llu stale, %llu label overlaps, %llu read an earlier dispatch's output, %llu rejected by the device, %llu dropped because the argument re-read differed\n",
+    AgcDriver::ProfilePrint_nid_no_patch("[groupcap] queue 0x%x (10 s): %llu runs resolved %llu dispatches (%llu cache hits) in %.1f ms (max %.2f ms); %llu adopted %.2f ms after the resolve on average, max %.2f ms; mismatches: address %llu key %llu memory %llu; %llu resolve failures, %llu stale, %llu label overlaps, %llu read an earlier dispatch's output, %llu rejected by the device, %llu dropped because the argument re-read differed\n",
                                          queue, static_cast<unsigned long long>(stats.runs), static_cast<unsigned long long>(stats.resolved), static_cast<unsigned long long>(stats.resolvedHits), stats.resolveMs, stats.resolveMaxMs,
-                                         static_cast<unsigned long long>(stats.adopted), stats.adopted != 0 ? stats.ageMs / static_cast<double>(stats.adopted) : 0.0, stats.ageMaxMs, static_cast<unsigned long long>(stats.addressMismatches), static_cast<unsigned long long>(stats.keyMismatches),
+                                         static_cast<unsigned long long>(stats.adopted), stats.adopted != 0 ? stats.ageMs / static_cast<double>(stats.adopted) : 0.0, stats.ageMaxMs, static_cast<unsigned long long>(stats.addressMismatches), static_cast<unsigned long long>(stats.keyMismatches), static_cast<unsigned long long>(stats.memoryMismatches),
                                          static_cast<unsigned long long>(stats.failures), static_cast<unsigned long long>(stats.stale), static_cast<unsigned long long>(stats.labelOverlaps), static_cast<unsigned long long>(stats.writtenBefore), static_cast<unsigned long long>(stats.deviceRejects), static_cast<unsigned long long>(stats.argumentMismatches));
     stats = GroupCaptureStats{};
     stats.reported = now;
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
index 04a1f72a02..4a2e1aa502 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
@@ -116,6 +116,14 @@ extern "C" std::uint64_t AgcDriverDispatchesAdoptedAhead_nid_postfix() {
     return AgcDriver::DriverDetail::Driver::Get().DispatchesAdoptedAhead();
 }
 
+extern "C" std::uint64_t AgcDriverDispatchesRejectedAhead_nid_postfix() {
+    return AgcDriver::DriverDetail::Driver::Get().DispatchesRejectedAhead();
+}
+
+extern "C" void AgcDriverSetAheadAdoptHook_nid_postfix(void (*hook)()) {
+    AgcDriver::DriverDetail::Driver::Get().SetAheadAdoptHook(hook);
+}
+
 extern "C" void AgcDriverRegisterVideoOutput_nid_postfix(std::uint32_t handle, const std::shared_ptr<AgcDriver::IVideoOutput>& output) {
     AgcDriver::RegisterVideoOutput(handle, output);
 }
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp
new file mode 100644
index 0000000000..e2453a66f0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/DispatchAheadAdoptCheck.cpp
@@ -0,0 +1,208 @@
+#include "VulkanTestDevice.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/Driver/Driver.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Submit/include/Acb.hpp"
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <initializer_list>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+alignas(256) std::array<std::uint32_t, 7> CounterCode{0xf4080200u, 0xfa000000u, 0xbf8cc07fu, 0x7e000281u, 0xe0c80000u, 0x80020000u, 0xbf810000u};
+alignas(256) std::array<std::uint32_t, 7> StoreCode{0xf4080200u, 0xfa000000u, 0xbf8cc07fu, 0x7e000202u, 0xe0700000u, 0x80020000u, 0xbf810000u};
+alignas(256) std::array<std::uint32_t, 15> SpinCode{0xf4080200u, 0xfa000000u, 0xbe840381u, 0x9304ff04u, 0x0019660du, 0x8004ff04u, 0x3c6ef35fu, 0x80828102u, 0xbf078002u, 0xbf85fff9u, 0xbf8cc07fu, 0x7e000204u, 0xe0700000u, 0x80020000u, 0xbf810000u};
+
+constexpr std::uint32_t Compute = 0x20u;
+constexpr std::uint32_t OtherCompute = 0x28u;
+constexpr std::uint32_t SpinIterations = 1u << 20u;
+
+alignas(256) std::array<std::uint32_t, 4> Stale{};
+alignas(256) std::array<std::uint32_t, 4> Fresh{};
+alignas(256) std::array<std::uint32_t, 4> Target{};
+alignas(256) std::array<std::uint32_t, 4> TargetDescriptor{};
+alignas(256) std::array<std::uint32_t, 4> Spun{};
+alignas(256) std::array<std::uint32_t, 4> SpunDescriptor{};
+alignas(256) volatile std::uint32_t Gate = 1;
+alignas(256) volatile std::uint32_t Done = 0;
+alignas(256) volatile std::uint32_t OtherDone = 0;
+
+enum class Window { None, CpuStore, QueuedGpuStore };
+
+std::atomic<Window> Armed{Window::None};
+std::uint32_t SpinDispatches = 16;
+std::vector<std::uint32_t> OtherWords;
+bool SawPending = false;
+
+std::uint32_t Low(const volatile void* pointer) {
+    return static_cast<std::uint32_t>(reinterpret_cast<std::uintptr_t>(pointer));
+}
+
+std::uint32_t High(const volatile void* pointer) {
+    return static_cast<std::uint32_t>(static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(pointer)) >> 32u);
+}
+
+std::array<std::uint32_t, 4> Descriptor(const void* pointer, std::uint32_t bytes) {
+    return {Low(pointer), High(pointer) & 0xffffu, bytes, 0x31016facu};
+}
+
+void SetShaderRegister(std::vector<std::uint32_t>& words, std::uint32_t offset, std::uint32_t value) {
+    words.insert(words.end(), {0xc0017600u, offset, value});
+}
+
+void Program(std::vector<std::uint32_t>& words, const void* code, std::initializer_list<std::uint32_t> userData) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(code));
+    SetShaderRegister(words, 0x20c, static_cast<std::uint32_t>(address >> 8u));
+    SetShaderRegister(words, 0x20d, static_cast<std::uint32_t>(address >> 40u) & 0xffu);
+    for (const std::uint32_t offset : {0x207u, 0x208u, 0x209u}) SetShaderRegister(words, offset, 1);
+    SetShaderRegister(words, 0x212, 0);
+    SetShaderRegister(words, 0x213, static_cast<std::uint32_t>(userData.size()) << 1u);
+    std::uint32_t offset = 0x240;
+    for (const auto value : userData) SetShaderRegister(words, offset++, value);
+}
+
+void Dispatch(std::vector<std::uint32_t>& words, const void* code, std::initializer_list<std::uint32_t> userData) {
+    Program(words, code, userData);
+    words.insert(words.end(), {0xc0031500u, 1, 1, 1, 0x8041u});
+}
+
+void WriteData(std::vector<std::uint32_t>& words, const volatile std::uint32_t* target, std::uint32_t value) {
+    words.insert(words.end(), {0xc0033700u, 0x00100200u, Low(target), High(target), value});
+}
+
+void Submit(std::uint32_t queue, std::vector<std::uint32_t>& words) {
+    Packet packet{words.data(), static_cast<std::uint32_t>(words.size()), 0, {}};
+    Require(sceAgcDriverSubmitAcb(queue, &packet) == 0, "compute submit failed");
+}
+
+void QueueStoreAhead() {
+    OtherWords.clear();
+    for (std::uint32_t index = 0; index < SpinDispatches; ++index) Dispatch(OtherWords, SpinCode.data(), {Low(SpunDescriptor.data()), High(SpunDescriptor.data()), SpinIterations});
+    Dispatch(OtherWords, StoreCode.data(), {Low(TargetDescriptor.data()), High(TargetDescriptor.data()), Low(Fresh.data())});
+    WriteData(OtherWords, &OtherDone, 1);
+    Submit(OtherCompute, OtherWords);
+    const auto start = std::chrono::steady_clock::now();
+    while (std::chrono::steady_clock::now() - start < std::chrono::seconds(5) && OtherDone == 0) {
+        if (AgcDriver::DriverDetail::Driver::QueryPendingSpan(reinterpret_cast<std::uintptr_t>(Target.data()), sizeof(Target), {}) != AgcDriver::ShaderMemory::PendingWrite::None) {
+            SawPending = true;
+            return;
+        }
+        std::this_thread::yield();
+    }
+}
+
+void BeforeAdoption() {
+    const auto window = Armed.exchange(Window::None);
+    if (window == Window::CpuStore) reinterpret_cast<volatile std::uint32_t&>(Target[0]) = Low(Fresh.data());
+    else if (window == Window::QueuedGpuStore) QueueStoreAhead();
+}
+
+void WaitIdle() {
+    AgcDriverWaitIdle_nid_postfix();
+    for (const auto* buffer : {&Stale, &Fresh, &Target}) AgcDriver::GuestMemory::FlushGpuWrites(reinterpret_cast<std::uintptr_t>(buffer->data()), sizeof(*buffer));
+}
+
+void Reset() {
+    WaitIdle();
+    Stale = {};
+    Fresh = {};
+    Target = Descriptor(Stale.data(), sizeof(Stale));
+    Done = 0;
+    OtherDone = 0;
+    SawPending = false;
+}
+
+void Gated(Window window) {
+    Reset();
+    std::vector<std::uint32_t> words;
+    words.insert(words.end(), {0xc0053c00u, 0x13u, Low(&Gate), High(&Gate), 1u, 0xffffffffu, 0x19u});
+    Dispatch(words, CounterCode.data(), {Low(Target.data()), High(Target.data())});
+    WriteData(words, &Done, 1);
+    Armed = window;
+    Submit(Compute, words);
+    WaitIdle();
+    Armed = Window::None;
+    Require(Done == 1, "the gated submission did not finish");
+}
+
+std::string Counts() {
+    return "(stale " + std::to_string(Stale[0]) + ", fresh " + std::to_string(Fresh[0]) + ")";
+}
+
+}
+
+int main() {
+    try {
+        auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        device.reset();
+        Require(High(Stale.data()) == High(Fresh.data()), "the stale and fresh buffers differ in their high address word");
+        TargetDescriptor = Descriptor(Target.data(), sizeof(Target));
+        SpunDescriptor = Descriptor(Spun.data(), sizeof(Spun));
+        AgcDriverSetAheadAdoptHook_nid_postfix(&BeforeAdoption);
+        Reset();
+        std::vector<std::uint32_t> warmUp;
+        Dispatch(warmUp, CounterCode.data(), {Low(Target.data()), High(Target.data())});
+        WriteData(warmUp, &Done, 1);
+        Submit(Compute, warmUp);
+        std::vector<std::uint32_t> otherWarmUp;
+        Dispatch(otherWarmUp, SpinCode.data(), {Low(SpunDescriptor.data()), High(SpunDescriptor.data()), SpinIterations});
+        Dispatch(otherWarmUp, StoreCode.data(), {Low(TargetDescriptor.data()), High(TargetDescriptor.data()), Low(Fresh.data())});
+        Submit(OtherCompute, otherWarmUp);
+        WaitIdle();
+        Require(Done == 1 && Target[0] == Low(Fresh.data()), "the warm-up dispatches did not run");
+
+        Gated(Window::None);
+        Require(Stale[0] == 1 && Fresh[0] == 0, "the gated dispatch without a store in the window did not count into the stale buffer " + Counts());
+        const auto adopted = AgcDriverDispatchesAdoptedAhead_nid_postfix();
+        Require(adopted != 0, "the gated dispatch was not resolved ahead and adopted");
+
+        auto rejected = AgcDriverDispatchesRejectedAhead_nid_postfix();
+        Gated(Window::CpuStore);
+        Require(Fresh[0] == 1 && Stale[0] == 0, "a dispatch resolved ahead whose descriptor the CPU replaced before its adoption used the old descriptor " + Counts());
+        Require(AgcDriverDispatchesRejectedAhead_nid_postfix() == rejected + 1, "the CPU store in the adoption window was not caught by the adoption check");
+        std::cout << "cpu store before adoption: passed\n";
+
+        bool conclusive = false;
+        for (int attempt = 0; attempt < 4 && !conclusive; ++attempt, SpinDispatches *= 4) {
+            rejected = AgcDriverDispatchesRejectedAhead_nid_postfix();
+            Gated(Window::QueuedGpuStore);
+            conclusive = SawPending;
+            if (!conclusive) {
+                std::cout << "queued gpu store before adoption: the store finished before the adoption with " << SpinDispatches << " spin dispatches, retrying\n";
+                continue;
+            }
+            Require(Fresh[0] == 1 && Stale[0] == 0, "a dispatch resolved ahead whose descriptor a GPU store queued on another queue replaces before its adoption used the old descriptor " + Counts());
+            Require(AgcDriverDispatchesRejectedAhead_nid_postfix() == rejected + 1, "the queued GPU store in the adoption window was not caught by the adoption check");
+        }
+        AgcDriverSetAheadAdoptHook_nid_postfix(nullptr);
+        if (!conclusive) {
+            std::cout << "queued gpu store before adoption: never observed the store pending at the adoption\n";
+            AgcDriverShutdown_nid_postfix();
+            return VulkanTestSkipped;
+        }
+        std::cout << "queued gpu store before adoption: passed\n";
+        std::cout << "dispatch ahead adopt check test passed\n";
+        AgcDriverShutdown_nid_postfix();
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        try {
+            AgcDriverShutdown_nid_postfix();
+        } catch (const std::exception& shutdownError) {
+            std::cerr << shutdownError.what() << '\n';
+        }
+        return 1;
+    }
+}

From 3383d303a7a1bf1882d3575f22dd17e015fab3ed Mon Sep 17 00:00:00 2001
From: Retr0 <gurau.eduard@ichb.ro>
Date: Thu, 22 Oct 2026 17:36:37 +0300
Subject: [PATCH 023/218] fix(libkernel): move every knote kevent reports
 behind the waiting ones

FreeBSD 11.4 kqueue_scan (sys/kern/kern_event.c) puts a reported level
knote back at the tail of the queue and takes an EV_CLEAR or EV_DISPATCH
knote off it, and knote_enqueue queues that one at the tail when it fires
again. kevent moved a reported knote to the tail only while it stayed
triggered, so a level socket or pipe knote and a re-fired EV_CLEAR or
EV_DISPATCH knote kept their place and could starve later knotes when
nevents is smaller than the number of ready ones. Now every reported
knote that is not deleted moves to the tail.
---
 core/libs/prx/libkernel/Equeue/Equeue.cpp |  4 +-
 core/libs/tests/GuestKqueue.cpp           | 54 +++++++++++++++++++++++
 2 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libkernel/Equeue/Equeue.cpp b/core/libs/prx/libkernel/Equeue/Equeue.cpp
index 1256cc9391..42552f1b9b 100644
--- a/core/libs/prx/libkernel/Equeue/Equeue.cpp
+++ b/core/libs/prx/libkernel/Equeue/Equeue.cpp
@@ -257,9 +257,7 @@ int KernelEqueuePrivate::CollectOncePerWait(KernelEvent* ev, int num) {
             e.event.data = 0;
         }
         const auto next = std::next(it);
-        if (e.triggered) {
-            requeued.splice(requeued.end(), m_events, it);
-        }
+        requeued.splice(requeued.end(), m_events, it);
         it = next;
     }
     m_events.splice(m_events.end(), requeued);
diff --git a/core/libs/tests/GuestKqueue.cpp b/core/libs/tests/GuestKqueue.cpp
index 62085d4470..4240bbccc7 100644
--- a/core/libs/tests/GuestKqueue.cpp
+++ b/core/libs/tests/GuestKqueue.cpp
@@ -785,6 +785,59 @@ static void DisableAndDispatch() {
     Require(close_nid_postfix(kq) == 0);
 }
 
+static void RequireNext(int kq, std::uintptr_t ident) {
+    KernelEvent event{};
+    Require(Poll(kq, &event, 1) == 1 && event.ident == ident);
+}
+
+static void ReportedKnotesMoveToTail() {
+    const int kq = kqueue_nid_postfix();
+    int first[2];
+    int second[2];
+    int pair[2];
+    Require(pipe_nid_postfix(first) == 0 && pipe_nid_postfix(second) == 0);
+    Require(socketpair_nid_postfix(Unix, Stream, 0, pair) == 0);
+    const std::uintptr_t level[3] = {static_cast<std::uintptr_t>(first[0]), static_cast<std::uintptr_t>(second[0]), static_cast<std::uintptr_t>(pair[0])};
+    for (const auto ident : level) {
+        Require(Apply(kq, Change(ident, EvfiltRead, EvAdd)) == 0);
+    }
+    Require(write_nid_postfix(first[1], "a", 1) == 1 && write_nid_postfix(second[1], "b", 1) == 1);
+    Require(send_nid_postfix(pair[1], "c", 1, 0) == 1);
+    for (int round = 0; round < 2; ++round) {
+        for (const auto ident : level) {
+            RequireNext(kq, ident);
+        }
+    }
+    for (const auto ident : level) {
+        Require(Apply(kq, Change(ident, EvfiltRead, EvDelete)) == 0);
+    }
+
+    KernelEvent event{};
+    for (const std::uintptr_t ident : {11, 12}) {
+        Require(Apply(kq, Change(ident, EvfiltUser, EvAdd | EvClear)) == 0);
+        Require(Apply(kq, Change(ident, EvfiltUser, 0, NoteTrigger)) == 0);
+    }
+    RequireNext(kq, 11);
+    Require(Apply(kq, Change(11, EvfiltUser, 0, NoteTrigger)) == 0);
+    RequireNext(kq, 12);
+    RequireNext(kq, 11);
+    Require(Poll(kq, &event, 1) == 0);
+
+    for (const std::uintptr_t ident : {21, 22}) {
+        Require(Apply(kq, Change(ident, EvfiltUser, EvAdd | EvDispatch)) == 0);
+        Require(Apply(kq, Change(ident, EvfiltUser, 0, NoteTrigger)) == 0);
+    }
+    RequireNext(kq, 21);
+    Require(Apply(kq, Change(21, EvfiltUser, EvEnable, NoteTrigger)) == 0);
+    RequireNext(kq, 22);
+    RequireNext(kq, 21);
+    Require(Poll(kq, &event, 1) == 0);
+
+    for (const int descriptor : {first[0], first[1], second[0], second[1], pair[0], pair[1], kq}) {
+        Require(close_nid_postfix(descriptor) == 0);
+    }
+}
+
 static void Errors() {
     const int kq = kqueue_nid_postfix();
     KernelEvent events[4]{};
@@ -1152,6 +1205,7 @@ int main() {
     EdgeTriggeredDispatch();
 #endif
     DisableAndDispatch();
+    ReportedKnotesMoveToTail();
     Errors();
     LowWaterMarks();
     FileWatch();

From 30707fb9c5d42ba747736f01a08764bd4ad04103 Mon Sep 17 00:00:00 2001
From: xdCloudy <52116030+xdCloudy@users.noreply.github.com>
Date: Wed, 21 Oct 2026 23:38:23 +0100
Subject: [PATCH 024/218] feat(libSceFreeTypeOt): declare 150 PS5 3.20 exports

---
 core/libs/prx/libSceFreeTypeOt/Export.cpp | 751 +++++++++++++++++++++-
 docs/dev/debt/libSceFreeTypeOt.md         |   5 +
 2 files changed, 755 insertions(+), 1 deletion(-)
 create mode 100644 docs/dev/debt/libSceFreeTypeOt.md

diff --git a/core/libs/prx/libSceFreeTypeOt/Export.cpp b/core/libs/prx/libSceFreeTypeOt/Export.cpp
index d81f4a5e32..1412320d5a 100644
--- a/core/libs/prx/libSceFreeTypeOt/Export.cpp
+++ b/core/libs/prx/libSceFreeTypeOt/Export.cpp
@@ -5,6 +5,755 @@
 
 extern "C" {
 
-APS5_DUMMY_FUN
+
+int APS5_VABI sceFreeTypeOtUnknown_UD7IFu7ML2U_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("UD7IFu7ML2U", sceFreeTypeOtUnknown_UD7IFu7ML2U_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2T7lbS_CSzA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2T7lbS+CSzA", sceFreeTypeOtUnknown_2T7lbS_CSzA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_MGEIQsujKaY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("MGEIQsujKaY", sceFreeTypeOtUnknown_MGEIQsujKaY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_mkmgcRnAJog_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("mkmgcRnAJog", sceFreeTypeOtUnknown_mkmgcRnAJog_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_m18bTUNF_0g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("m18bTUNF-0g", sceFreeTypeOtUnknown_m18bTUNF_0g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_vTZ34rw1sfg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("vTZ34rw1sfg", sceFreeTypeOtUnknown_vTZ34rw1sfg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_PvCNusrp9xQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("PvCNusrp9xQ", sceFreeTypeOtUnknown_PvCNusrp9xQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dlM4ASZdcjk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dlM4ASZdcjk", sceFreeTypeOtUnknown_dlM4ASZdcjk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Ev3BqJ_U1Fg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Ev3BqJ-U1Fg", sceFreeTypeOtUnknown_Ev3BqJ_U1Fg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_ZhtAXOoLNyo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("ZhtAXOoLNyo", sceFreeTypeOtUnknown_ZhtAXOoLNyo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_73vg_nRH68g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("73vg+nRH68g", sceFreeTypeOtUnknown_73vg_nRH68g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_wBKAYO7yEXw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("wBKAYO7yEXw", sceFreeTypeOtUnknown_wBKAYO7yEXw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_nSIux4OQyJM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("nSIux4OQyJM", sceFreeTypeOtUnknown_nSIux4OQyJM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Dr3F3qrSQ2c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Dr3F3qrSQ2c", sceFreeTypeOtUnknown_Dr3F3qrSQ2c_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_avLzN0tTxLI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("avLzN0tTxLI", sceFreeTypeOtUnknown_avLzN0tTxLI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0rKmI1ZbMAc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0rKmI1ZbMAc", sceFreeTypeOtUnknown_0rKmI1ZbMAc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BBRhYfYBDgU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BBRhYfYBDgU", sceFreeTypeOtUnknown_BBRhYfYBDgU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_c1nbr8oSWlg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("c1nbr8oSWlg", sceFreeTypeOtUnknown_c1nbr8oSWlg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_AVEEb57HhUw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("AVEEb57HhUw", sceFreeTypeOtUnknown_AVEEb57HhUw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_x8y0qzLiYOU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("x8y0qzLiYOU", sceFreeTypeOtUnknown_x8y0qzLiYOU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_VW4GD_TaIUc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("VW4GD-TaIUc", sceFreeTypeOtUnknown_VW4GD_TaIUc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_GiuNQjoj4fs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("GiuNQjoj4fs", sceFreeTypeOtUnknown_GiuNQjoj4fs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_5qqbXOGlHw4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("5qqbXOGlHw4", sceFreeTypeOtUnknown_5qqbXOGlHw4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4LY5pyZ5IQk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4LY5pyZ5IQk", sceFreeTypeOtUnknown_4LY5pyZ5IQk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_zE0V_0aouZ4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("zE0V+0aouZ4", sceFreeTypeOtUnknown_zE0V_0aouZ4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_LsyswTUNTRs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("LsyswTUNTRs", sceFreeTypeOtUnknown_LsyswTUNTRs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_AfL_nqNC5fY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("AfL-nqNC5fY", sceFreeTypeOtUnknown_AfL_nqNC5fY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_WIvTHYs7ZQQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("WIvTHYs7ZQQ", sceFreeTypeOtUnknown_WIvTHYs7ZQQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_yrtsLmTfa48_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("yrtsLmTfa48", sceFreeTypeOtUnknown_yrtsLmTfa48_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_tCMhTh7h8D4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("tCMhTh7h8D4", sceFreeTypeOtUnknown_tCMhTh7h8D4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_zyezaHweY3U_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("zyezaHweY3U", sceFreeTypeOtUnknown_zyezaHweY3U_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_C_PpdS5zris_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("C-PpdS5zris", sceFreeTypeOtUnknown_C_PpdS5zris_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_g8eLxL9VAhU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("g8eLxL9VAhU", sceFreeTypeOtUnknown_g8eLxL9VAhU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_OeNH41MA2Vs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("OeNH41MA2Vs", sceFreeTypeOtUnknown_OeNH41MA2Vs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Bhm8Injl0KA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Bhm8Injl0KA", sceFreeTypeOtUnknown_Bhm8Injl0KA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown___lgV9pRsO4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("++lgV9pRsO4", sceFreeTypeOtUnknown___lgV9pRsO4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BqGJsJcFYaM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BqGJsJcFYaM", sceFreeTypeOtUnknown_BqGJsJcFYaM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_umIqupy8UU0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("umIqupy8UU0", sceFreeTypeOtUnknown_umIqupy8UU0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_l6Cf9rb9fZQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("l6Cf9rb9fZQ", sceFreeTypeOtUnknown_l6Cf9rb9fZQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BgUMBGvhATU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BgUMBGvhATU", sceFreeTypeOtUnknown_BgUMBGvhATU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Pz262plj20w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Pz262plj20w", sceFreeTypeOtUnknown_Pz262plj20w_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_sKneJjUXWkQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("sKneJjUXWkQ", sceFreeTypeOtUnknown_sKneJjUXWkQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0Aal_TIC4so_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0Aal-TIC4so", sceFreeTypeOtUnknown_0Aal_TIC4so_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4RRjK_Wd1lU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4RRjK-Wd1lU", sceFreeTypeOtUnknown_4RRjK_Wd1lU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_weVsBCT_TTQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("weVsBCT+TTQ", sceFreeTypeOtUnknown_weVsBCT_TTQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_QH2emcgeFck_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("QH2emcgeFck", sceFreeTypeOtUnknown_QH2emcgeFck_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_NG7OgYsgcF8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("NG7OgYsgcF8", sceFreeTypeOtUnknown_NG7OgYsgcF8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_9km02mPqPJE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("9km02mPqPJE", sceFreeTypeOtUnknown_9km02mPqPJE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0Lv6K1d47jg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0Lv6K1d47jg", sceFreeTypeOtUnknown_0Lv6K1d47jg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8fAMdZCnewA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8fAMdZCnewA", sceFreeTypeOtUnknown_8fAMdZCnewA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_LsB538_IPrE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("LsB538+IPrE", sceFreeTypeOtUnknown_LsB538_IPrE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_hz_J3hohXW8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("hz-J3hohXW8", sceFreeTypeOtUnknown_hz_J3hohXW8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_KVbmKCGGowg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("KVbmKCGGowg", sceFreeTypeOtUnknown_KVbmKCGGowg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_hF3stKUWbWg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("hF3stKUWbWg", sceFreeTypeOtUnknown_hF3stKUWbWg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_p5GNJaXO2yE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("p5GNJaXO2yE", sceFreeTypeOtUnknown_p5GNJaXO2yE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8cnVx1yH9_I_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8cnVx1yH9-I", sceFreeTypeOtUnknown_8cnVx1yH9_I_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_HVSaZbxYi2s_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("HVSaZbxYi2s", sceFreeTypeOtUnknown_HVSaZbxYi2s_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_qAPXM5DN62Q_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("qAPXM5DN62Q", sceFreeTypeOtUnknown_qAPXM5DN62Q_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_5ipBcLYVc2k_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("5ipBcLYVc2k", sceFreeTypeOtUnknown_5ipBcLYVc2k_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8A0cAU4yBVY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8A0cAU4yBVY", sceFreeTypeOtUnknown_8A0cAU4yBVY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_z9Wsaf34JA4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("z9Wsaf34JA4", sceFreeTypeOtUnknown_z9Wsaf34JA4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_PaDk9bdmdhU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("PaDk9bdmdhU", sceFreeTypeOtUnknown_PaDk9bdmdhU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Z8KG6700sw4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Z8KG6700sw4", sceFreeTypeOtUnknown_Z8KG6700sw4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_uK7vGxAQVxM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("uK7vGxAQVxM", sceFreeTypeOtUnknown_uK7vGxAQVxM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_zetC8Tp1S8w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("zetC8Tp1S8w", sceFreeTypeOtUnknown_zetC8Tp1S8w_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_DAmwG6U7YIc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("DAmwG6U7YIc", sceFreeTypeOtUnknown_DAmwG6U7YIc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Yu9oXRVmTTo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Yu9oXRVmTTo", sceFreeTypeOtUnknown_Yu9oXRVmTTo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_ihIHD8BTNxI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("ihIHD8BTNxI", sceFreeTypeOtUnknown_ihIHD8BTNxI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_yCEJIsjIOO8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("yCEJIsjIOO8", sceFreeTypeOtUnknown_yCEJIsjIOO8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_L1uHkWTazkI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("L1uHkWTazkI", sceFreeTypeOtUnknown_L1uHkWTazkI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_C7N2GuwqTA0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("C7N2GuwqTA0", sceFreeTypeOtUnknown_C7N2GuwqTA0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_JgtSc0g3G6E_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("JgtSc0g3G6E", sceFreeTypeOtUnknown_JgtSc0g3G6E_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_gVf7xRLdWm8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("gVf7xRLdWm8", sceFreeTypeOtUnknown_gVf7xRLdWm8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_FHdeCFVf_f8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("FHdeCFVf-f8", sceFreeTypeOtUnknown_FHdeCFVf_f8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Qmgc0XACzRg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Qmgc0XACzRg", sceFreeTypeOtUnknown_Qmgc0XACzRg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_0rGx_oFMLyk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("0rGx-oFMLyk", sceFreeTypeOtUnknown_0rGx_oFMLyk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_thA48N_0VwQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("thA48N-0VwQ", sceFreeTypeOtUnknown_thA48N_0VwQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_jl0VxYZb8_o_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("jl0VxYZb8-o", sceFreeTypeOtUnknown_jl0VxYZb8_o_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Er0Lin_u20o_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Er0Lin-u20o", sceFreeTypeOtUnknown_Er0Lin_u20o_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_KHj92a3WDn4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("KHj92a3WDn4", sceFreeTypeOtUnknown_KHj92a3WDn4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_tDssQCH2syY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("tDssQCH2syY", sceFreeTypeOtUnknown_tDssQCH2syY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dXJK59vXRxs_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dXJK59vXRxs", sceFreeTypeOtUnknown_dXJK59vXRxs_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_BB4gl7SgLdk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("BB4gl7SgLdk", sceFreeTypeOtUnknown_BB4gl7SgLdk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Fv8MWCUH8k8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Fv8MWCUH8k8", sceFreeTypeOtUnknown_Fv8MWCUH8k8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_RzgDJTjQst4_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("RzgDJTjQst4", sceFreeTypeOtUnknown_RzgDJTjQst4_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4yt9cD1qcEI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4yt9cD1qcEI", sceFreeTypeOtUnknown_4yt9cD1qcEI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_u6Xquj1bFwc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("u6Xquj1bFwc", sceFreeTypeOtUnknown_u6Xquj1bFwc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown__Xm1cLEpBec_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("-Xm1cLEpBec", sceFreeTypeOtUnknown__Xm1cLEpBec_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_uDXTnGbAz44_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("uDXTnGbAz44", sceFreeTypeOtUnknown_uDXTnGbAz44_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_iruPsrXCN7U_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("iruPsrXCN7U", sceFreeTypeOtUnknown_iruPsrXCN7U_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_a7RlARfexoo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("a7RlARfexoo", sceFreeTypeOtUnknown_a7RlARfexoo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_jX1zq1i8KfI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("jX1zq1i8KfI", sceFreeTypeOtUnknown_jX1zq1i8KfI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_U_0WKVAePww_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("U+0WKVAePww", sceFreeTypeOtUnknown_U_0WKVAePww_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dlbnv6Wass8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dlbnv6Wass8", sceFreeTypeOtUnknown_dlbnv6Wass8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_cmd41395g7Y_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("cmd41395g7Y", sceFreeTypeOtUnknown_cmd41395g7Y_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_SX5I_XzH8HI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("SX5I+XzH8HI", sceFreeTypeOtUnknown_SX5I_XzH8HI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Bmi8PdvsM3M_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Bmi8PdvsM3M", sceFreeTypeOtUnknown_Bmi8PdvsM3M_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_jJh4SMt8NFQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("jJh4SMt8NFQ", sceFreeTypeOtUnknown_jJh4SMt8NFQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_1z6bBg1qBfU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("1z6bBg1qBfU", sceFreeTypeOtUnknown_1z6bBg1qBfU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_mF0B64O954g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("mF0B64O954g", sceFreeTypeOtUnknown_mF0B64O954g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_c002A4zTOgA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("c002A4zTOgA", sceFreeTypeOtUnknown_c002A4zTOgA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_mcT796Qgj_g_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("mcT796Qgj+g", sceFreeTypeOtUnknown_mcT796Qgj_g_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_b5gZp_r3WWI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("b5gZp-r3WWI", sceFreeTypeOtUnknown_b5gZp_r3WWI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_S_n0Md8Rjfw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("S+n0Md8Rjfw", sceFreeTypeOtUnknown_S_n0Md8Rjfw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_6a1p3QgXvo0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("6a1p3QgXvo0", sceFreeTypeOtUnknown_6a1p3QgXvo0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_JFSCOXTEvfg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("JFSCOXTEvfg", sceFreeTypeOtUnknown_JFSCOXTEvfg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_xejRyEbsLcw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("xejRyEbsLcw", sceFreeTypeOtUnknown_xejRyEbsLcw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_R1mZutnlTiM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("R1mZutnlTiM", sceFreeTypeOtUnknown_R1mZutnlTiM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4J4Baf8ana8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4J4Baf8ana8", sceFreeTypeOtUnknown_4J4Baf8ana8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Az4H9FlfxCA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Az4H9FlfxCA", sceFreeTypeOtUnknown_Az4H9FlfxCA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_xj3tNJptfLI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("xj3tNJptfLI", sceFreeTypeOtUnknown_xj3tNJptfLI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_TPKhRt1QIeE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("TPKhRt1QIeE", sceFreeTypeOtUnknown_TPKhRt1QIeE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_6_yXRlVrjbc_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("6+yXRlVrjbc", sceFreeTypeOtUnknown_6_yXRlVrjbc_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown__RLa_6fbshA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("+RLa-6fbshA", sceFreeTypeOtUnknown__RLa_6fbshA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_pBqh_Uh_gns_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("pBqh-Uh-gns", sceFreeTypeOtUnknown_pBqh_Uh_gns_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2rcvKZfm5rI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2rcvKZfm5rI", sceFreeTypeOtUnknown_2rcvKZfm5rI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_7cIS2cFG3PE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("7cIS2cFG3PE", sceFreeTypeOtUnknown_7cIS2cFG3PE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_LfyUi_LkdCk_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("LfyUi-LkdCk", sceFreeTypeOtUnknown_LfyUi_LkdCk_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_rzIWh7FJnmU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("rzIWh7FJnmU", sceFreeTypeOtUnknown_rzIWh7FJnmU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_cKndiZnt0EA_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("cKndiZnt0EA", sceFreeTypeOtUnknown_cKndiZnt0EA_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_eqGCaeizvWM_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("eqGCaeizvWM", sceFreeTypeOtUnknown_eqGCaeizvWM_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_RvFx7dv9ThU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("RvFx7dv9ThU", sceFreeTypeOtUnknown_RvFx7dv9ThU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Po8kyd3DlIw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Po8kyd3DlIw", sceFreeTypeOtUnknown_Po8kyd3DlIw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_B3uU5aDZn94_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("B3uU5aDZn94", sceFreeTypeOtUnknown_B3uU5aDZn94_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_dojyaLKzKN0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("dojyaLKzKN0", sceFreeTypeOtUnknown_dojyaLKzKN0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_08_mhD_AAds_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("08-mhD-AAds", sceFreeTypeOtUnknown_08_mhD_AAds_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_64XMq6sDxUo_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("64XMq6sDxUo", sceFreeTypeOtUnknown_64XMq6sDxUo_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4xG87W9dTSg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4xG87W9dTSg", sceFreeTypeOtUnknown_4xG87W9dTSg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_4_SScYDT5Pg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("4+SScYDT5Pg", sceFreeTypeOtUnknown_4_SScYDT5Pg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2rmvbvOCyjY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2rmvbvOCyjY", sceFreeTypeOtUnknown_2rmvbvOCyjY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_1jmC2QcpRl0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("1jmC2QcpRl0", sceFreeTypeOtUnknown_1jmC2QcpRl0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_HMcNe70D9TI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("HMcNe70D9TI", sceFreeTypeOtUnknown_HMcNe70D9TI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_6wJwUIVwAxg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("6wJwUIVwAxg", sceFreeTypeOtUnknown_6wJwUIVwAxg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_PrZtZyFwM6c_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("PrZtZyFwM6c", sceFreeTypeOtUnknown_PrZtZyFwM6c_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_3WpTQrvGUcU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("3WpTQrvGUcU", sceFreeTypeOtUnknown_3WpTQrvGUcU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_P6WOAeb0lJ8_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("P6WOAeb0lJ8", sceFreeTypeOtUnknown_P6WOAeb0lJ8_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_XGVABnpNksQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("XGVABnpNksQ", sceFreeTypeOtUnknown_XGVABnpNksQ_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_Ln9I6YfmYJU_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("Ln9I6YfmYJU", sceFreeTypeOtUnknown_Ln9I6YfmYJU_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_7cVMwHmN308_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("7cVMwHmN308", sceFreeTypeOtUnknown_7cVMwHmN308_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_AEU2tkjdZ2w_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("AEU2tkjdZ2w", sceFreeTypeOtUnknown_AEU2tkjdZ2w_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_2lSRg9FfIOY_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("2lSRg9FfIOY", sceFreeTypeOtUnknown_2lSRg9FfIOY_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_fPrLu1YGOaw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("fPrLu1YGOaw", sceFreeTypeOtUnknown_fPrLu1YGOaw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_t3vCgnT5YL0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("t3vCgnT5YL0", sceFreeTypeOtUnknown_t3vCgnT5YL0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_8bkQ_YRnpOE_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("8bkQ+YRnpOE", sceFreeTypeOtUnknown_8bkQ_YRnpOE_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_q4qhGebYuGI_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("q4qhGebYuGI", sceFreeTypeOtUnknown_q4qhGebYuGI_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_ni_K_leoQNg_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("ni-K-leoQNg", sceFreeTypeOtUnknown_ni_K_leoQNg_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_XfcgJB6V2a0_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("XfcgJB6V2a0", sceFreeTypeOtUnknown_XfcgJB6V2a0_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_TWzf5iykiGw_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("TWzf5iykiGw", sceFreeTypeOtUnknown_TWzf5iykiGw_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown__b4iVKArt94_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("-b4iVKArt94", sceFreeTypeOtUnknown__b4iVKArt94_nid_no_patch);
+
+int APS5_VABI sceFreeTypeOtUnknown_uSNqxrARpEQ_nid_no_patch() {
+    NotImplemented_nid_no_patch(__func__);
+}
+APS5_EXPORT("uSNqxrARpEQ", sceFreeTypeOtUnknown_uSNqxrARpEQ_nid_no_patch);
 
 }
diff --git a/docs/dev/debt/libSceFreeTypeOt.md b/docs/dev/debt/libSceFreeTypeOt.md
new file mode 100644
index 0000000000..285157bd3c
--- /dev/null
+++ b/docs/dev/debt/libSceFreeTypeOt.md
@@ -0,0 +1,5 @@
+# libSceFreeTypeOt technical debt
+
+### Unknown function info
+
+- The 150 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.

From d22b6916a9713addfb0be99f31a2ec3ab1091749 Mon Sep 17 00:00:00 2001
From: cadenasynyster <8373765+cadenasynyster@users.noreply.github.com>
Date: Wed, 21 Oct 2026 21:26:39 +0200
Subject: [PATCH 025/218] test(libkernel): create the readlink and lutimes test
 links with CreateSymbolicLinkW on Windows

MinGW's std::filesystem::create_symlink always fails on Windows, so the readlink checks in guest_kernel_sys and the lutimes checks in guest_file_timestamps skipped their link cases there. They now create the link with CreateSymbolicLinkW and SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE, as SaveDataFileWriteFailure.cpp does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GtXavMkgCTCdmRpweviHcQ
---
 core/libs/tests/GuestFileTimestamps.cpp | 7 +++++++
 core/libs/tests/GuestKernelSys.cpp      | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/core/libs/tests/GuestFileTimestamps.cpp b/core/libs/tests/GuestFileTimestamps.cpp
index 62750ec5f3..d3734c622a 100644
--- a/core/libs/tests/GuestFileTimestamps.cpp
+++ b/core/libs/tests/GuestFileTimestamps.cpp
@@ -159,7 +159,14 @@ int main() {
     Require(utimes_nid_postfix(path.c_str(), second) == 0, "utimes target to second");
     std::error_code symlinkError;
     const auto linkPath = (root / "link.txt").string();
+#ifdef _WIN32
+    if (!CreateSymbolicLinkW(std::filesystem::path(linkPath).c_str(), std::filesystem::path(path).c_str(),
+            SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        symlinkError = std::error_code(GetLastError(), std::system_category());
+    }
+#else
     std::filesystem::create_symlink(path, linkPath, symlinkError);
+#endif
     if (!symlinkError) {
         Require(lutimes_nid_postfix(linkPath.c_str(), first) == 0, "lutimes modifies symlink");
         FileStat targetStatus{};
diff --git a/core/libs/tests/GuestKernelSys.cpp b/core/libs/tests/GuestKernelSys.cpp
index 1d1ac475bb..4c27092bda 100644
--- a/core/libs/tests/GuestKernelSys.cpp
+++ b/core/libs/tests/GuestKernelSys.cpp
@@ -381,7 +381,13 @@ int main() {
 #endif
     std::error_code error;
     const auto link = (root / "link").string();
+#ifdef _WIN32
+    if (!CreateSymbolicLinkW(std::filesystem::path(link).c_str(), L"sub\\target.txt", SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE)) {
+        error = std::error_code(GetLastError(), std::system_category());
+    }
+#else
     std::filesystem::create_symlink("sub/target.txt", link, error);
+#endif
     if (!error) {
         std::memset(buffer, '#', sizeof(buffer));
         Require(readlink_nid_postfix(link.c_str(), buffer, sizeof(buffer)) == 14);

From 718e1755ac6f1f6b3a17495da942a3d55e1ea41b Mon Sep 17 00:00:00 2001
From: xdCloudy <52116030+xdCloudy@users.noreply.github.com>
Date: Thu, 22 Oct 2026 22:15:21 +0100
Subject: [PATCH 026/218] docs: distinguish known exports from unverified ABI

---
 docs/dev/debt/libSceFreeTypeOt.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceFreeTypeOt.md b/docs/dev/debt/libSceFreeTypeOt.md
index 285157bd3c..b3e085d085 100644
--- a/docs/dev/debt/libSceFreeTypeOt.md
+++ b/docs/dev/debt/libSceFreeTypeOt.md
@@ -1,5 +1,5 @@
 # libSceFreeTypeOt technical debt
 
-### Unknown function info
+### Known export names; ABI prototypes unverified
 
 - The 150 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.

From 2a7cd60c89fe3a7f3cdf3afdcd56d99bf626a480 Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Thu, 22 Oct 2026 22:43:33 +0100
Subject: [PATCH 027/218] feat(freetype): implement system outline border
 queries

---
 .../prx/libSceFreeType/src/OutlineBorders.cpp |  68 +++++
 core/libs/prx/libSceFreeTypeOl/CMakeLists.txt |  37 +++
 core/libs/prx/libSceFreeTypeOt/CMakeLists.txt |   3 +
 .../libs/tests/GuestFreeTypeOutlineBorder.cpp | 260 ++++++++++++++++++
 docs/dev/debt/libSceFreeType.md               |   2 +
 5 files changed, 370 insertions(+)
 create mode 100644 core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
 create mode 100644 core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
 create mode 100644 core/libs/prx/libSceFreeTypeOt/CMakeLists.txt
 create mode 100644 core/libs/tests/GuestFreeTypeOutlineBorder.cpp

diff --git a/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp b/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
new file mode 100644
index 0000000000..0362e25ff0
--- /dev/null
+++ b/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
@@ -0,0 +1,68 @@
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include <algorithm>
+#include <bit>
+#include <cstdint>
+#include <stdexcept>
+
+namespace {
+
+bool Clockwise(const FreeType::GuestOutline* outline) {
+    if (!outline || outline->n_points == 0) return true;
+    if (!outline->points) throw std::invalid_argument("FreeType outline border: null points");
+    auto minimum = outline->points[0];
+    auto maximum = minimum;
+    for (unsigned i = 1; i < outline->n_points; ++i) {
+        const auto point = outline->points[i];
+        minimum.x = std::min(minimum.x, point.x);
+        minimum.y = std::min(minimum.y, point.y);
+        maximum.x = std::max(maximum.x, point.x);
+        maximum.y = std::max(maximum.y, point.y);
+    }
+    if (minimum.x == maximum.x || minimum.y == maximum.y) return false;
+    constexpr std::int64_t limit = 0x1000000;
+    if (minimum.x < -limit || minimum.y < -limit || maximum.x > limit || maximum.y > limit) return false;
+    if (outline->n_contours == 0) return false;
+    if (!outline->contours) throw std::invalid_argument("FreeType outline border: null contours");
+    unsigned first = 0;
+    for (unsigned contour = 0; contour < outline->n_contours; ++contour) {
+        const unsigned last = outline->contours[contour];
+        if (last < first || last >= outline->n_points)
+            throw std::invalid_argument("FreeType outline border: invalid contour endpoint");
+        first = last + 1;
+    }
+    const auto magnitude = [](std::int64_t value) { return static_cast<std::uint32_t>(value < 0 ? -value : value); };
+    const auto shift = [](std::uint32_t value) { const auto bits = std::bit_width(value); return bits > 15 ? bits - 15 : 0; };
+    const auto xShift = shift(magnitude(maximum.x) | magnitude(minimum.x));
+    const auto yShift = shift(static_cast<std::uint32_t>(maximum.y - minimum.y));
+    std::int64_t area = 0;
+    first = 0;
+    for (unsigned contour = 0; contour < outline->n_contours; ++contour) {
+        const unsigned last = outline->contours[contour];
+        auto previous = outline->points[last];
+        previous.x >>= xShift;
+        previous.y >>= yShift;
+        for (unsigned i = first; i <= last; ++i) {
+            auto current = outline->points[i];
+            current.x >>= xShift;
+            current.y >>= yShift;
+            area += (current.y - previous.y) * (current.x + previous.x);
+            previous = current;
+        }
+        first = last + 1;
+    }
+    return area < 0;
+}
+
+}
+
+extern "C" {
+
+std::int32_t APS5_VABI FT_Outline_GetInsideBorder_nid_postfix(const FreeType::GuestOutline* outline) {
+    return Clockwise(outline) ? 1 : 0;
+}
+
+std::int32_t APS5_VABI FT_Outline_GetOutsideBorder_nid_postfix(const FreeType::GuestOutline* outline) {
+    return Clockwise(outline) ? 0 : 1;
+}
+
+}
diff --git a/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
new file mode 100644
index 0000000000..a9053faf5c
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
@@ -0,0 +1,37 @@
+add_library(libSceFreeTypeOl SHARED EXCLUDE_FROM_ALL Export.cpp ../libSceFreeType/src/OutlineBorders.cpp)
+target_include_directories(libSceFreeTypeOl PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceFreeTypeOl)
+
+if(BUILD_TESTING)
+    add_test_executable(guest_freetype_outline_border_tests ${LIBS_INCLUDE_DIR}/tests/GuestFreeTypeOutlineBorder.cpp)
+    target_include_directories(guest_freetype_outline_border_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_freetype_outline_border_tests PRIVATE freetype ${CMAKE_DL_LIBS})
+    if(WIN32)
+        target_link_libraries(guest_freetype_outline_border_tests PRIVATE libc)
+    endif()
+    configure_windows_unwind(guest_freetype_outline_border_tests)
+    add_custom_target(freetype_outline_border_patched DEPENDS
+        ${PATCHED_DIR}/libSceFreeTypeOl.prx ${PATCHED_DIR}/libSceFreeTypeOt.prx ${LIBC_PATCHED})
+    add_dependencies(guest_freetype_outline_border_tests freetype_outline_border_patched)
+    add_test(NAME guest_freetype_outline_border_reference COMMAND guest_freetype_outline_border_tests reference)
+    foreach(module IN ITEMS Ol Ot)
+        foreach(border IN ITEMS inside outside)
+            add_test(NAME guest_freetype_outline_border_${module}_${border}
+                COMMAND guest_freetype_outline_border_tests $<TARGET_FILE:libSceFreeType${module}> ${border} raw)
+            add_test(NAME guest_freetype_outline_border_${module}_${border}_patched
+                COMMAND guest_freetype_outline_border_tests ${PATCHED_DIR}/libSceFreeType${module}.prx ${border} patched)
+            set_tests_properties(guest_freetype_outline_border_${module}_${border}
+                guest_freetype_outline_border_${module}_${border}_patched PROPERTIES TIMEOUT 20)
+            if(WIN32)
+                set_tests_properties(guest_freetype_outline_border_${module}_${border}
+                    guest_freetype_outline_border_${module}_${border}_patched PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeTypeOl>")
+            endif()
+        endforeach()
+    endforeach()
+    set_tests_properties(guest_freetype_outline_border_reference PROPERTIES TIMEOUT 20)
+    if(WIN32)
+        set_tests_properties(guest_freetype_outline_border_reference PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeTypeOl>")
+    endif()
+endif()
diff --git a/core/libs/prx/libSceFreeTypeOt/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOt/CMakeLists.txt
new file mode 100644
index 0000000000..aca3d5c0df
--- /dev/null
+++ b/core/libs/prx/libSceFreeTypeOt/CMakeLists.txt
@@ -0,0 +1,3 @@
+add_library(libSceFreeTypeOt SHARED EXCLUDE_FROM_ALL Export.cpp ../libSceFreeType/src/OutlineBorders.cpp)
+target_include_directories(libSceFreeTypeOt PRIVATE ${LIBS_INCLUDE_DIR})
+configure_windows_unwind(libSceFreeTypeOt)
diff --git a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
new file mode 100644
index 0000000000..e191a4c131
--- /dev/null
+++ b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
@@ -0,0 +1,260 @@
+#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include <ft2build.h>
+#include FT_FREETYPE_H
+#include FT_STROKER_H
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <limits>
+#include <stdexcept>
+#include <string>
+#include <thread>
+#include <vector>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#endif
+
+using FreeType::GuestOutline;
+using FreeType::GuestVector;
+using Query = int (APS5_VABI*)(const GuestOutline*);
+static_assert(sizeof(GuestOutline) == 40 && alignof(GuestOutline) == 8);
+static_assert(offsetof(GuestOutline, points) == 8 && offsetof(GuestOutline, contours) == 24);
+static_assert(offsetof(GuestOutline, flags) == 32 && sizeof(GuestVector) == 16);
+static_assert(sizeof(FT_StrokerBorder) == 4);
+
+namespace {
+
+bool nativeInside;
+
+void Require(bool result, const char* message) {
+    if (result) return;
+    std::fprintf(stderr, "FreeType outline border: %s\n", message);
+    std::exit(1);
+}
+
+int APS5_VABI Native(const GuestOutline* input) {
+    if (!input) return nativeInside ? FT_Outline_GetInsideBorder(nullptr) : FT_Outline_GetOutsideBorder(nullptr);
+    FT_Outline outline{};
+    outline.n_points = input->n_points;
+    outline.n_contours = input->n_contours;
+    outline.flags = input->flags;
+    std::vector<FT_Vector> points;
+    std::vector<unsigned short> contours;
+    if (outline.n_points > 0) {
+        for (int i = 0; i < outline.n_points; ++i) {
+            Require(input->points[i].x >= std::numeric_limits<FT_Pos>::min() && input->points[i].x <= std::numeric_limits<FT_Pos>::max(), "reference x range");
+            Require(input->points[i].y >= std::numeric_limits<FT_Pos>::min() && input->points[i].y <= std::numeric_limits<FT_Pos>::max(), "reference y range");
+            points.push_back({static_cast<FT_Pos>(input->points[i].x), static_cast<FT_Pos>(input->points[i].y)});
+        }
+        if (outline.n_contours > 0)
+            for (int i = 0; i < outline.n_contours; ++i) contours.push_back(input->contours[i]);
+    }
+    outline.points = points.data();
+    outline.contours = contours.data();
+    return nativeInside ? FT_Outline_GetInsideBorder(&outline) : FT_Outline_GetOutsideBorder(&outline);
+}
+
+int Expected(bool inside, bool clockwise) { return inside == clockwise ? 1 : 0; }
+
+class ReadOnlyTail {
+    void* memory;
+    std::size_t page;
+    void* data;
+public:
+    ReadOnlyTail(const void* source, std::size_t bytes) {
+#ifdef _WIN32
+        SYSTEM_INFO info;
+        GetSystemInfo(&info);
+        page = info.dwPageSize;
+        memory = VirtualAlloc(nullptr, page * 2, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
+        Require(memory != nullptr, "allocate guard pages");
+#else
+        page = static_cast<std::size_t>(sysconf(_SC_PAGESIZE));
+        memory = mmap(nullptr, page * 2, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+        Require(memory != MAP_FAILED, "allocate guard pages");
+#endif
+        Require(bytes <= page, "guard fixture size");
+        data = static_cast<unsigned char*>(memory) + page - bytes;
+        std::memcpy(data, source, bytes);
+#ifdef _WIN32
+        DWORD previous;
+        Require(VirtualProtect(memory, page, PAGE_READONLY, &previous) != 0, "read-only input");
+        Require(VirtualProtect(static_cast<unsigned char*>(memory) + page, page, PAGE_NOACCESS, &previous) != 0, "inaccessible neighbor");
+#else
+        Require(mprotect(memory, page, PROT_READ) == 0, "read-only input");
+        Require(mprotect(static_cast<unsigned char*>(memory) + page, page, PROT_NONE) == 0, "inaccessible neighbor");
+#endif
+    }
+    ~ReadOnlyTail() {
+#ifdef _WIN32
+        VirtualFree(memory, 0, MEM_RELEASE);
+#else
+        munmap(memory, page * 2);
+#endif
+    }
+    template<class T> T* As() const { return static_cast<T*>(data); }
+    void* End() const { return static_cast<unsigned char*>(memory) + page; }
+};
+
+void Cases(Query query, bool inside, bool guest) {
+    Require(query(nullptr) == Expected(inside, true), "null outline");
+    GuestOutline outline{};
+    outline.points = reinterpret_cast<GuestVector*>(std::uintptr_t{1});
+    outline.contours = reinterpret_cast<std::uint16_t*>(std::uintptr_t{1});
+    Require(query(&outline) == Expected(inside, true), "empty outline does not read points or contours");
+    std::array<GuestVector, 4> points{{{0, 0}, {0, 64}, {64, 64}, {64, 0}}};
+    std::uint16_t end = 3;
+    outline = {1, 4, points.data(), nullptr, &end, 0};
+    Require(query(&outline) == Expected(inside, true), "clockwise polygon");
+    const auto original = points;
+    for (const int flags : {0, 1, 2, -1}) {
+        outline.flags = flags;
+        Require(query(&outline) == Expected(inside, true), "orientation ignores outline flags");
+    }
+    Require(std::memcmp(points.data(), original.data(), sizeof(points)) == 0, "input points unchanged");
+    std::reverse(points.begin(), points.end());
+    Require(query(&outline) == Expected(inside, false), "counterclockwise polygon");
+    for (auto& point : points) point.y = 0;
+    Require(query(&outline) == Expected(inside, false), "collapsed polygon uses no-orientation fallback");
+    points = original;
+    outline.n_contours = 0;
+    Require(query(&outline) == Expected(inside, false), "no contours");
+    outline.n_contours = 1;
+    for (const std::int64_t edge : {std::int64_t{0x1000000}, std::int64_t{0x1000001}}) {
+        points = {{{-edge, -edge}, {-edge, edge}, {edge, edge}, {edge, -edge}}};
+        Require(query(&outline) == (edge == 0x1000000 ? Expected(inside, true) : Expected(inside, false)), "coordinate-limit boundary");
+    }
+    std::array<GuestVector, 8> mixed{};
+    std::copy(original.begin(), original.end(), mixed.begin());
+    std::copy(original.rbegin(), original.rend(), mixed.begin() + 4);
+    std::array<std::uint16_t, 2> mixedEnds{{3, 7}};
+    GuestOutline cancelled{2, 8, mixed.data(), nullptr, mixedEnds.data(), 0};
+    Require(query(&cancelled) == Expected(inside, false), "non-collapsed opposite contours cancel area");
+    std::vector<GuestVector> manyPoints(65535);
+    std::copy(original.rbegin(), original.rend(), manyPoints.begin());
+    std::uint16_t manyEnd = 65534;
+    GuestOutline many{1, 65535, manyPoints.data(), nullptr, &manyEnd, 0};
+    Require(query(&many) == Expected(inside, false), "unsigned point count above 32767");
+    std::fill(manyPoints.begin(), manyPoints.end(), GuestVector{});
+    std::copy(original.begin(), original.end(), manyPoints.end() - 4);
+    std::vector<std::uint16_t> manyEnds(65532);
+    for (unsigned i = 0; i < manyEnds.size() - 1; ++i) manyEnds[i] = static_cast<std::uint16_t>(i);
+    manyEnds.back() = 65534;
+    many.n_contours = 65532;
+    many.contours = manyEnds.data();
+    Require(query(&many) == Expected(inside, true), "unsigned contour count above 32767");
+    if (guest) {
+        for (const auto edge : {std::numeric_limits<std::int64_t>::min(), std::numeric_limits<std::int64_t>::max()}) {
+            points = original;
+            points[0].x = edge;
+            Require(query(&outline) == Expected(inside, false), "64-bit out-of-range coordinate");
+        }
+        points = original;
+        std::array<GuestVector, 20> repeated{};
+        std::array<std::uint16_t, 5> ends{};
+        const std::array<GuestVector, 4> large{{{0, 0}, {0, 16384}, {16384, 16384}, {16384, 0}}};
+        for (unsigned i = 0; i < 5; ++i) {
+            std::copy(large.begin(), large.end(), repeated.begin() + i * 4);
+            ends[i] = static_cast<std::uint16_t>(i * 4 + 3);
+        }
+        GuestOutline wide{5, 20, repeated.data(), nullptr, ends.data(), 0};
+        Require(query(&wide) == Expected(inside, true), "LP64 area must not wrap at 32 bits");
+        ReadOnlyTail guardedPoints(original.data(), sizeof(original));
+        ReadOnlyTail guardedEnds(&end, sizeof(end));
+        GuestOutline guarded{1, 4, guardedPoints.As<GuestVector>(), static_cast<unsigned char*>(guardedPoints.End()), guardedEnds.As<std::uint16_t>(), -1};
+        ReadOnlyTail guardedOutline(&guarded, sizeof(guarded));
+        Require(query(guardedOutline.As<GuestOutline>()) == Expected(inside, true), "read-only bounded inputs and unused inaccessible tags");
+        outline = {1, 4, nullptr, nullptr, &end, 0};
+        bool threw = false;
+        try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+        Require(threw, "null positive-count points are explicitly unsupported");
+        outline.points = points.data();
+        outline.contours = nullptr;
+        threw = false;
+        try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+        Require(threw, "null positive-count contours are explicitly unsupported");
+        for (const std::uint16_t badEnd : {std::uint16_t{4}, std::uint16_t{0xffff}}) {
+            auto invalidEnd = badEnd;
+            outline.contours = &invalidEnd;
+            threw = false;
+            try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+            Require(threw, "invalid contour endpoint is explicitly unsupported");
+        }
+        for (const std::uint16_t nextEnd : {std::uint16_t{2}, std::uint16_t{3}}) {
+            std::array<std::uint16_t, 2> invalidEnds{{3, nextEnd}};
+            outline.n_contours = 2;
+            outline.contours = invalidEnds.data();
+            threw = false;
+            try { query(&outline); } catch (const std::invalid_argument&) { threw = true; }
+            Require(threw, "non-increasing contour endpoints are explicitly unsupported");
+        }
+    }
+    std::uint32_t state = 7;
+    for (unsigned iteration = 0; iteration < 512; ++iteration) {
+        for (auto& point : points) {
+            state = state * 1664525u + 1013904223u;
+            point.x = static_cast<int>((state >> 16) & 255) - 128;
+            state = state * 1664525u + 1013904223u;
+            point.y = static_cast<int>((state >> 16) & 255) - 128;
+        }
+        outline = {1, 4, points.data(), nullptr, &end, 0};
+        nativeInside = inside;
+        Require(query(&outline) == Native(&outline), "bounded polygon matches bundled FreeType");
+    }
+    if (guest) {
+        points = original;
+        outline = {1, 4, points.data(), nullptr, &end, 0};
+        std::array<std::thread, 4> threads;
+        for (auto& thread : threads) thread = std::thread([&] {
+            for (unsigned i = 0; i < 100; ++i) Require(query(&outline) == Expected(inside, true), "concurrent independent query");
+        });
+        for (auto& thread : threads) thread.join();
+    }
+}
+
+}
+
+int main(int argc, char** argv) {
+#ifdef _WIN32
+    SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
+#endif
+    if (argc == 2 && std::strcmp(argv[1], "reference") == 0) {
+        for (const bool inside : {false, true}) {
+            nativeInside = inside;
+            Cases(Native, inside, false);
+        }
+        std::puts("Bundled FreeType reference cases passed");
+        return 0;
+    }
+    Require(argc == 4, "expected library, border and export mode");
+    const bool inside = std::strcmp(argv[2], "inside") == 0;
+    const bool patched = std::strcmp(argv[3], "patched") == 0;
+    const char* symbol = patched ? (inside ? "Pz262plj20w" : "sKneJjUXWkQ") :
+        (inside ? "FT_Outline_GetInsideBorder_nid_postfix" : "FT_Outline_GetOutsideBorder_nid_postfix");
+#ifdef _WIN32
+    const auto library = LoadLibraryA(argv[1]);
+    Require(library != nullptr, "load requested library");
+    auto query = reinterpret_cast<Query>(GetProcAddress(library, symbol));
+#else
+    const auto library = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    Require(library != nullptr, "load requested library");
+    auto query = reinterpret_cast<Query>(dlsym(library, symbol));
+#endif
+    if (!query) std::fprintf(stderr, "Missing %s\n", symbol);
+    Require(query != nullptr, "missing outline-border export");
+    Cases(query, inside, true);
+    std::puts("Guest outline-border cases passed");
+#ifdef _WIN32
+    FreeLibrary(library);
+#else
+    dlclose(library);
+#endif
+}
diff --git a/docs/dev/debt/libSceFreeType.md b/docs/dev/debt/libSceFreeType.md
index 6d4f98438d..5695ed22b3 100644
--- a/docs/dev/debt/libSceFreeType.md
+++ b/docs/dev/debt/libSceFreeType.md
@@ -4,6 +4,8 @@
 
 - [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char and FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures and errors are unverified; the LP64 guest adapter follows the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Character iteration uses the low 32 bits of the input code, as that version does internally, and updates the guest's selected charmap pointer without refreshing unrelated glyph or outline data. Guest charmap fields are treated as read-only copies of the native records.
 
+- [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeType/src/OutlineBorders.cpp) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.
+
 - [FT_Init_FreeType, FT_New_Face, FT_Set_Pixel_Sizes, FT_Get_Char_Index, FT_Load_Glyph, FT_Render_Glyph](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - the PS4 library is taken to be FreeType 2 built for LP64: the face, size, charmap, glyph slot, bitmap and outline layouts follow the public headers of the bundled FreeType 2.13.3 with a 64-bit `long`, which matches the offsets the OpenOrbis samples read (`face->glyph` at 0x98, `slot->advance` at 0x80, `slot->bitmap` at 0x98, `slot->bitmap_left` at 0xc0). Which FreeType version and options the console library is built with is unknown, so the behaviour and error codes are those of FreeType 2.13.3. The OpenOrbis font, keyboard, threading, system and SDL2 samples import these six functions
 
 - [FT_New_Memory_Face, FT_Done_Face and FT_Done_FreeType](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures, errors and generic-finalizer ordering are unverified; they follow the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/include/freetype/freetype.h) with LP64 guest arguments. Caller-owned font bytes must remain valid until the face is freed.

From a3c6c8206e4cd2a548170345143c7fff68a8dfa5 Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Thu, 22 Oct 2026 22:47:12 +0100
Subject: [PATCH 028/218] docs(freetype): avoid adjacent debt entry conflicts

---
 docs/dev/debt/libSceFreeType.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/dev/debt/libSceFreeType.md b/docs/dev/debt/libSceFreeType.md
index 5695ed22b3..89ac75af9c 100644
--- a/docs/dev/debt/libSceFreeType.md
+++ b/docs/dev/debt/libSceFreeType.md
@@ -2,10 +2,10 @@
 
 ### Unknown function info
 
-- [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char and FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures and errors are unverified; the LP64 guest adapter follows the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Character iteration uses the low 32 bits of the input code, as that version does internally, and updates the guest's selected charmap pointer without refreshing unrelated glyph or outline data. Guest charmap fields are treated as read-only copies of the native records.
-
 - [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeType/src/OutlineBorders.cpp) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.
 
+- [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char and FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures and errors are unverified; the LP64 guest adapter follows the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Character iteration uses the low 32 bits of the input code, as that version does internally, and updates the guest's selected charmap pointer without refreshing unrelated glyph or outline data. Guest charmap fields are treated as read-only copies of the native records.
+
 - [FT_Init_FreeType, FT_New_Face, FT_Set_Pixel_Sizes, FT_Get_Char_Index, FT_Load_Glyph, FT_Render_Glyph](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - the PS4 library is taken to be FreeType 2 built for LP64: the face, size, charmap, glyph slot, bitmap and outline layouts follow the public headers of the bundled FreeType 2.13.3 with a 64-bit `long`, which matches the offsets the OpenOrbis samples read (`face->glyph` at 0x98, `slot->advance` at 0x80, `slot->bitmap` at 0x98, `slot->bitmap_left` at 0xc0). Which FreeType version and options the console library is built with is unknown, so the behaviour and error codes are those of FreeType 2.13.3. The OpenOrbis font, keyboard, threading, system and SDL2 samples import these six functions
 
 - [FT_New_Memory_Face, FT_Done_Face and FT_Done_FreeType](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures, errors and generic-finalizer ordering are unverified; they follow the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/include/freetype/freetype.h) with LP64 guest arguments. Caller-owned font bytes must remain valid until the face is freed.

From 982350964ca784e111abd873524b81b4b7e37509 Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Thu, 22 Oct 2026 22:50:43 +0100
Subject: [PATCH 029/218] docs(freetype): keep provider debt in its module file

---
 docs/dev/debt/libSceFreeType.md   | 2 --
 docs/dev/debt/libSceFreeTypeOt.md | 5 +++++
 2 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 docs/dev/debt/libSceFreeTypeOt.md

diff --git a/docs/dev/debt/libSceFreeType.md b/docs/dev/debt/libSceFreeType.md
index 89ac75af9c..6d4f98438d 100644
--- a/docs/dev/debt/libSceFreeType.md
+++ b/docs/dev/debt/libSceFreeType.md
@@ -2,8 +2,6 @@
 
 ### Unknown function info
 
-- [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeType/src/OutlineBorders.cpp) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.
-
 - [FT_Select_Charmap, FT_Set_Charmap, FT_Get_First_Char and FT_Get_Next_Char](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - console signatures and errors are unverified; the LP64 guest adapter follows the bundled [FreeType 2.13.3](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftobjs.c). Character iteration uses the low 32 bits of the input code, as that version does internally, and updates the guest's selected charmap pointer without refreshing unrelated glyph or outline data. Guest charmap fields are treated as read-only copies of the native records.
 
 - [FT_Init_FreeType, FT_New_Face, FT_Set_Pixel_Sizes, FT_Get_Char_Index, FT_Load_Glyph, FT_Render_Glyph](../../../core/libs/prx/libSceFreeType/Export.cpp) (libSceFreeType) - the PS4 library is taken to be FreeType 2 built for LP64: the face, size, charmap, glyph slot, bitmap and outline layouts follow the public headers of the bundled FreeType 2.13.3 with a 64-bit `long`, which matches the offsets the OpenOrbis samples read (`face->glyph` at 0x98, `slot->advance` at 0x80, `slot->bitmap` at 0x98, `slot->bitmap_left` at 0xc0). Which FreeType version and options the console library is built with is unknown, so the behaviour and error codes are those of FreeType 2.13.3. The OpenOrbis font, keyboard, threading, system and SDL2 samples import these six functions
diff --git a/docs/dev/debt/libSceFreeTypeOt.md b/docs/dev/debt/libSceFreeTypeOt.md
new file mode 100644
index 0000000000..64f195f445
--- /dev/null
+++ b/docs/dev/debt/libSceFreeTypeOt.md
@@ -0,0 +1,5 @@
+# libSceFreeTypeOt technical debt
+
+### Unknown function info
+
+- [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeTypeOt/CMakeLists.txt) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.

From d56c3f91f25dbebd19a69f50d60c5e28be8ddad0 Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Thu, 22 Oct 2026 21:42:44 -0300
Subject: [PATCH 030/218] fix(libc): report the empty host name measured on a
 PS5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/Hostname.cpp | 2 +-
 core/libs/tests/GuestHostname.cpp   | 2 +-
 docs/dev/debt/libc.md               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libc/src/Hostname.cpp b/core/libs/prx/libc/src/Hostname.cpp
index 7b205e3659..fa03672531 100644
--- a/core/libs/prx/libc/src/Hostname.cpp
+++ b/core/libs/prx/libc/src/Hostname.cpp
@@ -5,7 +5,7 @@
 #include <cstring>
 
 extern "C" int APS5_VABI gethostname_nid_postfix(char* name, std::size_t length) {
-    constexpr char hostname[] = "AnyPS5";
+    constexpr char hostname[] = "";
     if (name == nullptr) return 0;
     const int savedError = errno;
     const auto count = std::min(length, sizeof(hostname));
diff --git a/core/libs/tests/GuestHostname.cpp b/core/libs/tests/GuestHostname.cpp
index 36e18845dc..3010f83baf 100644
--- a/core/libs/tests/GuestHostname.cpp
+++ b/core/libs/tests/GuestHostname.cpp
@@ -22,7 +22,7 @@ static void Require(bool condition, int line) {
 #define Check(value) Require((value), __LINE__)
 
 int main() {
-    constexpr std::string_view expected = "AnyPS5";
+    constexpr std::string_view expected = "";
     for (std::size_t length = 0; length <= expected.size() + 2; ++length) {
         std::vector<char> buffer(length + 2, '#');
         *__error_nid_postfix() = 71;
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index c9cda8fa5a..b56cb1dfa8 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -108,7 +108,7 @@
 - The Windows libc [exception unwinder](../../../core/libs/prx/libc/src/exception/Unwind.cpp) cannot run arbitrary Windows exception or termination handlers. It accepts GCC C and C++ handlers identified by a project's `.sehgcc` section and interprets their LSDA with the guest personalities. A handler in an unmarked module, such as a C++ cleanup through `__gxx_personality_seh0` in `libstdc++-6.dll` or a system DLL function like `qsort` in `ucrtbase.dll` (Windows 10 22H2), still stops unwinding and the exception is reported as unhandled. SjLj exceptions are unsupported; Scoop GCC 15.2.0 selects them when SEH is disabled and lacks the System V ABI SEH compiler fix carried by MSYS2.
 - The libc [SSE4a trap emulation](../../../core/libs/prx/libc/src/specifics/windows/Sse4aEmulation.hpp) on Windows is superseded by `--to-intel` and remains only until the relinked title has been verified without it.
 - [getifaddrs](../../../core/libs/prx/libc/src/Interfaces.cpp) (libc) lists host interfaces and IPv4/IPv6 addresses in FreeBSD's layouts. Windows omits per-interface AF_LINK entries and interfaces without an address; its flags are only `IFF_UP`, `IFF_RUNNING`, `IFF_LOOPBACK`, `IFF_BROADCAST` and `IFF_MULTICAST` (PPP/tunnel adapters omit broadcast and point-to-point, and an unspecified prefix length gets a host mask). On Linux, `AF_LINK` `if_data` maps non-Ethernet/loopback/PPP types to `IFT_OTHER` (1) and leaves `ifi_omcasts`, `ifi_noproto`, `ifi_hwassist`, `ifi_metric`, `ifi_epoch`, `ifi_lastchange`, unknown baud rates and address-entry `ifa_data` as 0/null; a point-to-point address without a peer loses `IFF_POINTOPOINT`, and an omitted IPv4 broadcast is derived from the netmask. Interface names are the host's (`if<index>` on Windows above 15 bytes).
-- [gethostname](../../../core/libs/prx/libc/src/Hostname.cpp) (libc) reports the fixed guest name `AnyPS5` without querying the host machine name. Buffer copying, null queries and `ENAMETOOLONG` follow [FreeBSD gethostname](https://github.com/freebsd/freebsd-src/blob/main/lib/libc/gen/gethostname.c); the console's configurable hostname and its integration with `sysctl` and name resolution are unverified and not implemented.
+- [gethostname](../../../core/libs/prx/libc/src/Hostname.cpp) (libc) reports an empty name without querying the host machine name, as a payload process read on a PS5 (firmware 13.60): 0 with only the terminator for a 256-byte and a 1-byte buffer. Buffer copying, null queries and `ENAMETOOLONG` follow [FreeBSD gethostname](https://github.com/freebsd/freebsd-src/blob/main/lib/libc/gen/gethostname.c); whether a title process or a console with a configured name reads another name, and the integration with `sysctl` and name resolution, are unverified and not implemented.
 - [wctomb_s, wcrtomb_s, mbstowcs_s and mbsrtowcs_s](../../../core/libs/prx/libc/src/BoundsChecking.cpp) (libc) follow the console's `libc.prx`, but convert in the single-byte C locale of `wctomb`, `wcrtomb` and `mbrtowc` (`MB_CUR_MAX` 1): a character above 0xFF is `EILSEQ` in `wctomb_s` and `wcrtomb_s`, and each byte is one wide character in `mbstowcs_s` and `mbsrtowcs_s`. The locale of a title's `libc.prx` was not measured. The `wcrtomb_s` path where a character does not fit `smax` and the `EILSEQ` paths of `mbstowcs_s` and `mbsrtowcs_s` are not reached
 - [wcsrtombs_s](../../../core/libs/prx/libc/src/Multibyte.cpp) (libc) follows the console's `libc.prx`, but a runtime-constraint violation only returns its error: the default handler there writes the message and a newline to `stderr` before returning, which is not done here. Conversion uses the C locale of `wcrtomb` (`MB_CUR_MAX` 1), so the path where a multibyte character does not fit the remaining space is not reached
 - [c16rtomb, c32rtomb, mbrtoc16 and mbrtoc32](../../../core/libs/prx/libc/src/Multibyte.cpp) (libSceLibcInternal, implemented in libc) follow the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x7D480 to 0x7D920), which converts to and from UTF-8 whatever the locale, with the original sequences of up to six bytes and no check for surrogates or for values above 0x10FFFF when encoding. The conversion state keeps the value in its first eight bytes and the count of bytes still expected (or 0x10 for a pending low surrogate, 1 for a stored high surrogate) as 16 bits at offset 0xA; a null state, which the console dereferences, throws. As on the console, `mbrtoc16` does not store the complete code point when it returns a high surrogate, so the low surrogate of the next call is built from the value the state last held, which is the partial value of an earlier incomplete call or whatever the caller initialised it to, `c16rtomb` returns -1 without setting `errno` when a high surrogate is not followed by a low one, and `mbrtoc16` and `mbrtoc32` report `EILSEQ` as 86. Measured on a PS5 (firmware 13.60) from a homebrew payload, the system `libSceLibcInternal`'s default locale also converts UTF-8 in `wcrtomb`, `wctomb`, `mbrtowc` and `mblen` (`wctomb` of U+263A gives `E2 98 BA`, `mblen` of a lone 0xE9 gives -1); this libc keeps its single-byte C locale, so [wctomb and mblen](../../../core/libs/prx/libc/src/Multibyte.cpp), which call `wcrtomb` and `mbtowc` here as they call the same internal routines on the console, share that difference. Titles bundle their own `libc.prx`, whose locale was not measured

From 4bee82086fcd5f1c4cbecc18e8332b99893686cb Mon Sep 17 00:00:00 2001
From: Emanuele <118837721+imellag@users.noreply.github.com>
Date: Fri, 23 Oct 2026 08:55:00 +0200
Subject: [PATCH 031/218] fix(agc): destroy buffers and memory on MoltenVK only
 while the graphics queue is idle

---
 core/libs/prx/libSceAgcDriver/CMakeLists.txt  |  15 ++
 .../Execution/src/VulkanDevice.cpp            |   8 +-
 .../Graphics/include/DeferredDestruction.hpp  |  17 +++
 .../Graphics/src/DeferredDestruction.cpp      | 134 ++++++++++++++++++
 .../libSceAgcDriver/Graphics/src/Recorder.cpp |   2 +
 .../Graphics/src/Resources.cpp                |   2 +
 .../tests/DeferredDestruction.cpp             | 131 +++++++++++++++++
 docs/dev/ENVIRONMENT.md                       |   1 +
 docs/dev/debt/libSceAgcDriver.md              |   1 +
 9 files changed, 310 insertions(+), 1 deletion(-)
 create mode 100644 core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp
 create mode 100644 core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp
 create mode 100644 core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp

diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index 48689954f3..14b146062e 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -330,6 +330,7 @@ set(agcDriverSources
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/PipelineCache.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/PipelineJournal.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Resources.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/DeferredDestruction.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/PlaceholderImages.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/Recorder.cpp
         ${CMAKE_CURRENT_SOURCE_DIR}/Graphics/src/ParallelCompare.cpp
@@ -1170,6 +1171,20 @@ if(BUILD_TESTING)
     endif()
 endif()
 
+add_test_executable(agc_deferred_destruction_tests EXCLUDE_FROM_ALL tests/DeferredDestruction.cpp)
+target_include_directories(agc_deferred_destruction_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
+target_link_libraries(agc_deferred_destruction_tests PRIVATE libSceAgcDriver libc)
+set_target_properties(agc_deferred_destruction_tests PROPERTIES CXX_EXTENSIONS OFF)
+configure_windows_unwind(agc_deferred_destruction_tests)
+if(BUILD_TESTING)
+    set_target_properties(agc_deferred_destruction_tests PROPERTIES EXCLUDE_FROM_ALL OFF)
+    add_test(NAME agc_deferred_destruction COMMAND agc_deferred_destruction_tests)
+    if(WIN32)
+        set_tests_properties(agc_deferred_destruction PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
+endif()
+
 add_test_executable(agc_device_memory_fallback_tests EXCLUDE_FROM_ALL tests/DeviceMemoryFallback.cpp)
 target_include_directories(agc_device_memory_fallback_tests PRIVATE ${LIBS_INCLUDE_DIR} ${CMAKE_SOURCE_DIR}/core/shader/recompiler ${ANYPS5_VULKAN_HEADERS_INCLUDE_DIR})
 target_link_libraries(agc_device_memory_fallback_tests PRIVATE libSceAgcDriver libc)
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
index 9d93a5127f..e2396b1dd2 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
@@ -7,6 +7,7 @@
 #include "SpirvBackend/SpirvOptimizer.hpp"
 #endif
 #include "prx/libSceAgcDriver/Graphics/include/PipelineJournal.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
 #include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
 #include "prx/libSceAgcDriver/Execution/include/FloatFlushProbe.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"
@@ -306,6 +307,8 @@ struct VulkanDevice::State {
     PFN_vkGetCalibratedTimestampsKHR calibratedTimestamps = nullptr;
     PFN_vkCmdSetCheckpointNV checkpointMarker = nullptr;
     bool deviceLostHook = false;
+    bool deferDestruction = false;
+    PFN_vkGetDeviceProcAddr contextDeviceProc = nullptr;
     VkTimeDomainKHR hostTimeDomain = VK_TIME_DOMAIN_DEVICE_KHR;
     VkPhysicalDeviceSubgroupProperties subgroup{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_SUBGROUP_PROPERTIES};
     std::vector<std::uint32_t> capabilities{1};
@@ -844,6 +847,7 @@ struct VulkanDevice::State {
                 destroyPool(device, pool, nullptr);
             }
             if (settlePool != VK_NULL_HANDLE) destroyPool(device, settlePool, nullptr);
+            Graphics::DestroyDeferredObjects(device);
             destroyDevice(device, nullptr);
         }
         if (instance != VK_NULL_HANDLE) {
@@ -1182,6 +1186,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
         VkPhysicalDeviceProperties2 driverProperties{VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_PROPERTIES_2, &driver};
         state->InstanceFunction<PFN_vkGetPhysicalDeviceProperties2>("vkGetPhysicalDeviceProperties2")(selected, &driverProperties);
         driverId = driver.driverID;
+        state->deferDestruction = driver.driverID == VK_DRIVER_ID_MOLTENVK && std::getenv("APS5_NO_DEFERRED_DESTRUCTION") == nullptr;
         state->driverInfo = std::string(driver.driverName) + " " + driver.driverInfo;
         state->individuallyFreeDescriptorSets = driver.driverID == VK_DRIVER_ID_MESA_LLVMPIPE;
         state->subgroupControlBarriers = SubgroupControlBarrierUsable(driver.driverID);
@@ -1979,6 +1984,7 @@ VulkanDevice::VulkanDevice(const PresentationWindow* window, bool compileOnly) :
     check(state->InstanceFunction<PFN_vkCreateDevice>("vkCreateDevice")(selected, &deviceInfo, nullptr, &state->device), "vkCreateDevice");
     state->shaderProfile = std::move(shaderProfile);
     if (compileOnly) return;
+    if (state->deferDestruction) state->contextDeviceProc = Graphics::DeferDestructionToIdle(state->device, state->deviceProc);
     if (calibratedTimestamps != nullptr) {
         const bool khr = std::strcmp(calibratedTimestamps, VK_KHR_CALIBRATED_TIMESTAMPS_EXTENSION_NAME) == 0;
         const auto domains = reinterpret_cast<PFN_vkGetPhysicalDeviceCalibrateableTimeDomainsKHR>(state->instanceProc(state->instance, khr ? "vkGetPhysicalDeviceCalibrateableTimeDomainsKHR" : "vkGetPhysicalDeviceCalibrateableTimeDomainsEXT"));
@@ -3777,7 +3783,7 @@ Graphics::Context VulkanDevice::buildContext() const {
         state->physical,
         state->queue,
         state->pool,
-        state->deviceProc,
+        state->contextDeviceProc != nullptr ? state->contextDeviceProc : state->deviceProc,
         state->InstanceFunction<PFN_vkGetPhysicalDeviceFormatProperties>("vkGetPhysicalDeviceFormatProperties"),
         state->InstanceFunction<PFN_vkGetPhysicalDeviceImageFormatProperties>("vkGetPhysicalDeviceImageFormatProperties"),
         state->memoryProperties,
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp b/core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp
new file mode 100644
index 0000000000..70fb764122
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp
@@ -0,0 +1,17 @@
+#ifndef CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_DEFERREDDESTRUCTION_HPP
+#define CORE_LIBS_PRX_LIBSCEAGCDRIVER_GRAPHICS_INCLUDE_DEFERREDDESTRUCTION_HPP
+
+#include "prx/libSceAgcDriver/Graphics/include/Context.hpp"
+#include <chrono>
+#include <cstddef>
+
+namespace AgcDriver::Graphics {
+
+PFN_vkGetDeviceProcAddr DeferDestructionToIdle(VkDevice device, PFN_vkGetDeviceProcAddr resolver);
+void DestroyDeferredAtIdle(const Context& context, std::chrono::steady_clock::time_point now = std::chrono::steady_clock::now());
+void DestroyDeferredObjects(VkDevice device) noexcept;
+std::size_t DeferredObjects(VkDevice device);
+
+}
+
+#endif
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp
new file mode 100644
index 0000000000..1fb049628a
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp
@@ -0,0 +1,134 @@
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
+#include <atomic>
+#include <cstring>
+#include <mutex>
+#include <stdexcept>
+#include <string>
+#include <unordered_map>
+#include <vector>
+
+namespace AgcDriver::Graphics {
+
+namespace {
+
+constexpr std::size_t DrainObjects = 512;
+constexpr auto DrainAge = std::chrono::milliseconds(100);
+
+struct Deferred {
+    PFN_vkDestroyBuffer destroyBuffer = nullptr;
+    PFN_vkFreeMemory freeMemory = nullptr;
+    std::vector<VkBuffer> buffers;
+    std::vector<VkDeviceMemory> memory;
+    std::chrono::steady_clock::time_point oldest{};
+};
+
+struct Registry {
+    std::mutex mutex;
+    std::unordered_map<VkDevice, Deferred> devices;
+    std::atomic<PFN_vkGetDeviceProcAddr> resolver{nullptr};
+};
+
+Registry& registry() {
+    static auto& state = *new Registry();
+    return state;
+}
+
+void destroyAll(VkDevice device, const Deferred& deferred) noexcept {
+    for (const auto buffer : deferred.buffers) deferred.destroyBuffer(device, buffer, nullptr);
+    for (const auto memory : deferred.memory) deferred.freeMemory(device, memory, nullptr);
+}
+
+template<typename THandle>
+bool defer(VkDevice device, THandle handle, std::vector<THandle> Deferred::*list) noexcept {
+    try {
+        auto& state = registry();
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(device);
+        if (found == state.devices.end()) return false;
+        auto& deferred = found->second;
+        if (deferred.buffers.empty() && deferred.memory.empty()) deferred.oldest = std::chrono::steady_clock::now();
+        (deferred.*list).push_back(handle);
+        return true;
+    } catch (...) {
+        return false;
+    }
+}
+
+VKAPI_ATTR void VKAPI_CALL deferredDestroyBuffer(VkDevice device, VkBuffer buffer, const VkAllocationCallbacks* allocator) {
+    if (buffer == VK_NULL_HANDLE || defer(device, buffer, &Deferred::buffers)) return;
+    reinterpret_cast<PFN_vkDestroyBuffer>(registry().resolver.load(std::memory_order_acquire)(device, "vkDestroyBuffer"))(device, buffer, allocator);
+}
+
+VKAPI_ATTR void VKAPI_CALL deferredFreeMemory(VkDevice device, VkDeviceMemory memory, const VkAllocationCallbacks* allocator) {
+    if (memory == VK_NULL_HANDLE || defer(device, memory, &Deferred::memory)) return;
+    reinterpret_cast<PFN_vkFreeMemory>(registry().resolver.load(std::memory_order_acquire)(device, "vkFreeMemory"))(device, memory, allocator);
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL deferringDeviceProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkDestroyBuffer") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&deferredDestroyBuffer);
+    if (std::strcmp(name, "vkFreeMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&deferredFreeMemory);
+    return registry().resolver.load(std::memory_order_acquire)(device, name);
+}
+
+}
+
+PFN_vkGetDeviceProcAddr DeferDestructionToIdle(VkDevice device, PFN_vkGetDeviceProcAddr resolver) {
+    if (device == VK_NULL_HANDLE || resolver == nullptr) throw std::invalid_argument("AGC graphics: deferred destruction needs a device and its resolver");
+    Deferred deferred;
+    deferred.destroyBuffer = reinterpret_cast<PFN_vkDestroyBuffer>(resolver(device, "vkDestroyBuffer"));
+    deferred.freeMemory = reinterpret_cast<PFN_vkFreeMemory>(resolver(device, "vkFreeMemory"));
+    if (deferred.destroyBuffer == nullptr || deferred.freeMemory == nullptr) throw std::runtime_error("AGC graphics: missing Vulkan function: vkDestroyBuffer or vkFreeMemory");
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    const auto current = state.resolver.load(std::memory_order_acquire);
+    if (current != nullptr && current != resolver) throw std::runtime_error("AGC graphics: deferred destruction found two different device resolvers");
+    if (!state.devices.emplace(device, std::move(deferred)).second) throw std::runtime_error("AGC graphics: deferred destruction was set up twice for one device");
+    state.resolver.store(resolver, std::memory_order_release);
+    return &deferringDeviceProc;
+}
+
+void DestroyDeferredAtIdle(const Context& context, std::chrono::steady_clock::time_point now) {
+    auto& state = registry();
+    {
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(context.device);
+        if (found == state.devices.end()) return;
+        const auto objects = found->second.buffers.size() + found->second.memory.size();
+        if (objects == 0 || (objects < DrainObjects && now - found->second.oldest < DrainAge)) return;
+    }
+    const auto idle = context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle")(context.queue);
+    if (idle != VK_SUCCESS && idle != VK_ERROR_DEVICE_LOST) throw std::runtime_error("AGC graphics: vkQueueWaitIdle before destroying deferred objects: Vulkan result " + std::to_string(idle));
+    Deferred taken;
+    {
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(context.device);
+        if (found == state.devices.end()) return;
+        taken.destroyBuffer = found->second.destroyBuffer;
+        taken.freeMemory = found->second.freeMemory;
+        taken.buffers.swap(found->second.buffers);
+        taken.memory.swap(found->second.memory);
+    }
+    destroyAll(context.device, taken);
+}
+
+void DestroyDeferredObjects(VkDevice device) noexcept {
+    Deferred taken;
+    {
+        auto& state = registry();
+        std::lock_guard lock(state.mutex);
+        const auto found = state.devices.find(device);
+        if (found == state.devices.end()) return;
+        taken = std::move(found->second);
+        state.devices.erase(found);
+    }
+    destroyAll(device, taken);
+}
+
+std::size_t DeferredObjects(VkDevice device) {
+    auto& state = registry();
+    std::lock_guard lock(state.mutex);
+    const auto found = state.devices.find(device);
+    return found == state.devices.end() ? 0 : found->second.buffers.size() + found->second.memory.size();
+}
+
+}
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
index 30fb7b1889..557102f333 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp
@@ -7,6 +7,7 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/ParallelCompare.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
 #include "prx/libSceAgcDriver/Graphics/shaders/MeshArguments_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/SampleCounter_spv.h"
 #include "prx/libSceAgcDriver/Graphics/shaders/SampleDumps_spv.h"
@@ -3586,6 +3587,7 @@ void Recorder::Submit() {
         submission.pSignalSemaphores = &timeline;
     }
     if (hold != VK_NULL_HANDLE || timeline != VK_NULL_HANDLE) submission.pNext = &timelineInfo;
+    DestroyDeferredAtIdle(context);
     const auto submitStart = std::chrono::steady_clock::now();
     const auto result = function(queueSubmit, "vkQueueSubmit")(context.queue, 1, &submission, batch->fence);
     if (result == VK_ERROR_DEVICE_LOST) {
diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp
index 4f30207def..ea37fed7ef 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/Resources.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Recorder.hpp"
 #include "prx/libSceAgcDriver/Execution/include/PerformanceTimer.hpp"
 #include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
@@ -381,6 +382,7 @@ void CommandBatch::Submit() {
     submission.commandBufferCount = 1;
     submission.pCommandBuffers = &commands;
     timing.Mark("command_end");
+    DestroyDeferredAtIdle(context);
     Check(context.Function<PFN_vkQueueSubmit>("vkQueueSubmit")(context.queue, 1, &submission, fence), "vkQueueSubmit graphics");
     pending = true;
     submitted = true;
diff --git a/core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp b/core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp
new file mode 100644
index 0000000000..7873086b80
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/DeferredDestruction.cpp
@@ -0,0 +1,131 @@
+#include "prx/libSceAgcDriver/Graphics/include/DeferredDestruction.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <exception>
+#include <string>
+#include <vector>
+
+using namespace AgcDriver::Graphics;
+
+namespace {
+
+int failures = 0;
+
+void Expect(bool condition, const std::string& what) {
+    if (condition) return;
+    std::fprintf(stderr, "FAIL: %s\n", what.c_str());
+    ++failures;
+}
+
+std::vector<std::string> events;
+VkResult idleResult = VK_SUCCESS;
+
+template<typename THandle>
+THandle Handle(std::uintptr_t value) {
+    return reinterpret_cast<THandle>(value);
+}
+
+std::string Name(const char* kind, const void* handle) {
+    return std::string(kind) + std::to_string(reinterpret_cast<std::uintptr_t>(handle));
+}
+
+VKAPI_ATTR void VKAPI_CALL mockDestroyBuffer(VkDevice device, VkBuffer buffer, const VkAllocationCallbacks*) {
+    events.push_back(Name("buffer ", reinterpret_cast<const void*>(buffer)) + Name(" on ", device));
+}
+
+VKAPI_ATTR void VKAPI_CALL mockFreeMemory(VkDevice device, VkDeviceMemory memory, const VkAllocationCallbacks*) {
+    events.push_back(Name("memory ", reinterpret_cast<const void*>(memory)) + Name(" on ", device));
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL mockQueueWaitIdle(VkQueue queue) {
+    events.push_back(Name("idle ", queue));
+    return idleResult;
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL mockProc(VkDevice, const char* name) {
+    if (std::strcmp(name, "vkDestroyBuffer") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&mockDestroyBuffer);
+    if (std::strcmp(name, "vkFreeMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&mockFreeMemory);
+    if (std::strcmp(name, "vkQueueWaitIdle") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&mockQueueWaitIdle);
+    return nullptr;
+}
+
+Context ContextFor(VkDevice device, PFN_vkGetDeviceProcAddr proc) {
+    Context context{};
+    context.device = device;
+    context.queue = Handle<VkQueue>(0x900);
+    context.deviceProc = proc;
+    return context;
+}
+
+void DeferredUntilTheQueueIsIdle() {
+    events.clear();
+    const auto device = Handle<VkDevice>(0x100);
+    const auto proc = DeferDestructionToIdle(device, mockProc);
+    const auto context = ContextFor(device, proc);
+    Expect(context.Function<PFN_vkQueueWaitIdle>("vkQueueWaitIdle") == &mockQueueWaitIdle, "a function other than vkDestroyBuffer and vkFreeMemory was not passed through");
+    context.Function<PFN_vkFreeMemory>("vkFreeMemory")(device, Handle<VkDeviceMemory>(0x21), nullptr);
+    context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, Handle<VkBuffer>(0x11), nullptr);
+    context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, VK_NULL_HANDLE, nullptr);
+    Expect(events.empty() && DeferredObjects(device) == 2, "a destroy or free was not deferred, or a null handle was queued");
+    const auto start = std::chrono::steady_clock::now();
+    DestroyDeferredAtIdle(context, start);
+    Expect(events.empty() && DeferredObjects(device) == 2, "deferred objects younger than the drain age were destroyed, or the queue was waited for");
+    DestroyDeferredAtIdle(context, start + std::chrono::seconds(1));
+    const std::vector<std::string> drained{"idle 2304", "buffer 17 on 256", "memory 33 on 256"};
+    Expect(events == drained && DeferredObjects(device) == 0, "old deferred objects were not destroyed after a queue wait, buffers before memory");
+    events.clear();
+    for (std::uintptr_t index = 0; index < 512; ++index) context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, Handle<VkBuffer>(0x1000 + index), nullptr);
+    DestroyDeferredAtIdle(context, std::chrono::steady_clock::now());
+    Expect(events.size() == 513 && events.front() == "idle 2304" && DeferredObjects(device) == 0, "512 young deferred objects were not destroyed after a queue wait");
+    events.clear();
+    idleResult = VK_ERROR_OUT_OF_HOST_MEMORY;
+    context.Function<PFN_vkFreeMemory>("vkFreeMemory")(device, Handle<VkDeviceMemory>(0x22), nullptr);
+    bool threw = false;
+    try {
+        DestroyDeferredAtIdle(context, std::chrono::steady_clock::now() + std::chrono::seconds(1));
+    } catch (const std::exception&) {
+        threw = true;
+    }
+    Expect(threw && DeferredObjects(device) == 1 && events.size() == 1, "a failed queue wait did not throw, or destroyed the deferred objects");
+    idleResult = VK_SUCCESS;
+    events.clear();
+    DestroyDeferredObjects(device);
+    Expect(events == std::vector<std::string>{"memory 34 on 256"} && DeferredObjects(device) == 0, "the deferred objects were not destroyed when the device went, or the queue was waited for");
+    events.clear();
+    context.Function<PFN_vkDestroyBuffer>("vkDestroyBuffer")(device, Handle<VkBuffer>(0x12), nullptr);
+    Expect(events == std::vector<std::string>{"buffer 18 on 256"}, "a destroy after the device went was deferred");
+}
+
+void OtherDevicesDestroyAtOnce() {
+    events.clear();
+    const auto device = Handle<VkDevice>(0x101);
+    const auto proc = DeferDestructionToIdle(device, mockProc);
+    const auto other = Handle<VkDevice>(0x102);
+    reinterpret_cast<PFN_vkFreeMemory>(proc(other, "vkFreeMemory"))(other, Handle<VkDeviceMemory>(0x23), nullptr);
+    Expect(events == std::vector<std::string>{"memory 35 on 258"} && DeferredObjects(other) == 0, "a free on a device without deferred destruction was deferred");
+    bool threw = false;
+    try {
+        DeferDestructionToIdle(device, mockProc);
+    } catch (const std::exception&) {
+        threw = true;
+    }
+    Expect(threw, "deferred destruction was set up twice for one device");
+    DestroyDeferredObjects(device);
+}
+
+}
+
+int main() {
+    try {
+        DeferredUntilTheQueueIsIdle();
+        OtherDevicesDestroyAtOnce();
+    } catch (const std::exception& error) {
+        std::fprintf(stderr, "FAIL: %s\n", error.what());
+        return 1;
+    }
+    if (failures != 0) return 1;
+    std::puts("deferred destruction tests passed");
+    return 0;
+}
diff --git a/docs/dev/ENVIRONMENT.md b/docs/dev/ENVIRONMENT.md
index e56ecbaa7f..7df9affc21 100644
--- a/docs/dev/ENVIRONMENT.md
+++ b/docs/dev/ENVIRONMENT.md
@@ -206,6 +206,7 @@ The code reads environment names through `getenv`, `IsEnvironmentSet`, `kibSetti
 | `APS5_NO_CPU_COPY` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Memory/BufferCopy.cpp` |  | disables the CPU copy path of the copy HLE |
 | `APS5_NO_DATA_HITS` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/Driver/Dispatch/DispatchCache.cpp` |  | disables dispatch-cache hits that differ only in ShaderData or FlattenedSrt words |
 | `APS5_NO_DCC_PRESYNC` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp` |  | leaves the DCC key ranges out of the surfaces a build pre-syncs, so only the surface itself waits for its producer |
+| `APS5_NO_DEFERRED_DESTRUCTION` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | on MoltenVK, destroys buffers and frees device memory as soon as the driver releases them, instead of while the graphics queue is idle (KhronosGroup/MoltenVK#2876) |
 | `APS5_NO_DCC_WORD_SCAN` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/DccMetadata.cpp` |  | restores the byte-by-byte DCC key scan instead of the word-at-a-time compare |
 | `APS5_NO_DEFERRED_EVICTION` | presence | `core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp` |  | destroys displaced resource-cache entries under the mutex instead of deferring them to the open batch |
 | `APS5_NO_DEFERRED_SETTLES` | presence | `core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp` |  | settles watched private host imports as they open instead of through the deferred block-settling path (Windows only) |
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index 11a174c06c..3a46747f9e 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -99,6 +99,7 @@
 - [Unused pixel programs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver): a bound pixel program is skipped when color masks have no intersection and DB export and execution enables are clear, regardless of retained SPI_SHADER_Z_FORMAT. This follows [AMD PAL DbShaderControl](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/gfx9AbiToPipelineRegisters.h) and its [GFX10 register definitions](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/hw/gfxip/gfx9/chip/gfx9_plus_merged_registers.h), not a hardware measurement. Enabled DB_ALPHA_TO_MASK conservatively retains the program even with ALPHA_TO_MASK_DISABLE, because DecodeState currently enables Vulkan alpha-to-coverage without applying that override. Console behavior for these combinations has not been measured.
 - [Sample masks](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `PA_SC_AA_MASK_X0Y0_X1Y0` and `PA_SC_AA_MASK_X0Y1_X1Y1` hold one 16-bit sample mask for each pixel of the aligned 2x2 quad ([Mesa gfx10.json](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/registers/gfx10.json#L13512)); only the bits of the `MSAA_NUM_SAMPLES` rasterized samples count, and at one sample bit 0 of a pixel's field covers every sample of the target the draw is raised to. A mask equal for the four pixels is the Vulkan `pSampleMask`, the case [radv](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_cmd_buffer.c#L13633) and [radeonsi](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/gallium/drivers/radeonsi/si_state.c#L4218) program; with early fragment tests it needs `earlyFragmentSampleMaskTestBeforeSampleCounting` ([radv](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_physical_device.c#L2079) reports it). A mask that differs between the pixels is applied in the pixel shader without early fragment tests: a pixel whose mask covers all or none of its samples is demoted to a helper invocation by `gl_FragCoord` parity and killed when the program returns (the Radeon 860M's Windows driver 32.0.13058.8001 writes undefined colour for a demoted pixel whose export leaves its output unwritten), and otherwise the pixel's mask is ANDed into `gl_SampleMask` (with alpha-to-coverage and the mask export) after demoting invocations whose `SampleMask` input it leaves empty. A pixel program with early Z that writes memory under depth, stencil or depth-bounds tests is therefore refused. That XnYm is the pixel at (x mod 2, y mod 2) = (n, m) is read from the field names; that the mask removes samples before the depth and stencil tests and occlusion counting is inferred from radv implementing the Vulkan sample mask test with it; and that it takes no part in the centroid (`AA_MASK_CENTROID_DTMN` 0) is inferred from radv setting that bit only for conservative rasterization. None of it is measured on gfx1013. A mask equal for the four pixels that removes some but not all samples of a pixel is refused with active centroid inputs, since where Vulkan puts the centroid relative to `pSampleMask` is implementation-defined, and any partial mask is refused with conservative rasterization (radv sets `PREZ_AA_MASK_ENABLE` and `POSTZ_AA_MASK_ENABLE` [there](https://gitlab.freedesktop.org/mesa/mesa/-/blob/7b87f8ad226e/src/amd/vulkan/radv_cmd_buffer.c#L13653), which 0x6001 leaves clear).
 - [Covered-centroid raster state](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) accepts PA_SC_AA_CONFIG.COVERED_CENTROID_IS_CENTER only when the pixel program is skipped or SPI_PS_INPUT_ENA and SPI_PS_INPUT_ADDR have no active perspective or linear centroid input. Bit 29 follows [PS5_Mesa GFX10.3 registers](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json); [RADV](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/vulkan/radv_cmd_buffer.c) sets it on GFX10.3 and later. Active centroid interpolation and unspecified input registers still throw. Console covered-pixel centroid results were not measured.
+- [Buffer destruction on MoltenVK](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DeferredDestruction.cpp) (libSceAgcDriver): on MoltenVK, buffers and device memory released through the graphics context are destroyed only while the graphics queue is idle. MoltenVK makes every live `SHADER_DEVICE_ADDRESS` buffer resident, unretained, in each command buffer that uses device addresses, also in ones submitted after the release, and passes Metal a nil buffer once its memory is freed ([KhronosGroup/MoltenVK#2876](https://github.com/KhronosGroup/MoltenVK/issues/2876)). A recorder or command batch submission drains the queue under the GPU mutex once 512 objects wait or the oldest has waited 100 ms (`vkQueueWaitIdle`, then the buffers, then the memory), which stalls the CPU until the GPU is idle; memory released under pressure only returns at that drain. `VulkanDevice`'s own destroys are not deferred. `APS5_NO_DEFERRED_DESTRUCTION=1` turns this off; remove it once MoltenVK fixes #2876.
 - [Compute LDS beyond the device's shared-memory limit](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) lives in a coherent storage buffer with one slice of `LDS bytes / 4 + 1` dwords, rounded up to an even count so that 64-bit atomics stay 8-byte aligned, per workgroup (the dword after the LDS is the atomic lock on a device without `shaderBufferInt64Atomics`), shared by all such dispatches and grown in 1 MiB steps up to `maxStorageBufferRange`; a dispatch whose slices do not fit throws. It is slower than shared memory and its cost was not measured. An indirect dispatch of such a program always reads its group counts on the CPU. Its results are pinned against the in-limit semantics in `agc_driver_lds_beyond_device_limit`, not measured on hardware.
 - [AGC buffer allocations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) retry host/device out-of-memory once after reclaiming idle pool buffers and fully unused slab blocks. Live buffers and blocks with live slots are retained. Live images and other retained resources have no global memory bound; allocation failure still throws when reclaim cannot satisfy the request.
 - [Host placement after a device-memory refusal](../../../core/libs/prx/libSceAgcDriver/Graphics/src/BufferPool.cpp) (libSceAgcDriver): when the driver refuses a device-local allocation with `VK_ERROR_OUT_OF_DEVICE_MEMORY` after the pool's trim and the texture-cache release, device buffers and images (textures, storage textures, block, repacked, depth, depth plane and stencil copies, render, depth and multisampled targets and attachment proxies) are allocated in a host memory type their requirements allow. A host-placed device buffer leaves the pool on release. A host-placed image keeps that placement until it is destroyed and is never moved back to device memory, so every access to it crosses PCIe for its lifetime. The placements are counted in a rate-limited `[bufferpool]` line with the cumulative MiB, not the resident bytes. The 1x1 denormal clear probe still allocates device memory directly and throws on a refusal.

From 96bccd4c9416d70ec106b569a5b6f748ef7370e1 Mon Sep 17 00:00:00 2001
From: fablevoid <340827264+fable-void@users.noreply.github.com>
Date: Thu, 15 Oct 2026 20:48:10 +0000
Subject: [PATCH 032/218] perf(agc): wait for the display keys' writer before a
 present takes the device lock's time

The presenter checks a display buffer's DCC keys under the device lock.
When the batch of the kernel that writes those keys had not finished,
the check waited for the GPU while holding the lock, and the queue
worker recording the next frame waited behind the presenter.

PresentDisplayBuffer now first syncs through the key range with the
unlocked wait the flush hook uses: the presenter's acquisition is the
outermost on its thread and nothing has been decided yet, so the lock
is released for the GPU wait and retaken for the completions. The key
check that follows finds the batch finished.

Tested on Windows in a title's menu: the presenter's GPU waits under
the lock went from 721 (1.38 s) to 1 (0 ms) per 10 s, and the queue
worker's waits for the lock from 1.47 s to 0.18 s per 10 s.
---
 core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
index 4eb2724ed7..58683b2116 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
@@ -3213,6 +3213,7 @@ FrameDumps& Dumps() {
 }
 
 bool VulkanDevice::PresentDisplayBuffer(const DisplayBuffer& buffer) {
+    if (buffer.dccAddress != 0 && buffer.tilingMode == 0) state->recorder->SyncThrough(buffer.dccAddress, DisplayBufferKeyBytes(buffer), true);
     static const bool storeAtFlip = Graphics::StorageTexture::StoreAtFlipRequested(std::getenv("APS5_STORE_AT_FLIP"));
     if (storeAtFlip) Graphics::StorageTexture::FlushAllPending("flip");
     else Graphics::StorageTexture::FlushDumpSelected("flip");

From a3af6b1149de514093ac0a3eef230d6b57c5eab6 Mon Sep 17 00:00:00 2001
From: Yunus Shaikh <75296019+EagleBearerYS@users.noreply.github.com>
Date: Wed, 21 Oct 2026 22:33:39 +0000
Subject: [PATCH 033/218] perf(agc): count presents that waited for the display
 keys' writer unlocked

With APS5_PROFILE_DRAW set, the [present] line now counts the presents
whose sync through the display buffer's DCC keys waited for the GPU
before the key check, outside the GPU mutex, and the milliseconds they
waited: the waits the presenter took under the mutex before.
---
 .../libSceAgcDriver/Execution/include/VulkanDevice.hpp |  4 ++--
 .../Execution/src/Driver/Presentation.cpp              |  2 +-
 .../prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp | 10 +++++++++-
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
index 52303ede78..b30278117f 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp
@@ -252,8 +252,8 @@ public:
     // blit-submit times after the flip packet; noted in-place reads checked
     // (APS5_FLIP_READ_CHECK=1) and found overwritten before the blit's fence.
     struct PresentStatistics {
-        std::uint64_t presents, gpuUnread, batchesAheadOfBlit, batchesAfterFlip, readsChecked, readsOverwritten, acquireDrops;
-        double gpuBusyMs, gpuGapMs, lastSubmitAfterFlipMs, blitSubmitAfterFlipMs;
+        std::uint64_t presents, gpuUnread, batchesAheadOfBlit, batchesAfterFlip, readsChecked, readsOverwritten, acquireDrops, keyWriterWaits;
+        double gpuBusyMs, gpuGapMs, lastSubmitAfterFlipMs, blitSubmitAfterFlipMs, keyWriterWaitMs;
     };
     static PresentStatistics PresentCounts();
     struct PresyncStatistics {
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
index d071d049fc..b0613c20c3 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Presentation.cpp
@@ -177,7 +177,7 @@ void Driver::reportPresents(double waitedMs, std::size_t inFlight) {
     const auto flips = flipsCounted.load() - previousFlips;
     const double perFlip = flips != 0 ? 1.0 / static_cast<double>(flips) : 0.0;
     const auto serial = flipSerial.load();
-    AgcDriver::ProfilePrint_nid_no_patch( "[present] %llu presents over 10 s (%llu dropped: no free swapchain image; %zu may trail on the GPU); %s p50 %.2f ms, p90 %.2f ms, max %.2f ms over %zu; per frame, presented or dropped: GPU busy %.1f ms, idle gaps %.1f ms (%llu batches without a completion record); per flip: %.1f batches recorded (%.1f unsignaled at the flip); per present: %.1f batches ahead of the blit, %.1f after it; after the flip packet: last submit %.1f ms, blit submit %.1f ms; in-place reads overwritten before execution: %llu of %llu checked\n", static_cast<unsigned long long>(presents), static_cast<unsigned long long>(dropped), inFlight, inFlight != 0 ? "inflight_wait" : "render_fence_wait", percentile(0.5), percentile(0.9), waits.empty() ? 0.0 : waits.back(), waits.size(), (counts.gpuBusyMs - previous.gpuBusyMs) * perFrame, (counts.gpuGapMs - previous.gpuGapMs) * perFrame, static_cast<unsigned long long>(counts.gpuUnread - previous.gpuUnread), static_cast<double>(serial - windowSerial) * perFlip, static_cast<double>(flipBatchesUnsignaled.load() - previousUnsignaled) * perFlip, static_cast<double>(counts.batchesAheadOfBlit - previous.batchesAheadOfBlit) * perPresent, static_cast<double>(counts.batchesAfterFlip - previous.batchesAfterFlip) * perPresent, (counts.lastSubmitAfterFlipMs - previous.lastSubmitAfterFlipMs) * perPresent, (counts.blitSubmitAfterFlipMs - previous.blitSubmitAfterFlipMs) * perPresent, static_cast<unsigned long long>(counts.readsOverwritten - previous.readsOverwritten), static_cast<unsigned long long>(counts.readsChecked - previous.readsChecked));
+    AgcDriver::ProfilePrint_nid_no_patch( "[present] %llu presents over 10 s (%llu dropped: no free swapchain image; %zu may trail on the GPU); %s p50 %.2f ms, p90 %.2f ms, max %.2f ms over %zu; per frame, presented or dropped: GPU busy %.1f ms, idle gaps %.1f ms (%llu batches without a completion record); per flip: %.1f batches recorded (%.1f unsignaled at the flip); per present: %.1f batches ahead of the blit, %.1f after it; after the flip packet: last submit %.1f ms, blit submit %.1f ms; in-place reads overwritten before execution: %llu of %llu checked; waits for the display keys' writer outside the GPU mutex: %llu, %.1f ms\n", static_cast<unsigned long long>(presents), static_cast<unsigned long long>(dropped), inFlight, inFlight != 0 ? "inflight_wait" : "render_fence_wait", percentile(0.5), percentile(0.9), waits.empty() ? 0.0 : waits.back(), waits.size(), (counts.gpuBusyMs - previous.gpuBusyMs) * perFrame, (counts.gpuGapMs - previous.gpuGapMs) * perFrame, static_cast<unsigned long long>(counts.gpuUnread - previous.gpuUnread), static_cast<double>(serial - windowSerial) * perFlip, static_cast<double>(flipBatchesUnsignaled.load() - previousUnsignaled) * perFlip, static_cast<double>(counts.batchesAheadOfBlit - previous.batchesAheadOfBlit) * perPresent, static_cast<double>(counts.batchesAfterFlip - previous.batchesAfterFlip) * perPresent, (counts.lastSubmitAfterFlipMs - previous.lastSubmitAfterFlipMs) * perPresent, (counts.blitSubmitAfterFlipMs - previous.blitSubmitAfterFlipMs) * perPresent, static_cast<unsigned long long>(counts.readsOverwritten - previous.readsOverwritten), static_cast<unsigned long long>(counts.readsChecked - previous.readsChecked), static_cast<unsigned long long>(counts.keyWriterWaits - previous.keyWriterWaits), counts.keyWriterWaitMs - previous.keyWriterWaitMs);
     previous = counts;
     previousFlips = flipsCounted.load();
     previousUnsignaled = flipBatchesUnsignaled.load();
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
index 58683b2116..b0bac7aa90 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp
@@ -3213,7 +3213,15 @@ FrameDumps& Dumps() {
 }
 
 bool VulkanDevice::PresentDisplayBuffer(const DisplayBuffer& buffer) {
-    if (buffer.dccAddress != 0 && buffer.tilingMode == 0) state->recorder->SyncThrough(buffer.dccAddress, DisplayBufferKeyBytes(buffer), true);
+    if (buffer.dccAddress != 0 && buffer.tilingMode == 0) {
+        static const bool profile = std::getenv("APS5_PROFILE_DRAW") != nullptr;
+        const auto before = profile ? Graphics::Recorder::ThreadWaitedMs() : 0.0;
+        state->recorder->SyncThrough(buffer.dccAddress, DisplayBufferKeyBytes(buffer), true);
+        if (const auto waited = profile ? Graphics::Recorder::ThreadWaitedMs() - before : 0.0; waited > 0.0) {
+            ++presentCounters.keyWriterWaits;
+            presentCounters.keyWriterWaitMs += waited;
+        }
+    }
     static const bool storeAtFlip = Graphics::StorageTexture::StoreAtFlipRequested(std::getenv("APS5_STORE_AT_FLIP"));
     if (storeAtFlip) Graphics::StorageTexture::FlushAllPending("flip");
     else Graphics::StorageTexture::FlushDumpSelected("flip");

From 54196438fcc45d1f3fd611a0030cd14ddbdc0716 Mon Sep 17 00:00:00 2001
From: Yunus Shaikh <75296019+EagleBearerYS@users.noreply.github.com>
Date: Fri, 23 Oct 2026 08:51:27 +0000
Subject: [PATCH 034/218] test(agc): present behind a pending writer of the
 display keys without the GPU mutex

A headless device presents a DCC display buffer while a recorded kernel
that copies over its keys is still pending, holding the GPU mutex once as
Driver::Present does. The present must release the mutex for that wait
(the hold serial advances), read the keys the kernel stored and reach the
swapchain; with nothing pending it must keep the mutex. It stops at the
missing swapchain, after the key check.
---
 .../tests/execution/PresentKeyWriterWait.cpp  | 202 ++++++++++++++++++
 1 file changed, 202 insertions(+)
 create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp

diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp
new file mode 100644
index 0000000000..e85b6e55d0
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/PresentKeyWriterWait.cpp
@@ -0,0 +1,202 @@
+#include "prx/libSceAgcDriver/Execution/include/DisplayBuffer.hpp"
+#include "prx/libSceAgcDriver/Execution/include/GuestMemory.hpp"
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/DccMetadata.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <exception>
+#include <iostream>
+#include <mutex>
+#include <optional>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Side = 128;
+constexpr std::uint64_t DisplayFormat = 0x8000000000000000ull;
+constexpr std::size_t SurfaceBytes = 65536;
+constexpr std::size_t KeysOffset = SurfaceBytes;
+constexpr std::size_t KeysCapacity = 32768;
+constexpr std::size_t CopiedKeys = 256;
+constexpr std::size_t SourceKeysOffset = KeysOffset + KeysCapacity;
+constexpr std::size_t BlockBytes = 2 * 65536;
+constexpr std::uint8_t Uncompressed = 0xff;
+constexpr std::uint8_t Cleared = 0x00;
+
+alignas(256) constexpr std::array<std::uint32_t, 7> CopyKeysCode{
+    0x34020083, 0xe0341000, 0x80000201, 0xbf8c3f70, 0xe0741000, 0x80010201, 0xbf810000,
+};
+
+std::uint64_t AddressOf(const void* data) {
+    return static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+}
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(65536, BlockBytes));
+#endif
+        Require(block != nullptr, "present key writer wait: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint8_t* Data() { return block; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = AddressOf(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+ShaderRecompiler::RecompileResult Compile(AgcDriver::VulkanDevice& device, std::span<const std::uint32_t> code, const std::vector<std::uint32_t>& userData) {
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    return ShaderRecompiler::Recompile(request);
+}
+
+struct Scenario {
+    std::uint8_t* surface;
+    std::uint8_t* keys;
+    std::uint8_t* source;
+    std::size_t keyBytes;
+    AgcDriver::DisplayBuffer buffer;
+    std::vector<std::uint32_t> copyData;
+};
+
+Scenario Prepare(std::uint8_t* block) {
+    Scenario scenario{block, block + KeysOffset, block + SourceKeysOffset, 0, {AddressOf(block), DisplayFormat, Side, Side}, std::vector<std::uint32_t>(16, 0u)};
+    scenario.buffer.dccAddress = AddressOf(scenario.keys);
+    scenario.keyBytes = AgcDriver::DisplayBufferKeyBytes(scenario.buffer);
+    Require(AgcDriver::DisplayBufferSize(scenario.buffer) <= SurfaceBytes && scenario.keyBytes >= CopiedKeys && scenario.keyBytes <= KeysCapacity, "present key writer wait: the display buffer does not fit the guest block");
+    const auto source = BufferDescriptor(scenario.source, CopiedKeys);
+    const auto destination = BufferDescriptor(scenario.keys, CopiedKeys);
+    std::copy(source.begin(), source.end(), scenario.copyData.begin());
+    std::copy(destination.begin(), destination.end(), scenario.copyData.begin() + 4);
+    return scenario;
+}
+
+void Reset(const Scenario& scenario) {
+    std::memset(scenario.surface, 0x55, SurfaceBytes);
+    std::memset(scenario.keys, Uncompressed, scenario.keyBytes);
+    std::memset(scenario.keys, Cleared, CopiedKeys);
+    std::memset(scenario.source, Uncompressed, CopiedKeys);
+    AgcDriver::GuestMemory::BumpCollectEpoch();
+}
+
+std::string PresentFailure(AgcDriver::VulkanDevice& device, const AgcDriver::DisplayBuffer& buffer) {
+    try {
+        device.PresentDisplayBuffer(buffer);
+    } catch (const std::exception& error) {
+        return error.what();
+    }
+    return "the headless present succeeded";
+}
+
+const std::string NoSwapchain = "Vulkan presentation: device has no swapchain";
+
+bool CanCopyKeys(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
+    const std::array<std::uint32_t, 4> pattern{0xffffffffu, 0xffffffffu, 0xffffffffu, 0xffffffffu};
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    const bool filled = device.FillBuffer(AddressOf(scenario.keys), CopiedKeys, pattern);
+    device.WaitIdle();
+    return filled;
+}
+
+void RunPendingWriter(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
+    Reset(scenario);
+    const auto copy = Compile(device, CopyKeysCode, scenario.copyData);
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    Require(AgcDriver::GuestMemory::GpuMutex().DepthOnThisThread() == 1, "present key writer wait: the presenter's hold is not the outermost");
+    device.Dispatch(copy, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(CopyKeysCode.data()));
+    Require(AgcDriver::Graphics::DccKeyWritersPending(scenario.buffer.dccAddress, scenario.keyBytes), "a recorded kernel that copies data over the display keys is not seen as a pending key writer");
+    const auto holds = AgcDriver::GuestMemory::GpuHoldSerial();
+    const auto failure = PresentFailure(device, scenario.buffer);
+    const auto acquired = AgcDriver::GuestMemory::GpuHoldSerial() - holds;
+    Require(failure == NoSwapchain, "a present behind a pending writer of the display keys stopped before the swapchain: " + failure);
+    Require(acquired != 0, "the presenter synchronized with the display keys' writer without releasing the GPU mutex");
+    Require(!AgcDriver::Graphics::DccKeyWritersPending(scenario.buffer.dccAddress, scenario.keyBytes), "the display keys' writer is still pending after the present");
+    Require(scenario.keys[0] == Uncompressed && scenario.keys[CopiedKeys - 1] == Uncompressed, "the present read the display keys before their writer landed");
+}
+
+void RunNoWriter(AgcDriver::VulkanDevice& device, const Scenario& scenario) {
+    std::memset(scenario.keys, Uncompressed, scenario.keyBytes);
+    AgcDriver::GuestMemory::BumpCollectEpoch();
+    std::lock_guard gpu(AgcDriver::GuestMemory::GpuMutex());
+    device.WaitIdle();
+    Require(!AgcDriver::Graphics::DccKeyWritersPending(scenario.buffer.dccAddress, scenario.keyBytes), "the idle device still reports a pending writer of the display keys");
+    const auto holds = AgcDriver::GuestMemory::GpuHoldSerial();
+    const auto failure = PresentFailure(device, scenario.buffer);
+    const auto acquired = AgcDriver::GuestMemory::GpuHoldSerial() - holds;
+    Require(failure == NoSwapchain, "a present with no pending writer of the display keys stopped before the swapchain: " + failure);
+    Require(acquired == 0, "a present with no pending writer of the display keys released the GPU mutex");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        if (!device->CanWaitUnlocked()) {
+            std::puts("skipped, the device has no timeline semaphores: the presenter cannot wait without the GPU mutex");
+            return VulkanTestSkipped;
+        }
+        GuestBlock block;
+        const auto scenario = Prepare(block.Data());
+        if (!CanCopyKeys(*device, scenario)) {
+            std::puts("skipped, host imports are unavailable: the key writer of the test is a copied writer");
+            return VulkanTestSkipped;
+        }
+        RunPendingWriter(*device, scenario);
+        RunNoWriter(*device, scenario);
+        std::puts("present key writer wait tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}

From 860c3aa538a9e7452fe76fdbdfabef43eece893c Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 05:18:56 -0400
Subject: [PATCH 035/218] fix(relinker): ignore an unmapped note segment
 outside a module's file

0c6765e6a6 stopped bounds-checking the SCE comment and library version
segments, which decrypted modules list past the end of the file. Some
decrypted modules also end with an unmapped PT_NOTE (address 0, memory
size 0) right after those two: Hollow Knight: Silksong's
Media/Modules/Il2cppUserAssemblies.prx (PPSA12544) lists one at offset
0x54ad408 in a file of 0x54ad407 bytes, so converting the title failed
with "ELF range exceeds file". The guest writer already drops unmapped
notes (SegmentFilter), and nothing reads their bytes.

Skip the bounds check for a note with address 0 and memory size 0. A
mapped note outside the file still fails. test_guest_trailing_note
covers both, with an unmapped note inside the file as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/relinker/CMakeLists.txt                  |  2 +
 .../relinker/src/guest/GuestImageReader.cpp   |  2 +
 .../tests/test_guest_trailing_note.py         | 48 +++++++++++++++++++
 3 files changed, 52 insertions(+)
 create mode 100644 core/relinker/relinker/tests/test_guest_trailing_note.py

diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index 5c4b89dfa8..f86e5fed61 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -585,6 +585,8 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_module_dir.py $<TARGET_FILE:relinker>)
         add_test(NAME guest_module_directories COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_module_directories.py $<TARGET_FILE:relinker>)
+        add_test(NAME guest_trailing_note COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_guest_trailing_note.py $<TARGET_FILE:relinker>)
         add_test(NAME relinker_executables COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_executables.py $<TARGET_FILE:relinker>)
         add_test(NAME game_patches COMMAND ${Python3_EXECUTABLE}
diff --git a/core/relinker/relinker/src/guest/GuestImageReader.cpp b/core/relinker/relinker/src/guest/GuestImageReader.cpp
index 49a209c9d4..577b807bc2 100644
--- a/core/relinker/relinker/src/guest/GuestImageReader.cpp
+++ b/core/relinker/relinker/src/guest/GuestImageReader.cpp
@@ -38,8 +38,10 @@ GuestImage GuestImageReader::Read(const std::filesystem::path& path, std::vector
     std::map<std::uint64_t, std::uint64_t> loads;
     constexpr std::uint32_t sceComment = 0x6fffff00;
     constexpr std::uint32_t sceLibVersion = 0x6fffff01;
+    constexpr std::uint32_t note = 4;
     for (const auto& header : image.Headers) {
         if (header.Type == sceComment || header.Type == sceLibVersion) continue;
+        if (header.Type == note && header.MappedAddress == 0 && header.MemorySize == 0) continue;
         range(header.Offset, header.FileSize);
         if (header.Type == 1) {
             if (header.FileSize > header.MemorySize || header.MemorySize > std::numeric_limits<std::uint64_t>::max() - header.MappedAddress || (header.Flags & ~7u) != 0) fail("Invalid load segment");
diff --git a/core/relinker/relinker/tests/test_guest_trailing_note.py b/core/relinker/relinker/tests/test_guest_trailing_note.py
new file mode 100644
index 0000000000..5601a84caa
--- /dev/null
+++ b/core/relinker/relinker/tests/test_guest_trailing_note.py
@@ -0,0 +1,48 @@
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+from test_guest_intel_trampolines import main_fixture
+from test_guest_module_directories import module_with_symbol
+
+
+def module_with_note(offset, address, memory_size):
+    image = module_with_symbol(True)
+    struct.pack_into("<H", image, 56, 4)
+    struct.pack_into("<IIQQQQQQ", image, 232, 4, 4, offset, address, address, 0x48, memory_size, 4)
+    return image
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    with tempfile.TemporaryDirectory(prefix="anyps5-trailing-note-") as directory:
+        work = Path(directory)
+        size = len(module_with_symbol(True))
+        cases = (
+            ("unmapped-past-eof", module_with_note(size, 0, 0), None),
+            ("unmapped-in-file", module_with_note(size - 0x48, 0, 0), None),
+            ("mapped-past-eof", module_with_note(size, 0x3000, 0x48), "ELF range exceeds file"),
+        )
+        for name, module, error in cases:
+            for windows in (False, True):
+                case = work / f"{name}-{windows}"
+                (case / "sce_module").mkdir(parents=True)
+                (case / "sce_module" / "noted.prx").write_bytes(module)
+                source = case / "input.elf"
+                source.write_bytes(main_fixture())
+                output = case / ("output.exe" if windows else "output.elf")
+                result = subprocess.run([str(relinker), *(["--windows"] if windows else []), str(source), str(output)],
+                                        capture_output=True, text=True, timeout=30)
+                artifact = case / "app0" / "sce_module" / "noted.prx.guest.prx"
+                if error is None:
+                    assert result.returncode == 0 and artifact.exists(), (name, windows, result.stdout, result.stderr)
+                else:
+                    assert result.returncode == 2 and error in result.stderr and not artifact.exists(), (
+                        name, windows, result.returncode, result.stdout, result.stderr)
+    print("Guest trailing note tests passed")
+
+
+if __name__ == "__main__":
+    main()

From a431d14efe8d970737861fc157ef36c47a0e4524 Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Fri, 23 Oct 2026 08:52:48 -0300
Subject: [PATCH 036/218] fix(libkernel): mark a destroyed condition variable
 with 1 and accept destroying a null one, as measured on a PS5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libkernel/Pthread/src/Cond.cpp     | 4 +++-
 core/libs/tests/GuestPthreadDestroyedObjects.cpp | 9 +++++++++
 docs/dev/debt/libkernel.md                       | 2 +-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libkernel/Pthread/src/Cond.cpp b/core/libs/prx/libkernel/Pthread/src/Cond.cpp
index a3a3087bf7..12ba2399d5 100644
--- a/core/libs/prx/libkernel/Pthread/src/Cond.cpp
+++ b/core/libs/prx/libkernel/Pthread/src/Cond.cpp
@@ -25,7 +25,7 @@ std::mutex& InitializationMutex() {
 }
 
 PthreadCond destroyedCond() {
-    return reinterpret_cast<PthreadCond>(std::uintptr_t{2});
+    return reinterpret_cast<PthreadCond>(std::uintptr_t{1});
 }
 
 PthreadMutex destroyedMutex() {
@@ -175,6 +175,8 @@ int APS5_VABI scePthreadCondDestroy(PthreadCond* cond) {
     std::lock_guard lock(InitializationMutex());
     if (*cond == destroyedCond())
         return SCE_KERNEL_ERROR_EINVAL;
+    if (*cond == nullptr)
+        return 0;
     delete *cond;
     std::atomic_ref<PthreadCond>(*cond).store(destroyedCond(), std::memory_order_release);
     return 0;
diff --git a/core/libs/tests/GuestPthreadDestroyedObjects.cpp b/core/libs/tests/GuestPthreadDestroyedObjects.cpp
index ca35d7b099..3ded0d5acf 100644
--- a/core/libs/tests/GuestPthreadDestroyedObjects.cpp
+++ b/core/libs/tests/GuestPthreadDestroyedObjects.cpp
@@ -53,10 +53,19 @@ int main() {
     PthreadCond cond = nullptr;
     Require(scePthreadCondInit(&cond, nullptr, "destroyed") == SCE_OK);
     Require(scePthreadCondDestroy(&cond) == SCE_OK);
+    Require(reinterpret_cast<std::uintptr_t>(cond) == 1);
     Require(scePthreadCondSignal(&cond) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadCondBroadcast(&cond) == SCE_KERNEL_ERROR_EINVAL);
     Require(scePthreadCondWait(&cond, &mutex) == SCE_KERNEL_ERROR_EINVAL);
     Require(pthread_cond_signal_nid_postfix(&cond) == POSIX_EINVAL);
     Require(scePthreadCondDestroy(&cond) == SCE_KERNEL_ERROR_EINVAL);
     Require(pthread_cond_destroy_nid_postfix(&cond) == POSIX_EINVAL);
+
+    PthreadCond untouched = nullptr;
+    Require(scePthreadCondDestroy(&untouched) == SCE_OK && untouched == nullptr);
+    Require(scePthreadCondSignal(&untouched) == SCE_OK && untouched != nullptr);
+    Require(scePthreadCondDestroy(&untouched) == SCE_OK && reinterpret_cast<std::uintptr_t>(untouched) == 1);
+    untouched = nullptr;
+    Require(scePthreadCondBroadcast(&untouched) == SCE_OK && untouched != nullptr);
+    Require(scePthreadCondDestroy(&untouched) == SCE_OK);
 }
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index d36fb0ec1b..ecb2d3e7a3 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -61,7 +61,7 @@
 - [sceKernelSyncOnAddressWait](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - the only known caller passes a null timeout and a name string as the fourth argument; the timeout is assumed to point to microseconds like the other kernel waits, and the name is ignored
 - [sceKernelSyncOnAddressWait8 / sceKernelSyncOnAddressWait16 / sceKernelSyncOnAddressWait32 / sceKernelSyncOnAddressWait64](../../../core/libs/prx/libkernel/SyncOnAddress/src/SyncOnAddress.cpp) (libkernel) - libc's `__std_atomic_wait_direct_8/16/32/64` pass a microsecond timeout or null and ignore the result; the by-value comparand, return values and the 2- and 8-byte alignment of Wait16 and Wait64 are assumed
 - [scePthreadRwlockDestroy, pthread_rwlock_destroy](../../../core/libs/prx/libkernel/Pthread/src/Rwlock.cpp) (libkernel) - measured on a PS5 (firmware 13.60): destroying a rwlock returns 0 whether it is free or held for reading or writing, and leaves 1 in the handle; every call on that handle then returns `EINVAL` until it is initialized again, and a zero handle is initialized on first use by the `scePthreadRwlock` calls as by the POSIX ones. A rwlock destroyed while held is not freed, so its memory leaks. Destroying a rwlock while another thread is acquiring it is not guarded
-- [scePthreadCondWait / scePthreadCondTimedwait](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) - before waiting, FreeBSD libthr's [`cond_wait_common`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_cond.c#L1992-L2029) checks ownership through [`_mutex_owned`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_mutex.c#L1166-L1178): an unowned mutex returns `EPERM`, while its destroyed marker returns `EINVAL`. An untouched adaptive static initializer (slot value 1) therefore returns `EPERM`; the test covers this, an uninitialized slot, a mutex owned by another thread, and the destroyed marker for both timed and untimed sce and POSIX waits. A recursive mutex locked several times is released completely for the wait and relocked to the same depth afterwards, as FreeBSD libthr does (`_mutex_cv_unlock`, `_mutex_cv_lock`). These FreeBSD-derived behaviors remain unverified on console hardware. Cancellation follows the [POSIX condition wait contract](https://pubs.opengroup.org/onlinepubs/9799919799/functions/pthread_cond_clockwait.html): the original mutex and recursive depth are restored before cleanup, and a canceled waiter forwards a wake to the remaining waiters. The host condition state is retained across mutex reacquisition so the guest can destroy and free its condition after notification; cancellation ordering and signal replacement are not measured on a console
+- [scePthreadCondWait / scePthreadCondTimedwait](../../../core/libs/prx/libkernel/Pthread/src/Cond.cpp) (libkernel) - the mutex's owner is checked before waiting, as in FreeBSD libthr's [`cond_wait_common`](https://github.com/freebsd/freebsd-src/blob/main/lib/libthr/thread/thr_cond.c#L1992-L2029). Measured in a payload process on a PS5 (firmware 13.60): `EPERM` (`0x80020001`) for an unowned mutex of every type, the adaptive initializer (slot 1), an uninitialized slot and a mutex owned by another thread, `EINVAL` for the destroyed mutex (slot 2), and a recursive mutex is released completely and relocked to its depth. `scePthreadCondDestroy` stores 1, which every condition call refuses with `EINVAL`, and leaves an uninitialized slot alone. Cancellation restores the mutex and depth before cleanup and a canceled waiter forwards a wake, per POSIX; its ordering is not measured
 - [sceKernelSetEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - multi-waiter satisfaction follows fpPS4 in-order evaluation: registered waiters are evaluated in FIFO order and each satisfied waiter's clear mode is applied immediately to the pattern before evaluating subsequent waiters; this ordering is unverified on PS5 console hardware
 - [sceKernelOpenEventFlag](../../../core/libs/prx/libkernel/EventFlag/src/EventFlag.cpp) (libkernel) - returns the handle of an undeleted event flag this process created with the same name, and `SCE_KERNEL_ERROR_ENOENT` otherwise. Flags owned by other processes, such as the shell's `SceShellCoreUtilAppFocus`, do not exist here, and which attribute makes a flag openable on the console is not modelled. The error code for a missing name and the choice between flags sharing a name are unverified.
 - [sceKernelAioSubmitReadCommandsMultiple / sceKernelAioSubmitWriteCommandsMultiple / sceKernelAioWaitRequests / sceKernelAioPollRequests / sceKernelAioCancelRequest / sceKernelAioCancelRequests / sceKernelAioDeleteRequests](../../../core/libs/prx/libkernel/Aio/src/Aio.cpp) (libkernel) - behaviour from shadPS4 (one id per request for the Multiple submits, cancel turns any request aborted and id 0 reports processing, wait mode 2 returns once one request completed, poll copies every state without waiting); the 128 requests or ids per batch limit is from SharpProspero, with an unknown error, so larger batches throw; wait modes other than 1 (and) and 2 (or) throw; null pointers, negative counts and invalid ids return the codes the single-request siblings use, checked before any state is written

From e284395f586dda6808250210cb225aef4df8021e Mon Sep 17 00:00:00 2001
From: ntamas94 <ntamas@live.com>
Date: Fri, 23 Oct 2026 13:24:29 +0200
Subject: [PATCH 037/218] fix(agc): keep hundreds of raw shader snapshots
 cached

ReadRawShader evicted snapshots past 64 entries or 8 MiB. A snapshot owns
its prepared artifacts, so an evicted unregistered shader was recompiled
on its next use. PS4 titles do not register their shaders: Knowledge is
Power cycles through 383 of them in its menus and recompiled them 341 136
times in 240 s. Raise the limit to 4096 entries or 64 MiB.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Execution/src/Driver/Shaders/ShaderRegistry.cpp         | 2 +-
 core/libs/prx/libSceAgcDriver/tests/Submit.cpp              | 6 +++++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
index 1065f7921f..5e1064aaa1 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/Shaders/ShaderRegistry.cpp
@@ -136,7 +136,7 @@ std::shared_ptr<const ShaderSnapshot> ReadRawShader(std::uint64_t address) {
                 cache.erase(found);
             }
             const auto bytes = result->code.size() * sizeof(std::uint32_t);
-            while (!cache.empty() && (cache.size() >= 64 || cacheBytes + bytes > 8 * 1024 * 1024)) {
+            while (!cache.empty() && (cache.size() >= 4096 || cacheBytes + bytes > 64 * 1024 * 1024)) {
                 cacheBytes -= cache.back()->code.size() * sizeof(std::uint32_t);
                 cache.pop_back();
             }
diff --git a/core/libs/prx/libSceAgcDriver/tests/Submit.cpp b/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
index d97862941b..ded031d574 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Submit.cpp
@@ -955,7 +955,8 @@ int main(int argc, char** argv) {
         });
         for (auto& reader : readers) reader.join();
         for (const auto& snapshot : concurrent) check(snapshot == branched, "concurrent raw compute readers lost snapshot reuse");
-        alignas(256) std::array<std::array<std::uint32_t, 64>, 65> programs{};
+        struct alignas(256) RawProgram : std::array<std::uint32_t, 64> {};
+        std::vector<RawProgram> programs(4097);
         for (auto& program : programs) program[0] = 0xbf810000;
         const auto firstAddress = reinterpret_cast<std::uintptr_t>(programs.front().data());
         readers.clear();
@@ -965,6 +966,9 @@ int main(int argc, char** argv) {
         for (auto& reader : readers) reader.join();
         for (const auto& snapshot : concurrent) check(snapshot == concurrent.front(), "concurrent raw compute misses duplicated snapshots");
         const auto evicted = AgcDriver::DriverDetail::ReadRawShader(firstAddress);
+        for (std::size_t i = 1; i <= 400; ++i)
+            AgcDriver::DriverDetail::ReadRawShader(reinterpret_cast<std::uintptr_t>(programs[i].data()));
+        check(AgcDriver::DriverDetail::ReadRawShader(firstAddress) == evicted, "raw shader cache evicted a program while a title used only 401");
         for (std::size_t i = 1; i < programs.size(); ++i)
             AgcDriver::DriverDetail::ReadRawShader(reinterpret_cast<std::uintptr_t>(programs[i].data()));
         check(AgcDriver::DriverDetail::ReadRawShader(firstAddress) != evicted && evicted->code[0] == 0xbf810000,

From 229620dfc167fe8bd72acd21569ff07f0a39f99e Mon Sep 17 00:00:00 2001
From: jablkowy12 <ignacy2000@o2.pl>
Date: Fri, 23 Oct 2026 14:02:11 +0200
Subject: [PATCH 038/218] feat(tools): optionally require tests in skip reports

---
 tools/check_skips.py            |  9 +++++++--
 tools/tests/test_check_skips.py | 34 +++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/tools/check_skips.py b/tools/check_skips.py
index c837fb1096..e28b550420 100644
--- a/tools/check_skips.py
+++ b/tools/check_skips.py
@@ -26,8 +26,10 @@ def high_refresh_limitation(output):
     return bool(reasons) and all(HIGH_REFRESH_LIMITATION.fullmatch(reason) for reason in reasons)
 
 
-def skips(path):
+def skips(path, require_tests=False):
+    found = False
     for case in ET.parse(path).getroot().iter("testcase"):
+        found = True
         if case.get("status") == "disabled":
             raise ValueError(f"{path}: testcase {case.get('name')!r} is disabled and was not run")
         skipped = case.find("skipped")
@@ -39,6 +41,8 @@ def skips(path):
         output = ["skipped, " + reason.strip() for reason in (skipped.get("message", ""), skipped.text or "") if reason.strip()]
         output += [case.findtext(channel) or "" for channel in ("system-out", "system-err")]
         yield name, "\n".join(output)
+    if require_tests and not found:
+        raise ValueError(f"{path}: report contains no testcases")
 
 
 def main(argv=None):
@@ -49,9 +53,10 @@ def main(argv=None):
     parser.add_argument("junit", type=Path, help="the file written by ctest --output-junit")
     parser.add_argument("--job", choices=("linux", "windows"), default="linux")
     parser.add_argument("--list", action="store_true", help="print the skipped tests and why the file says they skipped")
+    parser.add_argument("--require-tests", action="store_true", help="fail if the report contains no testcases")
     args = parser.parse_args(argv)
     try:
-        found = sorted(skips(args.junit))
+        found = sorted(skips(args.junit, require_tests=args.require_tests))
     except (OSError, ET.ParseError, ValueError) as error:
         parser.error(str(error))
     if args.list:
diff --git a/tools/tests/test_check_skips.py b/tools/tests/test_check_skips.py
index ea82a476d1..e86dfbd726 100644
--- a/tools/tests/test_check_skips.py
+++ b/tools/tests/test_check_skips.py
@@ -206,6 +206,40 @@ class CheckSkipsTests(unittest.TestCase):
 
 
 
+class RequiredTestsTests(unittest.TestCase):
+    def test_required_reports_without_testcases_fail_in_both_jobs(self):
+        for xml in ('<testsuite/>', '<testsuites><testsuite tests="0"/></testsuites>'):
+            with tempfile.TemporaryDirectory() as directory:
+                junit = Path(directory) / "junit.xml"
+                junit.write_text(xml, encoding="utf-8")
+                for job in ("linux", "windows"):
+                    for options in ([], ["--list"]):
+                        with self.subTest(xml=xml, job=job, options=options):
+                            result = subprocess.run(
+                                [sys.executable, "-I", str(TOOL), str(junit), "--job", job, "--require-tests", *options],
+                                capture_output=True, text=True, timeout=5)
+                            self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+                            self.assertIn("no testcases", result.stderr)
+                            result = subprocess.run(
+                                [sys.executable, "-I", str(TOOL), str(junit), "--job", job, *options],
+                                capture_output=True, text=True, timeout=5)
+                            self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def test_executed_tests_without_skips_pass_in_both_jobs(self):
+        for xml in ('<testsuite><testcase name="normal"/></testsuite>',
+                    '<testsuites><testsuite><testcase name="normal"/></testsuite></testsuites>'):
+            with tempfile.TemporaryDirectory() as directory:
+                junit = Path(directory) / "junit.xml"
+                junit.write_text(xml, encoding="utf-8")
+                for job in ("linux", "windows"):
+                    with self.subTest(xml=xml, job=job):
+                        result = subprocess.run(
+                            [sys.executable, "-I", str(TOOL), str(junit), "--job", job, "--require-tests"],
+                            capture_output=True, text=True, timeout=5)
+                        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                        self.assertIn("0 test(s) skipped, all expected", result.stdout)
+
+
 class SkipReportTests(unittest.TestCase):
     def skipped(self, content):
         with tempfile.TemporaryDirectory() as directory:

From 2683388f93f27e1e324f91654f0f672370a6e4a2 Mon Sep 17 00:00:00 2001
From: emirplus <gmsplemir@gmail.com>
Date: Wed, 21 Oct 2026 19:57:28 +0300
Subject: [PATCH 039/218] fix(tools): handle errors cleanly and reconfigure
 streams in prepare_release_notes

Wrap the prepare_release_notes entrypoint in main(argv=None) with UTF-8
stream reconfiguration using backslashreplace error handling.

Decode release notes JSON with utf-8-sig to accept UTF-8 BOM headers.
Catch OSError and ValueError in main and report them via parser.error
rather than propagating unhandled tracebacks.
---
 tools/prepare_release_notes.py      | 17 +++++--
 tools/tests/test_package_release.py | 72 +++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+), 4 deletions(-)

diff --git a/tools/prepare_release_notes.py b/tools/prepare_release_notes.py
index 0163999059..0b8c6c72db 100644
--- a/tools/prepare_release_notes.py
+++ b/tools/prepare_release_notes.py
@@ -3,6 +3,7 @@ import json
 import os
 import re
 import stat
+import sys
 from pathlib import Path
 
 BODY_LIMIT = 125000
@@ -26,7 +27,7 @@ def prepare_notes(source, body, full):
         for second in paths[index + 1:]:
             if first.resolve() == second.resolve() or (first.exists() and second.exists() and first.samefile(second)):
                 raise ValueError("Release note input and outputs must be distinct files")
-    notes = json.loads(source.read_text(encoding="utf-8"))["body"]
+    notes = json.loads(source.read_text(encoding="utf-8-sig"))["body"]
     if not isinstance(notes, str):
         raise ValueError("Generated release notes body must be a string")
     for destination in (body, full):
@@ -40,13 +41,21 @@ def prepare_notes(source, body, full):
     body.write_bytes(release_body(notes).encode("utf-8"))
 
 
-def main():
+def main(argv=None):
+    if hasattr(sys.stdout, "reconfigure"):
+        sys.stdout.reconfigure(encoding="utf-8", errors="backslashreplace")
+    if hasattr(sys.stderr, "reconfigure"):
+        sys.stderr.reconfigure(encoding="utf-8", errors="backslashreplace")
     parser = argparse.ArgumentParser(description="Prepare size-safe GitHub release notes")
     parser.add_argument("--input", type=Path, required=True)
     parser.add_argument("--body", type=Path, required=True)
     parser.add_argument("--full", type=Path, required=True)
-    args = parser.parse_args()
-    prepare_notes(args.input, args.body, args.full)
+    args = parser.parse_args(argv)
+    try:
+        prepare_notes(args.input, args.body, args.full)
+    except (OSError, ValueError) as error:
+        parser.error(str(error))
+    return 0
 
 
 if __name__ == "__main__":
diff --git a/tools/tests/test_package_release.py b/tools/tests/test_package_release.py
index fb0ec3cd62..0a55febac1 100644
--- a/tools/tests/test_package_release.py
+++ b/tools/tests/test_package_release.py
@@ -629,6 +629,78 @@ class ReleaseNotesEdgeCaseTests(unittest.TestCase):
             self.assertEqual(body_path.read_text(encoding="utf-8"), notes)
             self.assertEqual(full_path.read_text(encoding="utf-8"), notes)
 
+    def test_prepare_notes_accepts_utf8_bom(self):
+        notes = "# Release v1.0.0\n"
+        source = "\ufeff" + json.dumps({"body": notes})
+        with tempfile.TemporaryDirectory() as directory:
+            directory = Path(directory)
+            source_path = directory / "source.json"
+            body_path = directory / "body.md"
+            full_path = directory / "full.md"
+            source_path.write_text(source, encoding="utf-8")
+            prepare_release_notes.prepare_notes(source_path, body_path, full_path)
+            self.assertEqual(body_path.read_text(encoding="utf-8"), notes)
+            self.assertEqual(full_path.read_text(encoding="utf-8"), notes)
+
+    def test_main_with_explicit_argv(self):
+        notes = "# Release v1.0.0\n"
+        source = json.dumps({"body": notes})
+        with tempfile.TemporaryDirectory() as directory:
+            directory = Path(directory)
+            source_path = directory / "source.json"
+            body_path = directory / "body.md"
+            full_path = directory / "full.md"
+            source_path.write_text(source, encoding="utf-8")
+            result = prepare_release_notes.main(["--input", str(source_path), "--body", str(body_path), "--full", str(full_path)])
+            self.assertEqual(result, 0)
+            self.assertEqual(body_path.read_text(encoding="utf-8"), notes)
+            self.assertEqual(full_path.read_text(encoding="utf-8"), notes)
+
+    def test_main_reports_error_without_a_traceback(self):
+        with tempfile.TemporaryDirectory() as directory:
+            directory = Path(directory)
+            input_dir = directory / "input_dir"
+            input_dir.mkdir()
+            body_path = directory / "body.md"
+            full_path = directory / "full.md"
+            stderr = io.StringIO()
+            with contextlib.redirect_stderr(stderr), self.assertRaises(SystemExit) as error:
+                prepare_release_notes.main(["--input", str(input_dir), "--body", str(body_path), "--full", str(full_path)])
+            self.assertEqual(error.exception.code, 2)
+            self.assertIn(input_dir.name, stderr.getvalue())
+            self.assertNotIn("Traceback", stderr.getvalue())
+
+    def test_main_reconfigures_streams(self):
+        class Stream:
+            def __init__(self):
+                self.encoding = None
+                self.errors = None
+
+            def reconfigure(self, encoding=None, errors=None):
+                self.encoding = encoding
+                self.errors = errors
+
+            def write(self, s):
+                pass
+
+            def flush(self):
+                pass
+
+        out, err = Stream(), Stream()
+        with patch.object(prepare_release_notes.sys, "stdout", out), patch.object(prepare_release_notes.sys, "stderr", err):
+            with tempfile.TemporaryDirectory() as directory:
+                directory = Path(directory)
+                source_path = directory / "source.json"
+                body_path = directory / "body.md"
+                full_path = directory / "full.md"
+                source_path.write_text(json.dumps({"body": "notes"}), encoding="utf-8")
+                result = prepare_release_notes.main(["--input", str(source_path), "--body", str(body_path), "--full", str(full_path)])
+                self.assertEqual(result, 0)
+        self.assertEqual(out.encoding, "utf-8")
+        self.assertEqual(out.errors, "backslashreplace")
+        self.assertEqual(err.encoding, "utf-8")
+        self.assertEqual(err.errors, "backslashreplace")
+
     def test_body_over_limit_without_whats_changed_is_returned_unchanged(self):
         notes = "# Release\n\n## Details\n\n" + "x" * (prepare_release_notes.BODY_LIMIT + 1)
         result = prepare_release_notes.release_body(notes)

From f24320dc1c59344c13db1fefa042937b48939d02 Mon Sep 17 00:00:00 2001
From: shanu337 <sharmashantanu337@gmail.com>
Date: Wed, 21 Oct 2026 19:16:32 +0530
Subject: [PATCH 040/218] refactor(libSceVideoOut): consolidate color space
 wrappers and add Flip tests

---
 .../libs/prx/libSceVideoOut/Unimplemented.cpp | 27 -------------------
 .../prx/libSceVideoOut/include/Output.hpp     |  2 ++
 core/libs/prx/libSceVideoOut/src/Output.cpp   | 25 +++++++++++++++++
 core/libs/prx/libSceVideoOut/tests/Flip.cpp   | 16 +++++++++++
 docs/dev/debt/libSceVideoOut.md               |  1 +
 5 files changed, 44 insertions(+), 27 deletions(-)

diff --git a/core/libs/prx/libSceVideoOut/Unimplemented.cpp b/core/libs/prx/libSceVideoOut/Unimplemented.cpp
index 91b75fbb31..45a83a04c0 100644
--- a/core/libs/prx/libSceVideoOut/Unimplemented.cpp
+++ b/core/libs/prx/libSceVideoOut/Unimplemented.cpp
@@ -37,35 +37,8 @@ int APS5_VABI sceVideoOutCursorSetPosition(int32_t, int32_t, uint32_t, uint32_t)
     return 0;
 }
 
-int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutAdjustColor_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutAdjustColor(handle, settings);
-}
-
-int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutColorSettingsSetGamma_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutColorSettingsSetGamma(settings, gamma);
-}
-
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(settings);
-}
-
-int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(settings, lumaScale, option);
-}
-
-int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
-    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutAdjustColorSpaceConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
-    return sceVideoOutAdjustColorSpaceConversion(handle, settings);
-}
-
-
 int APS5_VABI sceDbgVideoOutAddOutputModeVr60Privilege() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-
 }
diff --git a/core/libs/prx/libSceVideoOut/include/Output.hpp b/core/libs/prx/libSceVideoOut/include/Output.hpp
index 569e97ee77..8da7cc2561 100644
--- a/core/libs/prx/libSceVideoOut/include/Output.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Output.hpp
@@ -28,6 +28,8 @@ int APS5_VABI sceVideoOutLatencyControlWaitBeforeInput(int handle);
 int APS5_VABI sceVideoOutLatencyMeasureSetStartPoint(int handle, uint32_t point);
 int APS5_VABI sceVideoOutColorSettingsSetGamma(VideoOutColorSettings* settings, float gamma);
 int APS5_VABI sceVideoOutAdjustColor(int handle, const VideoOutColorSettings* settings);
+int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settings_size);
+int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settings_size);
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings);
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option);
 int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutColorSpaceConversionSettings* settings);
diff --git a/core/libs/prx/libSceVideoOut/src/Output.cpp b/core/libs/prx/libSceVideoOut/src/Output.cpp
index 24f9b6f15c..33a8ecdaac 100644
--- a/core/libs/prx/libSceVideoOut/src/Output.cpp
+++ b/core/libs/prx/libSceVideoOut/src/Output.cpp
@@ -370,6 +370,31 @@ int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutCo
     LibcAwaitExit_nid_postfix();
 }
 
+int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutAdjustColor_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutAdjustColor(handle, settings);
+}
+
+int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSettings)) throw std::runtime_error("sceVideoOutColorSettingsSetGamma_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutColorSettingsSetGamma(settings, gamma);
+}
+
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(settings);
+}
+
+int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(settings, lumaScale, option);
+}
+
+int APS5_VABI sceVideoOutAdjustColorSpaceConversion_(int handle, const VideoOutColorSpaceConversionSettings* settings, uint32_t settings_size) {
+    if (settings_size < sizeof(VideoOutColorSpaceConversionSettings)) throw std::runtime_error("sceVideoOutAdjustColorSpaceConversion_: VIDEO_OUT_ERROR_INVALID_VALUE");
+    return sceVideoOutAdjustColorSpaceConversion(handle, settings);
+}
+
 int APS5_VABI sceVideoOutSetGlobalBlendSpace(int handle, uint32_t space, uint32_t option) try {
     auto cfg = VideoOutDriver::Get().GetConfig(handle);
     if (cfg == nullptr) {
diff --git a/core/libs/prx/libSceVideoOut/tests/Flip.cpp b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
index 365eddf412..962682815e 100644
--- a/core/libs/prx/libSceVideoOut/tests/Flip.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
@@ -449,6 +449,22 @@ void testControls() {
     }
     VideoOutColorSettings settings{};
     expectFailure([&] { sceVideoOutColorSettingsSetGamma(&settings, std::numeric_limits<float>::quiet_NaN()); });
+    expectFailure([&] { sceVideoOutColorSettingsSetGamma_(&settings, 1.0f, sizeof(VideoOutColorSettings) - 1); });
+    check(sceVideoOutColorSettingsSetGamma_(&settings, 1.2f, sizeof(VideoOutColorSettings)) == 0, "gamma wrapper rejected valid size");
+    check(settings.gamma == 1.2f, "gamma wrapper failed to forward value");
+
+    expectFailure([&] { sceVideoOutAdjustColor_(handle, &settings, sizeof(VideoOutColorSettings) - 1); });
+    check(sceVideoOutAdjustColor_(handle, &settings, sizeof(VideoOutColorSettings)) == 0, "adjust color wrapper rejected valid size");
+
+    VideoOutColorSpaceConversionSettings cscSettings{};
+    expectFailure([&] { sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(&cscSettings, sizeof(VideoOutColorSpaceConversionSettings) - 1); });
+    check(sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_(&cscSettings, sizeof(VideoOutColorSpaceConversionSettings)) == 0, "default SDR to HDR wrapper rejected valid size");
+
+    expectFailure([&] { sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(&cscSettings, 1.0f, 0, sizeof(VideoOutColorSpaceConversionSettings) - 1); });
+    check(sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_(&cscSettings, 1.0f, 0, sizeof(VideoOutColorSpaceConversionSettings)) == 0, "SDR to HDR conversion wrapper rejected valid size");
+
+    expectFailure([&] { sceVideoOutAdjustColorSpaceConversion_(handle, &cscSettings, sizeof(VideoOutColorSpaceConversionSettings) - 1); });
+    check(sceVideoOutAdjustColorSpaceConversion_(handle, &cscSettings, sizeof(VideoOutColorSpaceConversionSettings)) == 0, "adjust color space conversion wrapper rejected valid size");
     KernelEqueue queue = 0;
     check(sceKernelCreateEqueue(&queue, "VideoOut test") == 0, "event queue creation failed");
     auto owner = EqueuePin_nid_postfix(queue);
diff --git a/docs/dev/debt/libSceVideoOut.md b/docs/dev/debt/libSceVideoOut.md
index 5fdf3bd52f..42a02e8a22 100644
--- a/docs/dev/debt/libSceVideoOut.md
+++ b/docs/dev/debt/libSceVideoOut.md
@@ -9,6 +9,7 @@
 
 ### Unknown function info
 
+- PPSA29866 imports declared without parameters, signatures unknown, added without an implementation because the title fails to load without them: [sceVideoOutSetFlipMaster and sceVideoOutClearFlipMaster](../../../core/libs/prx/libSceVideoOut/Unimplemented.cpp) (libSceVideoOut)
 - [sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion_, sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion_, sceVideoOutAdjustColorSpaceConversion_, sceVideoOutSetGlobalBlendSpace](../../../core/libs/prx/libSceVideoOut/src/Output.cpp) (libSceVideoOut) - PPSA30630 imports these to configure color space conversion and global blend space. Color space conversion settings are accepted with size validation (32 bytes) but conversion blocks and blend space parameters are not applied to the presentation swapchain
 - [sceVideoOutDeleteVrrActiveStatusEvent](../../../core/libs/prx/libSceVideoOut/src/Event.cpp) (libSceVideoOut, NID `-q-vbO859Tw`) - the name hashes to the NID PPSA02530 imports and is listed in [sce_symbols](https://github.com/zecoxao/sce_symbols) `aerolib.csv` at `fe2cc2948e`. The signature `(eq, handle)` and the behaviour, removing the handle's VRR status registration from the queue as the other `Delete*Event` calls do, follow sceVideoOutAddVrrActiveStatusEvent; no title has been observed calling it
 - [sceVideoOutCursorEnable, sceVideoOutCursorDisable, sceVideoOutCursorSetImageAddress, sceVideoOutCursorSetPosition](../../../core/libs/prx/libSceVideoOut/Unimplemented.cpp) (libSceVideoOut, NIDs `UPZWCH8qTM4`, `fEPEwROdCwM`, `u-9bhWQApq8`, `N17AK88NdD0`) - the names hash to the NIDs Prospero Win (PPSA99995) imports, and the parameter lists `(handle, index, address)`, `(handle, index)`, `(handle, index, address)` and `(handle, index, x, y)` follow its [declarations](https://github.com/mpereiraesaa/prospero-win/blob/644e32e400c555e340d507383398c5d21b39b0b0/wine/ps5/pw_vulkan_radv.c#L65-L68). The cursor image's format and size and the console's return values are not known; the functions report that they are not implemented.

From 201b8e816cada8a6cace30d0e98c49ede20eca92 Mon Sep 17 00:00:00 2001
From: PrivacyOnion <granfili074@gmail.com>
Date: Fri, 23 Oct 2026 17:10:18 +0200
Subject: [PATCH 041/218] docs(debt): document libSceNotification technical
 debt

---
 docs/dev/debt/libSceNotification.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 docs/dev/debt/libSceNotification.md

diff --git a/docs/dev/debt/libSceNotification.md b/docs/dev/debt/libSceNotification.md
new file mode 100644
index 0000000000..981ec693f0
--- /dev/null
+++ b/docs/dev/debt/libSceNotification.md
@@ -0,0 +1,5 @@
+# libSceNotification technical debt
+
+### Unknown function info
+
+- [sceNotificationSend, sceNotificationSendById, sceNotificationShowPsButtonPersistentBanner, sceNotificationHidePsButtonPersistentBanner](../../../core/libs/prx/libSceNotification/Export.cpp) (libSceNotification) - notification sending and banner presentation interfaces throw through `NotImplemented_nid_no_patch`. Native notification service IPC and parameter structures remain unimplemented.

From e437f33787df84b3033c82d991c120d89236bb1f Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Fri, 23 Oct 2026 12:13:07 -0300
Subject: [PATCH 042/218] fix(libkernel): answer the thread atexit references
 as measured on a PS5

Increment returns -1 for an address outside every module and Decrement never fails, instead of throwing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libkernel/System/src/Rtld.cpp | 11 +++++------
 core/libs/tests/GuestDynamicLoader.cpp      |  7 +++++--
 docs/dev/debt/libkernel.md                  |  2 +-
 3 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/core/libs/prx/libkernel/System/src/Rtld.cpp b/core/libs/prx/libkernel/System/src/Rtld.cpp
index 90472da544..bd730181e3 100644
--- a/core/libs/prx/libkernel/System/src/Rtld.cpp
+++ b/core/libs/prx/libkernel/System/src/Rtld.cpp
@@ -35,15 +35,13 @@ const void* imageContaining(const void* address, bool reference, void*& handle,
 #ifdef _WIN32
     const DWORD flags = GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | (reference ? 0 : GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT);
     HMODULE module = nullptr;
-    if (!GetModuleHandleExW(flags, reinterpret_cast<LPCWSTR>(address), &module))
-        throw std::runtime_error(std::string(caller) + ": address outside every loaded image");
+    if (!GetModuleHandleExW(flags, reinterpret_cast<LPCWSTR>(address), &module)) return nullptr;
     if (reference) handle = module;
     return module;
 #else
     Dl_info info{};
     link_map* image = nullptr;
-    if (!dladdr1(address, &info, reinterpret_cast<void**>(&image), RTLD_DL_LINKMAP) || !image)
-        throw std::runtime_error(std::string(caller) + ": address outside every loaded image");
+    if (!dladdr1(address, &info, reinterpret_cast<void**>(&image), RTLD_DL_LINKMAP) || !image) return nullptr;
     if (reference && image->l_name && *image->l_name) {
         handle = dlopen(image->l_name, RTLD_LAZY | RTLD_NOLOAD);
         if (!handle) throw std::runtime_error(std::string(caller) + ": cannot reference " + image->l_name);
@@ -55,6 +53,7 @@ const void* imageContaining(const void* address, bool reference, void*& handle,
 int referenceThreadAtexitImage(const void* address, const char* caller) {
     void* handle = nullptr;
     const void* image = imageContaining(address, true, handle, caller);
+    if (!image) return -1;
     std::lock_guard lock(threadAtexitMutex);
     threadAtexitReferences.emplace(image, handle);
     return 0;
@@ -63,11 +62,11 @@ int referenceThreadAtexitImage(const void* address, const char* caller) {
 int releaseThreadAtexitImage(const void* address, const char* caller) {
     void* handle = nullptr;
     const void* image = imageContaining(address, false, handle, caller);
+    if (!image) return 0;
     {
         std::lock_guard lock(threadAtexitMutex);
         const auto found = threadAtexitReferences.find(image);
-        if (found == threadAtexitReferences.end())
-            throw std::runtime_error(std::string(caller) + ": image holds no thread atexit reference");
+        if (found == threadAtexitReferences.end()) return 0;
         handle = found->second;
         threadAtexitReferences.erase(found);
     }
diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index 1307264c64..6013ae1f19 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -229,9 +229,12 @@ int main(int argc, char** argv) {
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
-    Require(ThrowsRuntimeError([] { _sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&Require)); }));
+    Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&Require)) == 0);
     int local = 0;
-    Require(ThrowsRuntimeError([&] { _sceKernelRtldThreadAtexitIncrement_nid_postfix(&local); }));
+    Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(&local) == -1);
+    Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(nullptr) == -1);
+    Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(&local) == 0);
+    Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(nullptr) == 0);
 #ifndef _WIN32
     Require(dlsym_nid_postfix(nullptr, "malloc") == nullptr);
     Require(dlsym_nid_postfix(nullptr, "dlopen") == nullptr);
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 515c8d8c2b..b8804e2c64 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -77,7 +77,7 @@
 - [Map hints inside a reservation](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMapDirectMemory` and the flexible and anonymous maps place a mapping without `MAP_FIXED` at its hint address when the whole range lies in a range still reserved by `sceKernelReserveVirtualRange`, as if `MAP_FIXED` were set. Taken from PPSA01474, which reserves 64 GiB and then maps its heaps inside it with hints and no `MAP_FIXED`, and uses the hint addresses afterwards; not measured on the console. Hints outside a reservation, or over a range that is partly mapped, stay hints
 - [Fixed anonymous mmap](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `MAP_PRIVATE | MAP_ANON | MAP_FIXED` replaces the requested range through the existing guest mapping machinery and zeroes the new memory. `MAP_EXCL` is checked under the allocation-registry mutation lock, including virtual reservations, and returns `ENOMEM` without changing an occupied range; without `MAP_FIXED` it is `EINVAL`. Lengths are rounded to 16 KiB and fixed addresses must be aligned. The complete rounded range must lie inside the guest arena or, for POSIX fixed anonymous `mmap` on Windows, one current or registered native thread stack; other mapping APIs do not opt into stack replacement. Native stack replacement keeps the reservation, decommits and recommits fresh pages, and rejects foreign allocations, ranges spanning reservations and host `PAGE_GUARD` pages before mutation. Current-stack ranges must end at least 64 KiB below the active host frame; callers replacing another thread's stack must coordinate with that thread. If recommitting fails, the call returns `ENOMEM` with the range still reserved; thread cleanup attempts to recommit it before restoring write access. This follows FreeBSD 11.4 [argument validation and rounding](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L226-L299), [fixed replacement](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1455-L1464), and [collision errno](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1604-L1613). The console behaviour has not been measured. AnyPS5 starts the guest arena at 0x200000000, so the fixed path rejects the low 0x400000 address requested by PICO-8 PPSA99808. The console address-space layout is unmeasured; executable placement outside the host arena is tracked in #5217. Static catalog disassembly finds `0x1012` in PPSA98001/PPSA99808 and `0x5012` in PPSA99808; these titles were not run.
 - [Mapping hints with no room above them](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - a mapping without `MAP_FIXED` whose hint lies above the guest address space, or has no free range at or above it, is placed from the bottom of the guest arena, as FreeBSD 11.4's [`vm_mmap_object`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1569) retries through [`vm_map_find_min`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1555-L1584) from its minimum address. FreeBSD's minimum is the end of the largest possible data segment rather than the start of the arena, and the console's address-space layout is not measured. PS5CEMU-HAR (PPSA99360) gives `sceKernelReserveVirtualRange` a hint near its own code, which is a host address here because the relinked executable lies outside the guest arena, so its JIT gets memory more than 2 GiB from its code and does not start
-- [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in the [fpPS4](https://github.com/red-prig/fpPS4) reimplementation, Increment takes a reference on the loaded image containing the address and Decrement releases one; the variants without the leading underscore are assumed to match
+- [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in a payload process on a PS5 (firmware 13.60), Increment returns -1 for an address outside every module (null, stack, heap) and 0 otherwise, and Decrement never fails, also without a matching Increment; the console's Decrement returns nothing, here 0. The module's `ref_count` did not change on the console. As in [fpPS4](https://github.com/red-prig/fpPS4), Increment here takes a reference on the image and Decrement releases one. The variants without the leading underscore are not exported by firmware 13.60's `libkernel_sys`; here they match
 - [tcgetattr, tcsetattr](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel) - every file and pipe descriptor is taken as not a terminal (`ENOTTY`), and a socket gets `EADDRNOTAVAIL` for `AF_INET` and `EOPNOTSUPP` otherwise, as FreeBSD's `in_control` and `pru_control_notsupp` answer a termios ioctl; what descriptors 0 to 2 of a title are on the console, and whether any of them is a terminal there, is unknown
 - [cfsetspeed](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel, NID `C1MQ6OaXRjo`) - console behavior and module/library versions are unverified. The prototype, uint32 speed and 44-byte termios layout (input speed at 36, output speed at 40) follow the public PS5 payload SDK [termios.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/termios.h) and [sys/_termios.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/sys/_termios.h). The module association follows its libkernel stub table and the NID rehashes to the aerolib name. Both speed fields accept every uint32 value and no flags or control characters change, as [FreeBSD 11.4 termios.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/gen/termios.c) does. No terminal I/O is performed. Null pointers throw where the reference dereferences them.
 - [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - descriptor 0 is never reported readable and descriptors 1 and 2 are always writable, as for a console title with no input; reads from descriptor 0 still go to the host stdin. `/dev/random` and `/dev/urandom` follow `randomdev_poll` for a seeded device under [`selscan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1178-L1236), which asks once with the flags of every set the descriptor is in: in the read set they are readable and reported in no other set, and otherwise they are reported in the write and exception sets they were asked in. A regular file, a directory or a file read from app0.zar is always readable and writable and never in the exception set, as `vop_stdpoll` answers, on every host. Guest sockets and libSceNet sockets are polled. A kqueue is readable while one of its events is triggered and is never writable or in the exception set, as FreeBSD 11.4's [`kqueue_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c#L1900-L1924) answers, on every host. Other descriptors are polled through the host on Linux, while on Windows pipes are checked every millisecond with the readiness test `poll` uses and any other descriptor throws. Dungeons (PPSA16064) selects on descriptor 0, and RetroArch (PPSA99169) selects on its web server's wake-up pipe next to its listening socket

From 4acca6020c26583deda0334309de8d6b25814f13 Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Fri, 23 Oct 2026 12:14:27 -0300
Subject: [PATCH 043/218] fix(libkernel): log a thread atexit Decrement without
 a reference

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libkernel/System/src/Rtld.cpp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libkernel/System/src/Rtld.cpp b/core/libs/prx/libkernel/System/src/Rtld.cpp
index bd730181e3..4a11c90be5 100644
--- a/core/libs/prx/libkernel/System/src/Rtld.cpp
+++ b/core/libs/prx/libkernel/System/src/Rtld.cpp
@@ -66,7 +66,10 @@ int releaseThreadAtexitImage(const void* address, const char* caller) {
     {
         std::lock_guard lock(threadAtexitMutex);
         const auto found = threadAtexitReferences.find(image);
-        if (found == threadAtexitReferences.end()) return 0;
+        if (found == threadAtexitReferences.end()) {
+            APS5_LOG_OUT("%s: image holds no thread atexit reference", caller);
+            return 0;
+        }
         handle = found->second;
         threadAtexitReferences.erase(found);
     }

From 7618d0335fb22651722c2bd0fc41c6da0f423538 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:30:51 -0500
Subject: [PATCH 044/218] test(libScePlayGo): cover install speed, eta, and
 prefetch handle validation

---
 core/libs/tests/GuestPlayGo.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/core/libs/tests/GuestPlayGo.cpp b/core/libs/tests/GuestPlayGo.cpp
index c03f4761ca..30a1375975 100644
--- a/core/libs/tests/GuestPlayGo.cpp
+++ b/core/libs/tests/GuestPlayGo.cpp
@@ -26,6 +26,9 @@ int APS5_VABI scePlayGoSetToDoList(int, const PlayGoToDo*, std::uint32_t);
 int APS5_VABI scePlayGoGetToDoList(int, PlayGoToDo*, std::uint32_t, std::uint32_t*);
 int APS5_VABI scePlayGoGetLocus(int, const std::uint16_t*, std::uint32_t, std::int8_t*);
 int APS5_VABI scePlayGoGetChunkId(int, std::uint16_t*, std::uint32_t, std::uint32_t*);
+int APS5_VABI scePlayGoGetEta(int, const std::uint16_t*, std::uint32_t, std::int64_t*);
+int APS5_VABI scePlayGoGetInstallSpeed(int, std::int32_t*);
+int APS5_VABI scePlayGoPrefetch(int, const std::uint16_t*, std::uint32_t, std::int8_t);
 }
 
 static void Require(bool value, const std::source_location location = std::source_location::current()) {
@@ -271,6 +274,14 @@ int main(int argc, char** argv) {
     RunLayout(argv[0], "--package-chunk-table", {{"playgo-chunk.dat", ChunkTableFile()}});
     RunLayout(argv[0], "--package-chunk-table", {{"playgo-chunk.dat", ChunkTableFile("plgo")}});
     RunLayout(argv[0], "--scenario-with-chunk-table", {{"playgo-chunk.dat", ChunkTableFile()}, {"playgo-scenario.json", "{}"}});
+    std::int64_t eta = -1;
+    std::int32_t speed = -1;
+    Require(scePlayGoGetEta(-1, nullptr, 0, &eta) == static_cast<int>(0x80CF0002));
+    Require(scePlayGoGetEta(0x506C476F, nullptr, 0, nullptr) == static_cast<int>(0x80CF0004));
+    Require(scePlayGoGetInstallSpeed(-1, &speed) == static_cast<int>(0x80CF0002));
+    Require(scePlayGoGetInstallSpeed(0x506C476F, nullptr) == static_cast<int>(0x80CF0004));
+    Require(scePlayGoGetInstallSpeed(0x506C476F, &speed) == 0 && speed == 2);
+    Require(scePlayGoPrefetch(-1, nullptr, 0, 0) == static_cast<int>(0x80CF0002));
     RunLayout(argv[0], "--scenario-only", {{"playgo-scenario.json", "{}"}});
     RunLayout(argv[0], "--ficm-only", {{"playgo-ficm.dat", "x"}});
     RunLayout(argv[0], "--hash-table-only", {{"playgo-hash-table.dat", "x"}});

From 07198e1e6a3a7bd48e1e486bfd67dac23941ea26 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:31:30 -0500
Subject: [PATCH 045/218] test(libSceSaveData.native): cover null parameter
 validation in sceSaveDataSyncSaveDataMemory

---
 core/libs/tests/GuestSaveDataMountStatus.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/libs/tests/GuestSaveDataMountStatus.cpp b/core/libs/tests/GuestSaveDataMountStatus.cpp
index 33fd69861e..b6330cb98e 100644
--- a/core/libs/tests/GuestSaveDataMountStatus.cpp
+++ b/core/libs/tests/GuestSaveDataMountStatus.cpp
@@ -20,6 +20,7 @@ int APS5_VABI sceSaveDataSetParam(const SaveDataMountPoint*, std::uint32_t, cons
 int APS5_VABI sceSaveDataLoadIcon(const SaveDataMountPoint*, SaveDataIcon*);
 int APS5_VABI sceSaveDataSaveIcon(const SaveDataMountPoint*, const SaveDataIcon*);
 int APS5_VABI sceSaveDataSaveIconByPath(const SaveDataMountPoint*, const char*);
+int APS5_VABI sceSaveDataSyncSaveDataMemory(const void* param);
 }
 
 namespace {
@@ -232,6 +233,7 @@ int main() {
     const auto previous = std::filesystem::current_path();
     std::filesystem::current_path(root);
     CheckUnmountedCalls();
+    Check(sceSaveDataSyncSaveDataMemory(nullptr) == static_cast<int>(0x809F0001), "null param rejected in memory sync");
     Check(sceSaveDataInitialize3(nullptr) == 0, "SaveData initializes");
     MountAndCheck("fresh", MountReadWrite | MountCreate2, 1u, "CREATE2 of a missing save");
     MountAndCheck("fresh", MountReadWrite | MountCreate2, 0u, "CREATE2 of an existing save");

From 08d7d3fb897669568dcd2a531ae24c188f2191bc Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:31:56 -0500
Subject: [PATCH 046/218] test(libSceNpTrophy): cover icon size pointer checks
 and invalid handle validation

---
 core/libs/tests/GuestNpTrophy.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/core/libs/tests/GuestNpTrophy.cpp b/core/libs/tests/GuestNpTrophy.cpp
index e8a9b8749f..a8fb67b032 100644
--- a/core/libs/tests/GuestNpTrophy.cpp
+++ b/core/libs/tests/GuestNpTrophy.cpp
@@ -13,6 +13,8 @@ extern "C" {
 int APS5_VABI sceNpTrophyCreateContext(int* context, int userId, std::uint32_t serviceLabel, std::uint64_t options);
 int APS5_VABI sceNpTrophyDestroyContext(int context);
 int APS5_VABI sceNpTrophyCreateHandle(int* handle);
+int APS5_VABI sceNpTrophyGetGameIcon(int contextId, int handle, void* buffer, std::uint64_t* size);
+int APS5_VABI sceNpTrophyGetGroupIcon(int contextId, int handle, int groupId, void* buffer, std::uint64_t* size);
 int APS5_VABI sceNpTrophyDestroyHandle(int handle);
 int APS5_VABI sceNpTrophyRegisterContext(int context, int handle, std::uint64_t options);
 int APS5_VABI sceNpTrophyGetTrophyUnlockState(int context, int handle, std::uint32_t* flags, std::uint32_t* count);
@@ -108,6 +110,12 @@ int main() {
 
     Require(sceNpTrophyCreateContext(&missing, 1, 1, 0) == 0, "context for a label without a package");
     Require(sceNpTrophyRegisterContext(missing, handle, 0) == TitleConfNotInstalled, "register without a trophy package");
+    Require(sceNpTrophyCreateHandle(nullptr) == InvalidArgument, "null handle creation");
+    Require(sceNpTrophyCreateContext(nullptr, 1, 0, 0) == InvalidArgument, "null context creation");
+    Require(sceNpTrophyGetGameIcon(context, handle, icon, nullptr) == InvalidArgument, "null game icon size pointer");
+    Require(sceNpTrophyGetGroupIcon(context, handle, 0, icon, nullptr) == InvalidArgument, "null group icon size pointer");
+    Require(sceNpTrophyGetTrophyIcon(context, handle, 0, icon, nullptr) == InvalidArgument, "null trophy icon size pointer");
+    Require(sceNpTrophyDestroyHandle(-1) == InvalidHandle, "invalid handle destruction");
     Require(sceNpTrophyDestroyContext(missing) == 0, "destroy the second context");
     Require(sceNpTrophyDestroyHandle(handle) == 0 && sceNpTrophyDestroyContext(context) == 0, "destroy the handle and context");
     Require(sceNpTrophyDestroyContext(context) == InvalidContext, "destroy the context twice");

From fcb9f57f50c9c47f385a777d20c41b4a4d0ea1ae Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:32:58 -0500
Subject: [PATCH 047/218] test(libSceAppContent): cover uninitialized rejection
 in addcont mount and info queries

---
 core/libs/tests/GuestAppContent.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/core/libs/tests/GuestAppContent.cpp b/core/libs/tests/GuestAppContent.cpp
index 42be4b89b2..104e5ae732 100644
--- a/core/libs/tests/GuestAppContent.cpp
+++ b/core/libs/tests/GuestAppContent.cpp
@@ -33,6 +33,7 @@ static constexpr int ErrorParameter = static_cast<int>(0x80D90002);
 static constexpr int ErrorNotFound = static_cast<int>(0x80D90005);
 static constexpr int ErrorDrmNoEntitlement = static_cast<int>(0x80D90007);
 static constexpr int ErrorBusy = static_cast<int>(0x80D90003);
+static constexpr int ErrorNotInitialized = static_cast<int>(0x80D90001);
 static constexpr int ErrorNotMounted = static_cast<int>(0x80D90004);
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -69,6 +70,9 @@ int main() {
     }
     AppContentInitParam init{};
     AppContentBootParam boot{};
+    Require(sceAppContentAddcontMount(0, nullptr, nullptr) == ErrorNotInitialized);
+    Require(sceAppContentAddcontUnmount(nullptr) == ErrorNotInitialized);
+    Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, nullptr) == ErrorNotInitialized);
     Require(sceAppContentInitialize(nullptr, &boot) == ErrorParameter);
     Require(sceAppContentInitialize(&init, nullptr) == ErrorParameter);
     init.reserved[31] = 1;

From 3f4fa3a17236d726f798a23f3007c64a3040ada7 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:33:36 -0500
Subject: [PATCH 048/218] test(libSceAjm.native): cover null parameter
 validation in sceAjmDecWVorbisCreateHeaderPacket

---
 core/libs/tests/GuestAjm.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/libs/tests/GuestAjm.cpp b/core/libs/tests/GuestAjm.cpp
index 4fca98867a..c1081ab1a1 100644
--- a/core/libs/tests/GuestAjm.cpp
+++ b/core/libs/tests/GuestAjm.cpp
@@ -20,6 +20,7 @@ extern "C" {
 int APS5_VABI sceAjmInitialize(std::int64_t, std::uint32_t*);
 int APS5_VABI sceAjmFinalize(std::uint32_t);
 int APS5_VABI sceAjmDecAt9ParseConfigData(const void*, AjmDecAt9ConfigDataInfo*);
+int APS5_VABI sceAjmDecWVorbisCreateHeaderPacket(void*);
 int APS5_VABI sceAjmDecMp3ParseFrame(const std::uint8_t*, std::uint32_t, int, AjmDecMp3ParseFrame*);
 int APS5_VABI sceAjmInstanceCreate(std::uint32_t, std::uint32_t, std::uint64_t, std::uint32_t*);
 int APS5_VABI sceAjmInstanceDestroy(std::uint32_t, std::uint32_t);
@@ -2051,5 +2052,6 @@ int main() {
     TestAt9GaplessSegments(context);
     TestAt9RunDecodesWholeInput(context);
     TestPcmResample(context);
+    Require(sceAjmDecWVorbisCreateHeaderPacket(nullptr) == static_cast<int>(0x80B50001));
     Require(sceAjmFinalize(context) == 0);
 }

From e6b2ae3dce070731c8dd3c3423a27ba131fe14d3 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:34:15 -0500
Subject: [PATCH 049/218] test(libSceSaveData.native): cover null convert
 struct and directory name validation

---
 core/libs/tests/GuestSaveDataConvert.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/libs/tests/GuestSaveDataConvert.cpp b/core/libs/tests/GuestSaveDataConvert.cpp
index df8f6743ce..3680a14dde 100644
--- a/core/libs/tests/GuestSaveDataConvert.cpp
+++ b/core/libs/tests/GuestSaveDataConvert.cpp
@@ -59,6 +59,9 @@ int main() {
 
     float progress = 0.0f;
     Check(sceSaveDataGetConvertProgress(&progress) == SaveDataErrorNotInitialized, "query before initialize fails with not initialized");
+    Check(sceSaveDataConvert(nullptr) == SaveDataErrorParameter, "null convert pointer is rejected");
+    SaveDataConvert nullDir{};
+    Check(sceSaveDataConvert(&nullDir) == SaveDataErrorParameter, "null dir_name is rejected");
     Check(sceSaveDataInitialize3(nullptr) == 0, "SaveData initializes");
     Check(sceSaveDataGetConvertProgress(&progress) == 0, "get convert progress succeeds");
     Check(progress == 0.0f, "convert progress reports 0.0f initially");

From c6b0f8ac9d79d7960659267c93676325e5574b78 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:34:28 -0500
Subject: [PATCH 050/218] test(libSceVideoOut): cover null status buffer
 validation in sceVideoOutGetResolutionStatus

---
 core/libs/tests/GuestVideoOutResolutionStatus.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/libs/tests/GuestVideoOutResolutionStatus.cpp b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
index e401ad3023..fb4d14f108 100644
--- a/core/libs/tests/GuestVideoOutResolutionStatus.cpp
+++ b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
@@ -68,6 +68,8 @@ int main() {
     for (const auto byte : vrr) Require(byte == std::byte{0xff});
 
     Require(Rejects(handle, nullptr));
+    Require(sceVideoOutGetResolutionStatus(handle, nullptr) == static_cast<int>(0x80290002u));
+    Require(sceVideoOutGetResolutionStatus(-1, nullptr) == static_cast<int>(0x80290002u));
     Require(Rejects(0, &status));
     Require(Rejects(-1, &status));
     Require(Rejects(NEVER_OPENED_HANDLE, &status));

From aa276cd7457508f0a479b83bc76a6bda18372950 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Fri, 23 Oct 2026 11:34:40 -0500
Subject: [PATCH 051/218] test(libSceConvertKeycode): cover null address and
 invalid keyboard type rejection

---
 core/libs/tests/GuestConvertKeycodeTitle.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/core/libs/tests/GuestConvertKeycodeTitle.cpp b/core/libs/tests/GuestConvertKeycodeTitle.cpp
index 6fd7337573..20bb8d6656 100644
--- a/core/libs/tests/GuestConvertKeycodeTitle.cpp
+++ b/core/libs/tests/GuestConvertKeycodeTitle.cpp
@@ -8,6 +8,8 @@
 
 extern "C" {
 int APS5_VABI sceConvertKeycodeGetImeKeyboardType(std::int32_t, std::uint32_t*);
+int APS5_VABI sceConvertKeycodeGetVirtualKeycode(std::uint16_t, std::uint32_t, std::uint16_t*);
+int APS5_VABI sceConvertKeycodeGetCharacter(std::uint16_t, std::uint32_t, std::uint32_t, char16_t*);
 }
 
 int main() {
@@ -21,5 +23,11 @@ int main() {
     std::memcpy(process.data() + 16, &sdkVersion, sizeof(sdkVersion));
     if (!ProcessParametersFixture::Install(process.data(), process.size())) return 2;
     std::uint32_t type = 0xFFFFFFFFu;
+    std::uint16_t virtualKey = 0;
+    char16_t character = 0;
+    if (sceConvertKeycodeGetVirtualKeycode(0, 0, nullptr) != static_cast<int>(0x80BC0031u)) return 1;
+    if (sceConvertKeycodeGetVirtualKeycode(0, 0, &virtualKey) != static_cast<int>(0x80BC0034u)) return 1;
+    if (sceConvertKeycodeGetCharacter(0, 0, 0, nullptr) != static_cast<int>(0x80BC0031u)) return 1;
+    if (sceConvertKeycodeGetCharacter(0, 0, 0, &character) != static_cast<int>(0x80BC0034u)) return 1;
     return sceConvertKeycodeGetImeKeyboardType(0x10000000, &type) == 0 && type == 4 ? 0 : 1;
 }

From 8cfa0cbf6f0a18d98d694a0891e5d4e679964cfd Mon Sep 17 00:00:00 2001
From: Bram910 <bram@makowski.be>
Date: Wed, 21 Oct 2026 20:52:38 +0200
Subject: [PATCH 052/218] fix(io): reject NUL bytes in native file paths

---
 core/relinker/CMakeLists.txt               | 10 +++
 core/relinker/io/src/NativePath.cpp        |  3 +
 core/relinker/io/tests/NativePathTests.cpp | 74 ++++++++++++++++++++++
 3 files changed, 87 insertions(+)
 create mode 100644 core/relinker/io/tests/NativePathTests.cpp

diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index 5c4b89dfa8..9c59099716 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -102,6 +102,16 @@ if(BUILD_TESTING)
     target_link_libraries(relinker_conversion_tests PRIVATE relinker_core)
     add_test(NAME relinker_conversion COMMAND relinker_conversion_tests)
     set_tests_properties(relinker_conversion PROPERTIES TIMEOUT 20)
+
+    add_test_executable(native_path_tests
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/tests/NativePathTests.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/src/NativePath.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/src/FileReader.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/io/src/FileWriter.cpp)
+    target_include_directories(native_path_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/io/include ${CMAKE_CURRENT_SOURCE_DIR}/domain/include)
+    add_test(NAME native_path COMMAND native_path_tests)
+    set_tests_properties(native_path PROPERTIES TIMEOUT 20)
+
     add_test_executable(relinker_game_patch_tests ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/GamePatchTests.cpp)
     target_link_libraries(relinker_game_patch_tests PRIVATE relinker_core)
     add_test(NAME relinker_game_patch COMMAND relinker_game_patch_tests)
diff --git a/core/relinker/io/src/NativePath.cpp b/core/relinker/io/src/NativePath.cpp
index 13b11fa505..ad603ef310 100644
--- a/core/relinker/io/src/NativePath.cpp
+++ b/core/relinker/io/src/NativePath.cpp
@@ -1,8 +1,11 @@
 #include <io/NativePath.hpp>
+#include <stdexcept>
 
 namespace Io {
 
 std::filesystem::path NativePath(const std::string& path) {
+    if (path.find('\0') != std::string::npos)
+        throw std::invalid_argument("File path contains a NUL byte");
     const std::u8string utf8(path.begin(), path.end());
     return std::filesystem::path(utf8);
 }
diff --git a/core/relinker/io/tests/NativePathTests.cpp b/core/relinker/io/tests/NativePathTests.cpp
new file mode 100644
index 0000000000..e40cd5f3cf
--- /dev/null
+++ b/core/relinker/io/tests/NativePathTests.cpp
@@ -0,0 +1,74 @@
+#include <io/FileReader.hpp>
+#include <io/FileWriter.hpp>
+#include <io/NativePath.hpp>
+#include <chrono>
+#include <filesystem>
+#include <iostream>
+#include <stdexcept>
+#include <string>
+#include <vector>
+
+namespace {
+
+void Require(bool condition, const std::string& message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+template<typename TAction>
+void RequireInvalidPath(TAction action) {
+    try {
+        action();
+    } catch (const std::invalid_argument& error) {
+        Require(std::string(error.what()).find("NUL") != std::string::npos, "Path error does not identify the NUL byte");
+        return;
+    }
+    throw std::runtime_error("A path containing a NUL byte was accepted");
+}
+
+void Conversions() {
+    for (const std::string path : {"", "relative/file.bin", "a path with spaces", "caf\xc3\xa9/\xe6\x97\xa5\xe6\x9c\xac.bin"})
+        Require(Io::Utf8Path(Io::NativePath(path)) == path, "Valid path did not round-trip");
+    for (const std::string prefix : {"", "file", "directory/file"}) {
+        for (const auto& suffix : std::vector<std::string>{"", "suffix", std::string(1, '\0')}) {
+            const auto path = prefix + '\0' + suffix;
+            RequireInvalidPath([&] { Io::NativePath(path); });
+        }
+    }
+}
+
+void FileAccess(const std::filesystem::path& directory) {
+    const auto original = directory / Io::NativePath("caf\xc3\xa9-\xe6\x97\xa5\xe6\x9c\xac.bin");
+    const auto originalPath = Io::Utf8Path(original);
+    const std::vector<std::uint8_t> expected{0, 1, 10, 13, 127, 128, 255};
+    Io::FileWriter().Write(originalPath, expected);
+    Require(Io::FileReader().Read(originalPath) == expected, "Valid UTF-8 file path did not preserve binary data");
+    const auto missingPath = Io::Utf8Path(directory / "missing.bin");
+    for (const auto& prefix : {originalPath, missingPath}) {
+        for (const std::string suffix : {"", ".other", "/other.bin"}) {
+            const auto path = prefix + '\0' + suffix;
+            RequireInvalidPath([&] { Io::FileReader().Read(path); });
+            RequireInvalidPath([&] { Io::FileWriter().Write(path, std::vector<std::uint8_t>{42}); });
+            RequireInvalidPath([&] { Io::FileWriter().Write(path, std::string("replacement")); });
+            Require(Io::FileReader().Read(originalPath) == expected, "Invalid path changed the file named before the NUL byte");
+            Require(!std::filesystem::exists(Io::NativePath(missingPath)), "Invalid path created the file named before the NUL byte");
+        }
+    }
+}
+
+}
+
+int main() {
+    const auto directory = std::filesystem::temp_directory_path() /
+        ("anyps5-native-path-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    try {
+        Conversions();
+        std::filesystem::create_directory(directory);
+        FileAccess(directory);
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        std::error_code ignored;
+        std::filesystem::remove_all(directory, ignored);
+        return 1;
+    }
+    std::filesystem::remove_all(directory);
+}

From 5bf97cce6b2a011a75b7893cc4514da51433466a Mon Sep 17 00:00:00 2001
From: Bram910 <bram@makowski.be>
Date: Wed, 21 Oct 2026 22:01:19 +0200
Subject: [PATCH 053/218] fix(tools): validate ELF import table file ranges

---
 tools/import_audit.py            |  3 ++
 tools/tests/test_import_audit.py | 89 ++++++++++++++++++++++++++++++++
 2 files changed, 92 insertions(+)

diff --git a/tools/import_audit.py b/tools/import_audit.py
index 75540f1667..5c2573996a 100644
--- a/tools/import_audit.py
+++ b/tools/import_audit.py
@@ -84,6 +84,7 @@ def elf_program_dynamic_symbols(path, data):
     _, _, dynamic_offset, _, _, dynamic_size, _, _ = dynamic_segments[0]
     if dynamic_size % 16:
         raise AuditError(f"{path}: dynamic segment size {dynamic_size} is not a multiple of 16")
+    take(data, dynamic_offset, dynamic_size, path, "dynamic segment")
     dynamic = {}
     needed_offsets = []
     for position in range(0, dynamic_size, 16):
@@ -197,6 +198,7 @@ def elf_imports(path, data):
         if kind == 11:
             if entry != 24 or size % 24 or link >= len(sections) or sections[link][1] != 3:
                 raise AuditError(f"{path}: invalid dynamic symbol table (entry size {entry}, size {size}, string table section {link})")
+            take(data, offset, size, path, "dynamic symbol table")
             strings_offset, strings_size = sections[link][4], sections[link][5]
             take(data, strings_offset, strings_size, path, "dynamic string table")
             for position in range(0, size, 24):
@@ -207,6 +209,7 @@ def elf_imports(path, data):
         elif kind == 6:
             if entry != 16 or size % 16 or link >= len(sections) or sections[link][1] != 3:
                 raise AuditError(f"{path}: invalid dynamic section (entry size {entry}, size {size}, string table section {link})")
+            take(data, offset, size, path, "dynamic section")
             strings_offset, strings_size = sections[link][4], sections[link][5]
             take(data, strings_offset, strings_size, path, "dynamic string table")
             for position in range(0, size, 16):
diff --git a/tools/tests/test_import_audit.py b/tools/tests/test_import_audit.py
index b719d91dc6..7a6e7f7009 100644
--- a/tools/tests/test_import_audit.py
+++ b/tools/tests/test_import_audit.py
@@ -104,6 +104,13 @@ def exporting(*names):
     return build_elf([(name, 1, GLOBAL_FUNCTION) for name in names])
 
 
+def elf_dynamic_range_fields(image):
+    sections = struct.unpack_from("<Q", image, 40)[0]
+    if sections:
+        return sections + 192 + 24, sections + 192 + 32
+    return 120 + 8, 120 + 32
+
+
 def with_elf_symbol_table_range(image, offset, size):
     image = bytearray(image)
     section_offset = struct.unpack_from("<Q", image, 40)[0] + 64
@@ -909,6 +916,88 @@ class ImportAuditTests(unittest.TestCase):
                 self.assertIn(str(path), err)
                 self.assertIn("lies outside the file", err)
 
+    def test_elf_import_symbol_tables_reject_ranges_outside_the_file(self):
+        original = build_elf([("alpha", 0, GLOBAL_FUNCTION)])
+        for offset, size in ((len(original) + 1, 0), (2**64 - 1, 0),
+                             (len(original) - 23, 24), (len(original), 24)):
+            with self.subTest(offset=offset, size=size):
+                with self.assertRaisesRegex(import_audit.AuditError, "dynamic symbol table.*outside the file"):
+                    import_audit.elf_imports(Path("invalid-imports.prx"), with_elf_symbol_table_range(original, offset, size))
+
+    def test_elf_import_symbol_tables_can_end_at_eof(self):
+        original = build_elf([("alpha", 0, GLOBAL_FUNCTION)])
+        empty = with_elf_symbol_table_range(original, len(original), 0)
+        symbols, needed = import_audit.elf_imports(Path("empty.prx"), empty)
+        self.assertFalse(symbols)
+        self.assertFalse(needed)
+        sections = struct.unpack_from("<Q", original, 40)[0]
+        offset, size = struct.unpack_from("<QQ", original, sections + 64 + 24)
+        relocated = with_elf_symbol_table_range(original + original[offset:offset + size], len(original), size)
+        symbols, needed = import_audit.elf_imports(Path("relocated.prx"), relocated)
+        self.assertEqual(set(symbols), {"alpha"})
+        self.assertFalse(needed)
+
+    def test_elf_dynamic_table_ranges_are_checked_before_the_terminator(self):
+        for sectioned in (False, True):
+            original = build_elf([], ["libc.prx"]) if sectioned else build_sectionless_elf([], ["libc.prx"])
+            offset_field, size_field = elf_dynamic_range_fields(original)
+            offset = struct.unpack_from("<Q", original, offset_field)[0]
+            excessive_size = ((len(original) - offset) // 16 + 1) * 16
+            for start, size in ((offset, excessive_size), (offset, 2**64 - 16),
+                                (len(original) + 1, 0), (2**64 - 1, 16)):
+                with self.subTest(sectioned=sectioned, offset=start, size=size):
+                    image = bytearray(original)
+                    struct.pack_into("<Q", image, offset_field, start)
+                    struct.pack_into("<Q", image, size_field, size)
+                    with self.assertRaisesRegex(import_audit.AuditError, "dynamic (segment|section).*outside the file"):
+                        import_audit.elf_imports(Path("truncated.prx"), image)
+
+    def test_elf_dynamic_tables_ending_at_eof_and_terminated_padding(self):
+        for sectioned in (False, True):
+            original = build_elf([], ["libc.prx"]) if sectioned else build_sectionless_elf([], ["libc.prx"])
+            offset_field, size_field = elf_dynamic_range_fields(original)
+            offset = struct.unpack_from("<Q", original, offset_field)[0]
+            size = struct.unpack_from("<Q", original, size_field)[0]
+            for padding in (b"", struct.pack("<qQ", 1, 2**64 - 1)):
+                with self.subTest(sectioned=sectioned, padding=bool(padding)):
+                    image = bytearray(original + original[offset:offset + size] + padding)
+                    struct.pack_into("<Q", image, offset_field, len(original))
+                    struct.pack_into("<Q", image, size_field, size + len(padding))
+                    if not sectioned:
+                        struct.pack_into("<QQ", image, 64 + 32, len(image), len(image))
+                        struct.pack_into("<QQ", image, offset_field + 8, 0x400000 + len(original), 0x400000 + len(original))
+                        struct.pack_into("<Q", image, size_field + 8, size + len(padding))
+                    symbols, needed = import_audit.elf_imports(Path("valid.prx"), image)
+                    self.assertFalse(symbols)
+                    self.assertEqual(needed, {"libc.prx"})
+
+    def test_invalid_elf_dynamic_ranges_preserve_the_previous_report(self):
+        registry = self.work.root / "game.json"
+        report = self.work.root / "audit.json"
+        module = self.work.modules / "broken.prx"
+        write_registry(registry, [])
+        (self.work.libs / "libc.prx").write_bytes(exporting())
+        cases = []
+        for sectioned in (False, True):
+            original = build_elf([], ["libc.prx"]) if sectioned else build_sectionless_elf([], ["libc.prx"])
+            offset_field, size_field = elf_dynamic_range_fields(original)
+            offset = struct.unpack_from("<Q", original, offset_field)[0]
+            image = bytearray(original)
+            struct.pack_into("<Q", image, size_field, ((len(image) - offset) // 16 + 1) * 16)
+            cases.append(("dynamic section" if sectioned else "dynamic segment", image))
+        original = build_elf([], ["libc.prx"])
+        cases.append(("dynamic symbol table", with_elf_symbol_table_range(original, len(original) + 1, 0)))
+        for table, image in cases:
+            with self.subTest(table=table):
+                module.write_bytes(image)
+                report.write_bytes(b"previous report")
+                code, output, error = self.work.run(registry, "--json", str(report))
+                self.assertEqual((code, output), (2, ""))
+                self.assertIn(str(module), error)
+                self.assertIn(table, error)
+                self.assertNotIn("Traceback", error)
+                self.assertEqual(report.read_bytes(), b"previous report")
+
     def test_sectionless_elf_gnu_hash(self):
         image = build_sectionless_elf([
             ("AAAAAAAAAAA", 0, GLOBAL_FUNCTION), ("BBBBBBBBBBB", 1, GLOBAL_FUNCTION)],

From 0a238f9e49485c0fe356e06c622de784a62da436 Mon Sep 17 00:00:00 2001
From: cadenasynyster <8373765+cadenasynyster@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:26:38 +0200
Subject: [PATCH 054/218] fix(libc): keep a rename source lookup error ahead of
 a destination loop

On Windows, rename converted ENOENT or ENOTDIR to ELOOP when either parent directory was below a symbolic link loop. A missing source, or a source below a non-directory, paired with a destination through a loop then reported ELOOP. FreeBSD 11.4 kern_renameat returns the failed source lookup before it examines the destination. A loop below the source still gives ELOOP, and a loop below the destination gives ELOOP only when the source lookup succeeded.

guest_filesystem gains the missing-source and non-directory-source-prefix cases paired with a looping destination, for rename and sceKernelRename.
---
 core/libs/prx/libc/src/Rename.cpp   | 5 ++++-
 core/libs/tests/GuestFilesystem.cpp | 6 ++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libc/src/Rename.cpp b/core/libs/prx/libc/src/Rename.cpp
index 0e7f64e5d7..6c02484c32 100644
--- a/core/libs/prx/libc/src/Rename.cpp
+++ b/core/libs/prx/libc/src/Rename.cpp
@@ -132,7 +132,10 @@ extern "C" int RenameGuestPath_nid_no_patch(const char* from, const char* to) {
         }
 #ifdef _WIN32
         constexpr int GuestEloop = 62;
-        if ((error == 2 || error == 20) && (BelowSymbolicLinkLoop(source.parent_path()) || BelowSymbolicLinkLoop(destination.parent_path()))) error = GuestEloop;
+        if (error == 2 || error == 20) {
+            if (BelowSymbolicLinkLoop(source.parent_path())) error = GuestEloop;
+            else if (SourceLookupError_nid_no_patch(source) == 0 && BelowSymbolicLinkLoop(destination.parent_path())) error = GuestEloop;
+        }
 #endif
         if (error) { errno = error; return -1; }
         RecordWrittenPath_nid_no_patch(source);
diff --git a/core/libs/tests/GuestFilesystem.cpp b/core/libs/tests/GuestFilesystem.cpp
index 1eaa8196a8..b016ee838b 100644
--- a/core/libs/tests/GuestFilesystem.cpp
+++ b/core/libs/tests/GuestFilesystem.cpp
@@ -973,6 +973,12 @@ int main() {
         Require(rename_nid_postfix(renameThroughLoop.c_str(), renameTarget.c_str()) == -1 && *__error_nid_postfix() == 62);
         Require(sceKernelRename(present.string().c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x8002003eu));
         Require(rename_nid_postfix(present.string().c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 62);
+        const auto missingSource = (root / "missing-source").string();
+        const auto underFile = present.string() + "\\child";
+        Require(sceKernelRename(missingSource.c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x80020002u));
+        Require(rename_nid_postfix(missingSource.c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 2);
+        Require(sceKernelRename(underFile.c_str(), renameThroughLoop.c_str()) == static_cast<int>(0x80020014u));
+        Require(rename_nid_postfix(underFile.c_str(), renameThroughLoop.c_str()) == -1 && *__error_nid_postfix() == 20);
         Require(stat_nid_postfix(fileLink.string().c_str(), &status) == 0 && status.st_size == 5);
         FileStat absoluteStatus{};
         Require(lstat_nid_postfix(absoluteLink.string().c_str(), &absoluteStatus) == 0);

From d2e18d53b32768d1e8606c6ea26395cd299b70dc Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 16:18:56 -0400
Subject: [PATCH 055/218] fix(libc): return the console's class bits from the
 ctype functions

isalpha, isdigit, isspace and the other ctype classifiers returned 1 for
a match. The libc.prx bundled with eleven titles returns the matching
bits of its classification table instead, for example 0x20 from isdigit,
0x04 from isspace(' ') and 0x40 from isspace('\t'), and its table marks
tab with 0x400, which isblank returns. The classifiers now return the
exported table's bits under the console's masks, and the table gains the
tab bit; which characters match is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/LocaleSupport.cpp | 29 ++++++++++++-----------
 core/libs/tests/GuestCharacter.cpp       | 30 ++++++++++++++++++++++++
 core/libs/tests/GuestLocale.cpp          |  2 +-
 3 files changed, 46 insertions(+), 15 deletions(-)

diff --git a/core/libs/prx/libc/src/LocaleSupport.cpp b/core/libs/prx/libc/src/LocaleSupport.cpp
index fb1f8042ab..b88a211adc 100644
--- a/core/libs/prx/libc/src/LocaleSupport.cpp
+++ b/core/libs/prx/libc/src/LocaleSupport.cpp
@@ -227,6 +227,7 @@ constexpr std::array<short, 257> MakeClassificationTable() {
         if (value < 32 || value == 127) mask |= 0x80;
         if (value == ' ') mask |= 0x04;
         if (value >= '\t' && value <= '\r') mask |= 0x40;
+        if (value == '\t') mask |= 0x400;
         if (value >= 'A' && value <= 'Z') mask |= 0x02;
         if (value >= 'a' && value <= 'z') mask |= 0x10;
         if (value >= '0' && value <= '9') mask |= 0x20;
@@ -257,10 +258,10 @@ void ValidateCharacter(int value) {
     if (value != EOF && (value < 0 || value > UCHAR_MAX)) throw std::invalid_argument("Invalid character value");
 }
 
-int ClassifyCharacter(int value, std::ctype_base::mask mask) {
+int ClassifyCharacter(int value, short mask) {
     ValidateCharacter(value);
     if (value == EOF) return 0;
-    return std::use_facet<std::ctype<char>>(std::locale::classic()).is(mask, static_cast<char>(value));
+    return g_classificationTable[static_cast<std::size_t>(value) + 1] & mask;
 }
 
 int ConvertCharacter(int value, bool upper) {
@@ -275,18 +276,18 @@ int ConvertCharacter(int value, bool upper) {
 
 extern "C" {
 
-int APS5_VABI isupper_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::upper); }
-int APS5_VABI islower_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::lower); }
-int APS5_VABI isalpha_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::alpha); }
-int APS5_VABI isdigit_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::digit); }
-int APS5_VABI isalnum_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::alnum); }
-int APS5_VABI isspace_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::space); }
-int APS5_VABI isblank_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::blank); }
-int APS5_VABI iscntrl_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::cntrl); }
-int APS5_VABI isprint_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::print); }
-int APS5_VABI isgraph_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::graph); }
-int APS5_VABI ispunct_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::punct); }
-int APS5_VABI isxdigit_nid_postfix(int c) { return ClassifyCharacter(c, std::ctype_base::xdigit); }
+int APS5_VABI isupper_nid_postfix(int c) { return ClassifyCharacter(c, 0x02); }
+int APS5_VABI islower_nid_postfix(int c) { return ClassifyCharacter(c, 0x10); }
+int APS5_VABI isalpha_nid_postfix(int c) { return ClassifyCharacter(c, 0x12); }
+int APS5_VABI isdigit_nid_postfix(int c) { return ClassifyCharacter(c, 0x20); }
+int APS5_VABI isalnum_nid_postfix(int c) { return ClassifyCharacter(c, 0x32); }
+int APS5_VABI isspace_nid_postfix(int c) { return ClassifyCharacter(c, 0x44); }
+int APS5_VABI isblank_nid_postfix(int c) { return ClassifyCharacter(c, 0x404); }
+int APS5_VABI iscntrl_nid_postfix(int c) { return ClassifyCharacter(c, 0x80); }
+int APS5_VABI isprint_nid_postfix(int c) { return ClassifyCharacter(c, 0x3e); }
+int APS5_VABI isgraph_nid_postfix(int c) { return ClassifyCharacter(c, 0x3a); }
+int APS5_VABI ispunct_nid_postfix(int c) { return ClassifyCharacter(c, 0x08); }
+int APS5_VABI isxdigit_nid_postfix(int c) { return ClassifyCharacter(c, 0x01); }
 int APS5_VABI toupper_nid_postfix(int c) { return ConvertCharacter(c, true); }
 int APS5_VABI tolower_nid_postfix(int c) { return ConvertCharacter(c, false); }
 
diff --git a/core/libs/tests/GuestCharacter.cpp b/core/libs/tests/GuestCharacter.cpp
index 7601716b77..a7e3dfdf8b 100644
--- a/core/libs/tests/GuestCharacter.cpp
+++ b/core/libs/tests/GuestCharacter.cpp
@@ -24,7 +24,37 @@ const short* APS5_VABI _Getptoupper_nid_postfix();
 const char* APS5_VABI setlocale_nid_postfix(int, const char*);
 }
 static void Require(bool value) { if (!value) std::abort(); }
+static int ConsoleClass(int c) {
+    if (c < 0 || c > 255) return 0;
+    int bits = 0;
+    if ((c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')) bits |= 0x01;
+    if (c >= 'A' && c <= 'Z') bits |= 0x02;
+    if (c == ' ') bits |= 0x04;
+    if (c >= 33 && c <= 126 && !(c >= '0' && c <= '9') && !(c >= 'A' && c <= 'Z') && !(c >= 'a' && c <= 'z')) bits |= 0x08;
+    if (c >= 'a' && c <= 'z') bits |= 0x10;
+    if (c >= '0' && c <= '9') bits |= 0x20;
+    if (c >= '\t' && c <= '\r') bits |= 0x40;
+    if (c < 32 || c == 127) bits |= 0x80;
+    if (c == '\t') bits |= 0x400;
+    return bits;
+}
+static void CheckConsoleClassValues() {
+    Require(isspace_nid_postfix(' ') == 0x04 && isspace_nid_postfix('\t') == 0x40 && isspace_nid_postfix('\n') == 0x40);
+    Require(isblank_nid_postfix(' ') == 0x04 && isblank_nid_postfix('\t') == 0x400 && iscntrl_nid_postfix('\t') == 0x80);
+    Require(isdigit_nid_postfix('0') == 0x20 && isalnum_nid_postfix('0') == 0x20 && isxdigit_nid_postfix('0') == 0x01);
+    Require(isupper_nid_postfix('A') == 0x02 && isalpha_nid_postfix('A') == 0x02 && isxdigit_nid_postfix('F') == 0x01 && isxdigit_nid_postfix('G') == 0);
+    Require(islower_nid_postfix('a') == 0x10 && isalpha_nid_postfix('a') == 0x10 && isprint_nid_postfix(' ') == 0x04 && isgraph_nid_postfix(' ') == 0);
+    Require(ispunct_nid_postfix('_') == 0x08 && isgraph_nid_postfix('_') == 0x08 && isprint_nid_postfix('_') == 0x08 && iscntrl_nid_postfix(127) == 0x80);
+    for (int c = EOF; c <= 255; ++c) {
+        const int bits = ConsoleClass(c);
+        Require(isupper_nid_postfix(c) == (bits & 0x02) && islower_nid_postfix(c) == (bits & 0x10) && isalpha_nid_postfix(c) == (bits & 0x12));
+        Require(isdigit_nid_postfix(c) == (bits & 0x20) && isalnum_nid_postfix(c) == (bits & 0x32) && isxdigit_nid_postfix(c) == (bits & 0x01));
+        Require(isspace_nid_postfix(c) == (bits & 0x44) && isblank_nid_postfix(c) == (bits & 0x404) && iscntrl_nid_postfix(c) == (bits & 0x80));
+        Require(isprint_nid_postfix(c) == (bits & 0x3e) && isgraph_nid_postfix(c) == (bits & 0x3a) && ispunct_nid_postfix(c) == (bits & 0x08));
+    }
+}
 int main() {
+    CheckConsoleClassValues();
     Require(std::setlocale(LC_CTYPE, "C") != nullptr);
     for (int category = 0; category <= 6; ++category) {
         const char* result = setlocale_nid_postfix(category, "C");
diff --git a/core/libs/tests/GuestLocale.cpp b/core/libs/tests/GuestLocale.cpp
index 78aaee27be..f3bf2fa152 100644
--- a/core/libs/tests/GuestLocale.cpp
+++ b/core/libs/tests/GuestLocale.cpp
@@ -121,7 +121,7 @@ static void CheckCharacterTables() {
     Require(classification[-1] == 0 && lower[-1] == -1 && upper[-1] == -1);
     Require(classification['A'] == 0x03 && classification['a'] == 0x11);
     Require(classification['G'] == 0x02 && classification['0'] == 0x21);
-    Require(classification[' '] == 0x04 && classification['\t'] == 0xc0);
+    Require(classification[' '] == 0x04 && classification['\t'] == 0x4c0);
     Require(classification['\n'] == 0xc0 && classification['!'] == 0x08);
     for (int value = 0; value < 256; ++value) {
         Require(lower[value] == (value >= 'A' && value <= 'Z' ? value + 32 : value));

From 0b2e9aa56477d5f49df208e44da57a3d0291dc68 Mon Sep 17 00:00:00 2001
From: HQasper <52220032+HQasper@users.noreply.github.com>
Date: Thu, 22 Oct 2026 19:57:29 +0200
Subject: [PATCH 056/218] fix(agc): draw stencil AND, OR, XOR and XNOR on the
 bits they change

DB_STENCIL_CONTROL codes 10, 11, 12 and 15 (STENCIL_AND, STENCIL_OR,
STENCIL_XOR, STENCIL_XNOR) combine the stored stencil value with
DB_STENCILREFMASK.STENCILOPVAL, as AMD_stencil_operation_extended
defines them, and threw "stencil operation N is unsupported".

Each one now becomes a single Vulkan operation with the face's write
mask narrowed to the bits it can change: ZERO for AND, INVERT for XOR
and XNOR, REPLACE with those reference bits set for OR. A face whose
other operations write other bits, OR against a compared test value bit
it would set, OR with a stencil test value export, and NAND and NOR
still throw.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../libSceAgcDriver/Graphics/src/State.cpp    |  31 ++-
 .../prx/libSceAgcDriver/tests/Graphics.cpp    |  96 ++++++++-
 .../execution/StencilLogicOperations.cpp      | 202 ++++++++++++++++++
 docs/dev/debt/libSceAgcDriver.md              |   1 +
 4 files changed, 328 insertions(+), 2 deletions(-)
 create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp

diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
index 23ed20c037..3b3f0b9430 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp
@@ -314,13 +314,33 @@ VkStencilOpState stencilFace(std::uint32_t compare, std::uint32_t ops, std::uint
     auto fixed = compare == 0 || compare == 7 ? 0u : face.compareMask;
     std::uint32_t invertMask = 0;
     std::uint32_t inverted = 0;
+    std::uint32_t logicMask = 0;
+    const auto logic = [](std::uint32_t op) { return op == 10 || op == 11 || op == 12 || op == 15; };
     const auto convert = [&](std::uint32_t op, bool testFailed) {
         if (face.writeMask == 0) return VK_STENCIL_OP_KEEP;
         char detail[112];
-        if (opValExport && ((op == 4 && !opValReference) || op == 5 || op == 6 || op == 8 || op == 9)) {
+        if (opValExport && ((op == 4 && !opValReference) || (op >= 5 && op != 7))) {
             std::snprintf(detail, sizeof(detail), "AGC graphics: stencil operation %u with a pixel shader that exports the stencil operation value is unsupported", op);
             throw std::runtime_error(detail);
         }
+        if (logic(op)) {
+            const auto bits = (op == 11 || op == 12 ? opValue : ~opValue) & face.writeMask;
+            if (bits == 0) return VK_STENCIL_OP_KEEP;
+            if (logicMask != 0 && logicMask != bits) {
+                std::snprintf(detail, sizeof(detail), "AGC graphics: stencil logic operations on write masks 0x%02x and 0x%02x are unsupported", logicMask, bits);
+                throw std::runtime_error(detail);
+            }
+            logicMask = bits;
+            if (op != 11) return op == 10 ? VK_STENCIL_OP_ZERO : VK_STENCIL_OP_INVERT;
+            if (testValExport) throw std::runtime_error("AGC graphics: stencil OR is unsupported with a pixel shader that exports the stencil test value");
+            if ((~reference & fixed & bits) != 0) {
+                std::snprintf(detail, sizeof(detail), "AGC graphics: stencil OR of 0x%02x against test value 0x%02x (masks 0x%02x/0x%02x) is unsupported", opValue, test, face.compareMask, face.writeMask);
+                throw std::runtime_error(detail);
+            }
+            reference |= bits;
+            fixed |= bits;
+            return VK_STENCIL_OP_REPLACE;
+        }
         switch (op) {
             case 0: return VK_STENCIL_OP_KEEP;
             case 1: return VK_STENCIL_OP_ZERO;
@@ -377,6 +397,15 @@ VkStencilOpState stencilFace(std::uint32_t compare, std::uint32_t ops, std::uint
         if (inverted != active) throw std::runtime_error("AGC graphics: a stencil replacement drawn as an inversion beside another stencil operation is unsupported");
         face.writeMask = invertMask;
     }
+    if (logicMask != 0) {
+        const auto other = [&](std::uint32_t op) { return op != 0 && !logic(op); };
+        if ((other(ops & 0xfu) || other((ops >> 4u) & 0xfu) || other((ops >> 8u) & 0xfu)) && logicMask != face.writeMask) {
+            char detail[128];
+            std::snprintf(detail, sizeof(detail), "AGC graphics: stencil operations 0x%03x combine a logic operation on write mask 0x%02x with write mask 0x%02x", ops & 0xfffu, logicMask, face.writeMask);
+            throw std::runtime_error(detail);
+        }
+        face.writeMask = logicMask;
+    }
     face.reference = reference;
     Require(!opValReference || compare == 0 || compare == 7 || face.compareMask == 0, "a stencil compare against the test value is unsupported with a pixel shader that exports the stencil operation value");
     return face;
diff --git a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
index 39a2b17eb8..52b4304f31 100644
--- a/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/Graphics.cpp
@@ -8951,7 +8951,7 @@ void stencilRefExportTests() {
             Require(AgcDriver::Graphics::DrawRejection(unused, false).empty(), "the precheck rejected STENCIL_OP_VAL_EXPORT_ENABLE without a stencil test in DB_SHADER_CONTROL " + std::to_string(shaderControl));
             Require(AgcDriver::Graphics::DecodePixelStageInfo(unused.context, IdentityExports).stencilRefExportEnable == ((shaderControl & 2u) != 0), "STENCIL_OP_VAL_EXPORT_ENABLE without a stencil test exported the stencil reference");
             const bool replaces = (shaderControl & 6u) == 4u;
-            for (const auto [ops, writeMask, compare, accepted] : {std::tuple{0x000u, 0xffu, 7u, true}, std::tuple{0x737u, 0xffu, 7u, true}, std::tuple{0x110u, 0xffu, 7u, true}, std::tuple{0x050u, 0x00u, 7u, true}, std::tuple{0x040u, 0xffu, 7u, replaces}, std::tuple{0x40040u, 0xffu, 7u, replaces}, std::tuple{0x404u, 0x0fu, 0u, replaces}, std::tuple{0x040u, 0xffu, 2u, false}, std::tuple{0x340u, 0xffu, 7u, false}, std::tuple{0x042u, 0xffu, 7u, false}, std::tuple{0x050u, 0xffu, 7u, false}, std::tuple{0x600u, 0xffu, 7u, false}, std::tuple{0x008u, 0xffu, 7u, false}, std::tuple{0x900u, 0xffu, 7u, false}, std::tuple{0x5000u, 0xffu, 7u, false}}) {
+            for (const auto [ops, writeMask, compare, accepted] : {std::tuple{0x000u, 0xffu, 7u, true}, std::tuple{0x737u, 0xffu, 7u, true}, std::tuple{0x110u, 0xffu, 7u, true}, std::tuple{0x050u, 0x00u, 7u, true}, std::tuple{0x040u, 0xffu, 7u, replaces}, std::tuple{0x40040u, 0xffu, 7u, replaces}, std::tuple{0x404u, 0x0fu, 0u, replaces}, std::tuple{0x040u, 0xffu, 2u, false}, std::tuple{0x340u, 0xffu, 7u, false}, std::tuple{0x042u, 0xffu, 7u, false}, std::tuple{0x050u, 0xffu, 7u, false}, std::tuple{0x600u, 0xffu, 7u, false}, std::tuple{0x008u, 0xffu, 7u, false}, std::tuple{0x900u, 0xffu, 7u, false}, std::tuple{0x5000u, 0xffu, 7u, false}, std::tuple{0x0c0u, 0xffu, 7u, false}, std::tuple{0x00bu, 0xffu, 7u, false}}) {
                 auto stenciled = stencilRefExportQueue(shaderControl, zFormat);
                 for (const auto [offset, word] : {std::pair{0x010u, 0x80000180u}, std::pair{0x011u, 0x20000181u}, std::pair{0x012u, 0x00001000u}, std::pair{0x013u, 0x00002000u}, std::pair{0x015u, 0x00002000u}, std::pair{0x007u, 0x003f003fu}, std::pair{0x000u, 0u}, std::pair{0x002u, 0u}, std::pair{0x00au, 0u}, std::pair{0x00bu, 0x3f800000u}, std::pair{0x200u, 0x007007b3u}}) stenciled.context[offset] = word;
                 stenciled.context[0x10b] = ops;
@@ -9261,6 +9261,99 @@ void stencilReferenceUnusedTests() {
     std::cout << "Unused stencil reference sample equivalence passed: " << accepted << " accepted states, " << countermodels << " dependent countermodels\n";
 }
 
+void stencilLogicOperationTests() {
+    const auto queueFor = [](std::uint32_t ops, std::uint32_t front, std::uint32_t back, std::uint32_t depthControl) {
+        auto queue = makeState();
+        for (const auto [offset, word] : {std::pair{0x000u, 0u}, std::pair{0x002u, 0u}, std::pair{0x007u, (1u << 16u) | 3u}, std::pair{0x00au, 0u}, std::pair{0x00bu, 0u}, std::pair{0x010u, 0x22900983u}, std::pair{0x011u, 0x20000181u}, std::pair{0x012u, 0x100u}, std::pair{0x014u, 0x100u}, std::pair{0x013u, 0x200u}, std::pair{0x015u, 0x200u}, std::pair{0x005u, 0x300u}, std::pair{0x01eu, 0x1u}}) queue.context[offset] = word;
+        queue.context[0x10b] = ops;
+        queue.context[0x10c] = front;
+        queue.context[0x10d] = back;
+        queue.context[0x200] = depthControl;
+        return queue;
+    };
+    const auto refMaskOf = [](std::uint32_t test, std::uint32_t writeMask, std::uint32_t value) { return test | 0xff00u | (writeMask << 16u) | (value << 24u); };
+    const auto apply = [](std::uint32_t op, std::uint32_t stencil, std::uint32_t value) {
+        switch (op) {
+            case 1: return 0u;
+            case 10: return stencil & value;
+            case 11: return stencil | value;
+            case 12: return stencil ^ value;
+            case 15: return ~(stencil ^ value);
+            default: return stencil;
+        }
+    };
+    const auto matches = [&](const AgcDriver::Graphics::State& state, const VkStencilOpState& face, std::uint32_t ops, std::uint32_t compare, std::uint32_t refMask, const std::string& name) {
+        const auto test = refMask & 0xffu;
+        const auto compareMask = (refMask >> 8u) & 0xffu;
+        const auto writeMask = (refMask >> 16u) & 0xffu;
+        const auto value = refMask >> 24u;
+        for (std::uint32_t stencil = 0; stencil < 256u; ++stencil) {
+            for (const bool depthPass : {false, true}) {
+                const bool stencilPass = stencilComparison(static_cast<VkCompareOp>(compare), test & compareMask, stencil & compareMask);
+                const auto op = (ops >> (!stencilPass ? 0u : !depthPass ? 8u : 4u)) & 0xfu;
+                const auto expected = ((stencil & ~writeMask) | (apply(op, stencil, value) & writeMask)) & 0xffu;
+                const auto [actual, passed] = stencilReferenceOutcome(state, face, face.reference, stencil, depthPass, true);
+                Require(actual == expected && passed == (stencilPass && depthPass), name + ": stencil " + std::to_string(stencil) + (depthPass ? " passing" : " failing") + " the depth test became " + std::to_string(actual) + ", expected " + std::to_string(expected));
+            }
+        }
+    };
+    std::size_t accepted = 0;
+    for (const auto op : {10u, 11u, 12u, 15u}) {
+        for (const auto placement : {0x010u, 0x001u, 0x100u, 0x111u}) {
+            for (const auto compare : {7u, 0u, 2u, 3u}) {
+                for (const auto [test, writeMask, value] : {std::tuple{0x00u, 0xffu, 0x5au}, std::tuple{0xa5u, 0xffu, 0x21u}, std::tuple{0xa5u, 0x3cu, 0xffu}, std::tuple{0xffu, 0xf0u, 0x0fu}, std::tuple{0x5au, 0x81u, 0x00u}}) {
+                    const auto ops = op * placement;
+                    const auto refMask = refMaskOf(test, writeMask, value);
+                    const auto queue = queueFor(ops, refMask, refMask, 0x13u | (compare << 8u));
+                    const auto name = "stencil operation " + std::to_string(op) + " in DB_STENCIL_CONTROL " + std::to_string(ops) + " with compare " + std::to_string(compare) + " and DB_STENCILREFMASK " + std::to_string(refMask);
+                    const auto bits = (op == 11u || op == 12u ? value : ~value) & writeMask;
+                    if (op == 11u && compare != 0u && compare != 7u && (~test & bits) != 0u) {
+                        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(queue)); }, "stencil OR of");
+                        continue;
+                    }
+                    const auto state = AgcDriver::Graphics::DecodeState(queue);
+                    Require(state.stencilTest && state.depthTest && (state.stencilFront.writeMask & 0xffu) == (bits != 0u ? bits : writeMask), "the write mask is not narrowed to the bits changed by " + name);
+                    matches(state, state.stencilFront, ops, compare, refMask, name);
+                    ++accepted;
+                }
+            }
+        }
+    }
+    for (const auto [ops, refMask, name] : {std::tuple{0x0c1u, refMaskOf(0x80u, 0xffu, 0xffu), "XOR of every written bit beside ZERO"}, std::tuple{0x0cbu, refMaskOf(0x8fu, 0xffu, 0x0fu), "OR and XOR of the same bits"}, std::tuple{0x0fau, refMaskOf(0x80u, 0xffu, 0xf0u), "AND and XNOR of the same bits"}, std::tuple{0xb0bu, refMaskOf(0x30u, 0x3cu, 0xf0u), "OR on stencil fail and depth fail"}}) {
+        const auto queue = queueFor(ops, refMask, refMask, 0x13u | (3u << 8u));
+        const auto state = AgcDriver::Graphics::DecodeState(queue);
+        matches(state, state.stencilFront, ops, 3u, refMask, name);
+        ++accepted;
+    }
+    {
+        const auto front = refMaskOf(0x11u, 0xffu, 0x0fu);
+        const auto back = refMaskOf(0x22u, 0x3cu, 0x30u);
+        const auto queue = queueFor(0x0c0u | (0x0a0u << 12u), front, back, 0x93u | (7u << 8u) | (5u << 20u));
+        const auto state = AgcDriver::Graphics::DecodeState(queue);
+        Require(state.stencilFront.passOp == VK_STENCIL_OP_INVERT && state.stencilFront.writeMask == 0x0fu && state.stencilBack.passOp == VK_STENCIL_OP_ZERO && state.stencilBack.writeMask == 0x0cu, "front XOR and back AND did not keep their own write masks");
+        matches(state, state.stencilFront, 0x0c0u, 7u, front, "front XOR beside a back AND");
+        matches(state, state.stencilBack, 0x0a0u, 5u, back, "back AND beside a front XOR");
+        accepted += 2;
+    }
+    for (const auto [ops, refMask, reason] : {std::tuple{0x0d0u, refMaskOf(0u, 0xffu, 0x0fu), "stencil operation 13 is unsupported"}, std::tuple{0x0e0u, refMaskOf(0u, 0xffu, 0x0fu), "stencil operation 14 is unsupported"}, std::tuple{0x0cau, refMaskOf(0u, 0xffu, 0x0fu), "stencil logic operations on write masks"}, std::tuple{0x0fcu, refMaskOf(0u, 0xffu, 0x0fu), "stencil logic operations on write masks"},std::tuple{0x0c1u, refMaskOf(0u, 0xffu, 0x0fu), "combine a logic operation"}, std::tuple{0x5c0u, refMaskOf(0u, 0xffu, 0x01u), "combine a logic operation"}}) {
+        const auto queue = queueFor(ops, refMask, refMask, 0x13u | (7u << 8u));
+        expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(queue)); }, reason);
+    }
+    for (const auto ops : {0x0c0u, 0x0b0u}) {
+        auto exported = stencilRefExportQueue(0x12u, 9u);
+        for (const auto [offset, word] : {std::pair{0x010u, 0x80000180u}, std::pair{0x011u, 0x20000181u}, std::pair{0x012u, 0x00001000u}, std::pair{0x013u, 0x00002000u}, std::pair{0x015u, 0x00002000u}, std::pair{0x007u, 0x003f003fu}, std::pair{0x000u, 0u}, std::pair{0x002u, 0u}, std::pair{0x00au, 0u}, std::pair{0x00bu, 0x3f800000u}, std::pair{0x200u, 0x007007b3u}}) exported.context[offset] = word;
+        exported.context[0x10b] = ops;
+        exported.context[0x10c] = exported.context[0x10d] = refMaskOf(0u, 0xffu, 0x0fu);
+        if (ops == 0x0c0u) {
+            const auto state = AgcDriver::Graphics::DecodeState(exported);
+            Require(state.stencilFront.passOp == VK_STENCIL_OP_INVERT && state.stencilFront.writeMask == 0x0fu, "a stencil test value export changed a stencil XOR");
+        } else {
+            expectFailure([&] { static_cast<void>(AgcDriver::Graphics::DecodeState(exported)); }, "stencil OR is unsupported with a pixel shader that exports the stencil test value");
+        }
+    }
+    std::cout << "Stencil logic operations matched AND, OR, XOR and XNOR under the write mask for " << accepted << " register states\n";
+}
+
 std::set<std::string> bufferViews(std::span<const std::uint32_t> words) {
     std::set<std::string> views;
     for (std::size_t at = 5; at < words.size() && (words[at] >> 16u) != 0; at += words[at] >> 16u) {
@@ -11637,6 +11730,7 @@ int main(int argc, char** argv) {
         orderedPixelShaderTests();
         stencilRefExportTests();
         stencilReferenceUnusedTests();
+        stencilLogicOperationTests();
         aliasedBufferViewTests();
         LineStripTests();
         ShaderModuleKeyTests();
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp
new file mode 100644
index 0000000000..21f62c48d6
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/StencilLogicOperations.cpp
@@ -0,0 +1,202 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/ShaderInputState.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/State.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#include <algorithm>
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstdio>
+#include <iostream>
+#include <span>
+#include <string>
+#include <utility>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Width = 64;
+constexpr std::uint32_t Height = 16;
+constexpr std::uint32_t WaveSize = 64;
+constexpr std::uint32_t PlainControl = 0x50u;
+constexpr std::byte Kept{0x40};
+alignas(256) std::array<std::byte, Width * Height * 4> Pixels{};
+alignas(256) std::array<std::byte, 128 * 128 * 4> DepthMemory{};
+alignas(256) std::array<std::byte, 256 * 256> StencilMemory{};
+
+alignas(256) constexpr std::array<std::uint32_t, 6> VertexCode{
+    0xe0382000, 0x80000005, 0xbf8c3f70, 0xf80008cf, 0x03020100, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::uint32_t, 4> PixelCode{
+    0x7e0e02f2, 0xf800180f, 0x07070707, 0xbf810000,
+};
+
+alignas(256) constexpr std::array<std::array<float, 4>, 3> Vertices{{
+    {-1.0f, -1.0f, 0.25f, 1.0f}, {3.0f, -1.0f, 0.25f, 1.0f}, {-1.0f, 3.0f, 0.25f, 1.0f},
+}};
+
+struct Shaders {
+    ShaderRecompiler::RecompileResult vertex;
+    ShaderRecompiler::RecompileResult pixel;
+    std::uint32_t pixelPush = 0;
+};
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t stride, std::uint32_t count) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu) | (stride << 16u), count, 0x01016facu};
+}
+
+ShaderRecompiler::ShaderPixelStageInfo PixelInfo() {
+    const AgcDriver::Registers context{
+        {0x1b3, 0x700u}, {0x1b4, 0x700u}, {0x1b6, 0u}, {0x1c5, 9u}, {0x203, PlainControl},
+    };
+    return AgcDriver::Graphics::DecodePixelStageInfo(context, {0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u, 0xe4u});
+}
+
+Shaders Compile(AgcDriver::VulkanDevice& device) {
+    const auto target = device.Target();
+    std::vector<std::uint32_t> vertexUserData(4, 0u);
+    const auto vertexBuffer = BufferDescriptor(Vertices.data(), 16u, static_cast<std::uint32_t>(Vertices.size()));
+    std::copy(vertexBuffer.begin(), vertexBuffer.end(), vertexUserData.begin());
+    const std::array<ShaderRecompiler::MemoryRegion, 1> vertexMemory{{{reinterpret_cast<std::uintptr_t>(VertexCode.data()), std::as_bytes(std::span(VertexCode))}}};
+    ShaderRecompiler::RecompileRequest vertex{
+        {ShaderStage::Vertex, reinterpret_cast<std::uintptr_t>(VertexCode.data()), VertexCode, 0, {}},
+        {WaveSize, 0, vertexUserData, std::nullopt, std::nullopt, ShaderRecompiler::ShaderVertexStageInfo{}, vertexMemory},
+        target,
+        {0, 0, 0, 64}
+    };
+    vertex.useCache = false;
+    Shaders shaders{ShaderRecompiler::Recompile(vertex), {}, 0};
+    const auto vertexPush = static_cast<std::uint32_t>(shaders.vertex.pushConstants.size());
+    std::vector<std::uint32_t> pixelUserData(8, 0u);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> pixelMemory{{{reinterpret_cast<std::uintptr_t>(PixelCode.data()), std::as_bytes(std::span(PixelCode))}}};
+    ShaderRecompiler::RecompileRequest fragment{
+        {ShaderStage::Fragment, reinterpret_cast<std::uintptr_t>(PixelCode.data()), PixelCode, 0, {}},
+        {WaveSize, 0, pixelUserData, std::nullopt, PixelInfo(), std::nullopt, pixelMemory},
+        target,
+        PixelPushLayout(vertexPush, target)
+    };
+    fragment.useCache = false;
+    shaders.pixel = ShaderRecompiler::Recompile(fragment);
+    shaders.pixelPush = PixelPushOffset(vertexPush, target);
+    return shaders;
+}
+
+AgcDriver::QueueState StencilQueue(std::uint32_t ops, std::uint32_t refMask, std::uint32_t depthControl) {
+    AgcDriver::QueueState queue;
+    queue.userConfig[0x242] = 4;
+    queue.context = {
+        {0x2d5, 0x2000},
+        {0x1b6, 0}, {0x1b8, 0}, {0x207, 0}, {0x203, 0x800},
+        {0x2dc, 0xaa00}, {0x2f8, 0}, {0x292, 2}, {0x293, 0},
+        {0x80, 0}, {0x8d, 0}, {0x83, 0xffff}, {0x8c, 0xa},
+        {0x2f9, 0x2d}, {0x313, 0x6000}, {0x30e, 0xffffffff}, {0x30f, 0xffffffff},
+        {0x206, 0x43f}, {0x204, 0x80000}, {0x205, 0x240},
+        {0x8e, 0xf}, {0x8f, 0xf}, {0x202, 0xcc0010},
+        {0x1c4, 0}, {0x1c5, 9}, {0x1c3, 4}, {0x31c, 0x28028},
+        {0x31b, 0}, {0x31d, 0}, {0x3b0, (63u << 14u) | 3u},
+        {0x3b8, 0x9000000}, {0x1e0, 0},
+        {0xc, 0}, {0xd, 0x40040},
+        {0x81, 0x80000000}, {0x82, 0x40040},
+        {0x90, 0x80000000}, {0x91, 0x40040},
+        {0x94, 0x80000000}, {0x95, 0x40040},
+        {0x000, 0}, {0x002, 0}, {0x007, (1u << 16u) | 3u}, {0x00a, 0}, {0x00b, 0}, {0x010, 0x22900983u}, {0x011, 0x20000181u},
+        {0x012, 0x100}, {0x014, 0x100}, {0x013, 0x200}, {0x015, 0x200}, {0x005, 0x300}, {0x01e, 0x1},
+        {0x10b, ops}, {0x10c, refMask}, {0x10d, refMask}, {0x200, depthControl}
+    };
+    const auto address = reinterpret_cast<std::uintptr_t>(Pixels.data());
+    queue.context[0x318] = static_cast<std::uint32_t>(address >> 8u);
+    queue.context[0x390] = static_cast<std::uint32_t>(address >> 40u);
+    queue.context[0x10f] = std::bit_cast<std::uint32_t>(32.0f);
+    queue.context[0x110] = std::bit_cast<std::uint32_t>(32.0f);
+    queue.context[0x111] = std::bit_cast<std::uint32_t>(-2.0f);
+    queue.context[0x112] = std::bit_cast<std::uint32_t>(2.0f);
+    queue.context[0x113] = std::bit_cast<std::uint32_t>(1.0f);
+    queue.context[0x114] = 0;
+    queue.context[0xb4] = 0;
+    queue.context[0xb5] = std::bit_cast<std::uint32_t>(1.0f);
+    queue.shader[0x008] = 0x100;
+    queue.shader[0x009] = 0;
+    return queue;
+}
+
+void Draw(AgcDriver::VulkanDevice& device, const Shaders& shaders, const VkStencilOpState& stencil) {
+    Pixels.fill(Kept);
+    const std::array<AgcDriver::Graphics::CompiledShader, 2> stages{{
+        {ShaderStage::Vertex, &shaders.vertex, 0},
+        {ShaderStage::Fragment, &shaders.pixel, shaders.pixelPush}
+    }};
+    AgcDriver::Graphics::State state{};
+    state.stages = {AgcDriver::Graphics::ShaderPath::Vertex, 0u, WaveSize, WaveSize, std::nullopt, std::nullopt};
+    state.color = {reinterpret_cast<std::uintptr_t>(Pixels.data()), {Width, Height}, VK_FORMAT_R8G8B8A8_UNORM, Pixels.size(), 0xe4u};
+    state.colors = {state.color};
+    state.hasColorTarget = true;
+    state.depth = AgcDriver::Graphics::DepthTarget{reinterpret_cast<std::uintptr_t>(DepthMemory.data()), reinterpret_cast<std::uintptr_t>(StencilMemory.data()), {Width, Height}, VK_FORMAT_D32_SFLOAT_S8_UINT, 1.0f, 0};
+    state.depthTest = false;
+    state.depthCompare = VK_COMPARE_OP_ALWAYS;
+    state.stencilTest = true;
+    state.stencilFront = stencil;
+    state.stencilBack = stencil;
+    state.renderExtent = {Width, Height};
+    state.topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
+    state.viewport = {0, static_cast<float>(Height), static_cast<float>(Width), -static_cast<float>(Height), 0, 1};
+    state.negativeOneToOne = false;
+    state.scissor = {{0, 0}, {Width, Height}};
+    state.cullMode = VK_CULL_MODE_NONE;
+    state.frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
+    state.blend.colorWriteMask = 15;
+    state.blends = {state.blend};
+    state.blendConstants = {};
+    device.Draw(state, AgcDriver::Pm4::DrawParameters{0, 3u, 0, 1u, 0, false}, stages);
+    device.WaitIdle();
+}
+
+std::uint32_t Expected(std::uint32_t op, std::uint32_t stored, std::uint32_t value, std::uint32_t writeMask) {
+    const auto result = op == 10u ? stored & value : op == 11u ? stored | value : op == 12u ? stored ^ value : ~(stored ^ value);
+    return ((stored & ~writeMask) | (result & writeMask)) & 0xffu;
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        const auto shaders = Compile(*device);
+        const auto replace = [](std::uint32_t value) { return VkStencilOpState{VK_STENCIL_OP_REPLACE, VK_STENCIL_OP_REPLACE, VK_STENCIL_OP_REPLACE, VK_COMPARE_OP_ALWAYS, 0xffu, 0xffu, value}; };
+        const auto equal = [](std::uint32_t value) { return VkStencilOpState{VK_STENCIL_OP_KEEP, VK_STENCIL_OP_KEEP, VK_STENCIL_OP_KEEP, VK_COMPARE_OP_EQUAL, 0xffu, 0u, value}; };
+        std::size_t checked = 0;
+        for (const auto stored : {0xa5u, 0x3cu}) {
+            for (const auto op : {10u, 11u, 12u, 15u}) {
+                for (const auto [writeMask, value] : {std::pair{0xffu, 0x3cu}, std::pair{0x0fu, 0x96u}, std::pair{0xf6u, 0xffu}}) {
+                    for (const auto [ops, compare] : {std::pair{op << 4u, 7u}, std::pair{op, 0u}}) {
+                        const auto refMask = 0xff00u | (writeMask << 16u) | (value << 24u);
+                        const auto face = AgcDriver::Graphics::DecodeState(StencilQueue(ops, refMask, 1u | (compare << 8u))).stencilFront;
+                        const auto expected = Expected(op, stored, value, writeMask);
+                        const auto name = "stencil operation " + std::to_string(op) + " in DB_STENCIL_CONTROL " + std::to_string(ops) + " with DB_STENCILREFMASK " + std::to_string(refMask) + " on stored value " + std::to_string(stored);
+                        Draw(*device, shaders, replace(stored));
+                        Draw(*device, shaders, face);
+                        Draw(*device, shaders, equal(expected));
+                        for (std::uint32_t pixel = 0; pixel < Width * Height; ++pixel) {
+                            Require(Pixels[pixel * 4u] == std::byte{255}, name + ": pixel " + std::to_string(pixel) + " does not hold the expected stencil value " + std::to_string(expected));
+                        }
+                        Draw(*device, shaders, equal(expected ^ 0x80u));
+                        Require(std::ranges::all_of(std::span(Pixels).first(4), [](std::byte value) { return value == Kept; }), name + ": the stencil value also equals " + std::to_string(expected ^ 0x80u));
+                        ++checked;
+                    }
+                }
+            }
+        }
+        std::printf("stencil logic operation tests passed: %zu states\n", checked);
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index 3d7bbfd474..920d8641e1 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -152,6 +152,7 @@
 - [DB_SHADER_CONTROL.CONSERVATIVE_Z_EXPORT](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver) becomes `DepthLess`/`DepthGreater`. For a pixel shader that breaks the promise, the host driver decides whether its interpolated Z is depth-tested before shading; what the console does then was not measured.
 - [DB_SHADER_CONTROL.STENCIL_TEST_VAL_EXPORT_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) becomes `FragStencilRefEXT` when available, taken from the second MRTZ channel of the 32_GR and 32_ABGR formats as Mesa's AMD drivers write it ([`emit_ps_mrtz_export`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/3e32b0e1f132231b7a972c1b0b5b06c7e16cf8b9/src/amd/common/nir/ac_nir_lower_ps_late.c#L194)); the console was not measured. The host value is the test value of both faces and what `REPLACE_TEST` writes, so a stencil operation that writes all ones or the operation value throws with it, as do a stencil clear draw and the UINT16_ABGR layout. A device without the extension uses the bounded replay described above. On such a device a draw first drops the export when the reference cannot change its result (`StencilReferenceUnused`: no stencil test or attachment, or on both faces a compare that ignores it and no reachable `REPLACE` through a non-zero write mask), and its pixel shader is then compiled at its first draw, not when its ABI is resolved. A device with the extension keeps the export, so each such shader keeps one pixel variant.
 - [DB_SHADER_CONTROL.STENCIL_OP_VAL_EXPORT_ENABLE](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - the pixel shader supplies the stencil operation source value per pixel, in place of `DB_STENCILREFMASK.STENCILOPVAL`. Only the operations that take that value read it: `REPLACE_OP` and the clamped and wrapping add and subtract (codes 4, 5, 6, 8 and 9), and the logic operations, which throw already ([AMD_stencil_operation_extended](https://registry.khronos.org/OpenGL/extensions/AMD/AMD_stencil_operation_extended.txt), [AMD_shader_stencil_value_export](https://registry.khronos.org/OpenGL/extensions/AMD/AMD_shader_stencil_value_export.txt)). Vulkan has no per-pixel operation value. Without `STENCIL_TEST_VAL_EXPORT_ENABLE`, a `REPLACE_OP` reachable through a non-zero write mask (`StencilOperationValueReplaces`) becomes `REPLACE` with the exported value as `FragStencilRefEXT`, or the bounded replay without the extension; this requires a compare that ignores the test value and no `ONES` or `REPLACE_TEST` on either face, and early tests throw. The value is taken from bits 8-15 of the second MRTZ channel: the PPSA27836 pixel shader that uses it shifts it left by 8 before `exp mrtz` (`v_lshlrev_b32 v0, 8, v0`), which is the only evidence for the layout. The add and subtract operations, and `REPLACE_OP` with a test value export, throw. With the 32_GR or 32_ABGR Z format and no such operation, or without a stencil test, the export cannot change the result and is ignored. Other Z formats throw. The console was not measured.
+- [Stencil logic operations](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - `STENCIL_NAND` and `STENCIL_NOR` (`DB_STENCIL_CONTROL` 13 and 14, [PS5_Mesa](https://github.com/mihawk-99/PS5_Mesa/blob/0b2d6d1a61d9bbf89cf8beb88a696144f67c61f8/src/amd/registers/gfx103.json#L581-L598)) throw. AND, OR, XOR and XNOR (10, 11, 12 and 15) apply `STENCILOPVAL` as [AMD_stencil_operation_extended](https://registry.khronos.org/OpenGL/extensions/AMD/AMD_stencil_operation_extended.txt) defines them, not measured on the console, drawn as `ZERO`, `REPLACE` with those reference bits set, or `INVERT` under the write mask narrowed to the bits they change. A face whose other operations write other bits throws, as does OR on a compared test value bit it would set, or with a stencil test value export.
 - [DB_SHADER_CONTROL.DEPTH_BEFORE_SHADER](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp) (libSceAgcDriver) becomes `EarlyFragmentTests`, and so does `Z_ORDER` `EARLY_Z_THEN_LATE_Z` or `EARLY_Z_THEN_RE_Z` without kill, Z export, mask export or stencil export; with alpha-to-coverage the tests stay late. The meaning of the bit and of `Z_ORDER` 3 follows Mesa (`src/amd/registers/gfx10.json`; RADV sets the bit for `early_fragment_tests` in `src/amd/vulkan/radv_shader.c`). What the console does with `DEPTH_BEFORE_SHADER` and a Z export, a mask export, a stencil export or alpha-to-coverage together was not measured.
 - [PA_SC_CONSERVATIVE_RASTERIZATION_CNTL](../../../core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp) (libSceAgcDriver) - 0x6001 uses Vulkan overestimation on devices that add at most 1/256 pixel and keep degenerate triangles; the console's uncertainty region and degenerate handling are unmeasured. A value with `OVER_RAST_ENABLE` and `UNDER_RAST_ENABLE` clear is decoded as disabled even when `UNCERTAINTY_REGION_MODE` or the `OUTER_`/`INNER_UNCERTAINTY_EDGERULE_OVERRIDE` bits (19:16) are set, as PPSA01474 writes 0xe6000; that these fields have no effect without over- or underestimation is assumed from their names, not measured. With `PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES` = 0 the `PERSP_CENTROID` and `LINEAR_CENTROID` inputs get the pixel-centre barycentrics, as without conservative rasterization ([shader debt](shader.md)): the one rasterized sample sits at the pixel centre, so every centroid the rasterizer could pick for an overestimated pixel is that point; that it does not move the centroid towards the primitive when the sample is uncovered is inferred, not measured. With more rasterized samples, and when a single-sample draw is raised to a multisampled color target, centroid inputs throw.
 - [Descriptor pool chain](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp) (libSceAgcDriver) - each pool holds two storage buffer descriptors more than a set can take, as a workaround: RADV (Mesa 26.0 and later) lets a `FREE_DESCRIPTOR_SET` pool place a set up to 32 bytes past the pool's buffer ([`util_vma_heap_init`](https://gitlab.freedesktop.org/mesa/mesa/-/blob/main/src/amd/vulkan/radv_descriptor_pool.c) is given `bo_size + RADV_POOL_HEAP_OFFSET` as a size), and with a page-multiple pool size those bytes are an unmapped page

From 7753a92d3249b935d403d01a2639760e6dc4900e Mon Sep 17 00:00:00 2001
From: Filip Michalski <filip.michalski92@gmail.com>
Date: Wed, 21 Oct 2026 14:27:12 +0200
Subject: [PATCH 057/218] perf(shader): avoid scanning the final IR operand use

---
 .../src/IrValue.cpp                           |  8 +++++---
 .../tests/UseRewrite.cpp                      | 20 ++++++++++++++++++-
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp b/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp
index a7cc1db50d..6d1e69deb7 100644
--- a/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/src/IrValue.cpp
@@ -39,9 +39,11 @@ void IrValue::ReplaceArgument(std::size_t index, IrValue* argument) {
     }
     IrValue* previous = arguments[index];
     if (previous != nullptr) {
-        const auto operandIt = std::find_if(previous->operandUses.begin(), previous->operandUses.end(), [this, index](const IrUse& use) {
-            return use.user == this && use.operand == index;
-        });
+        const auto operandIt = !previous->operandUses.empty() && previous->operandUses.back() == IrUse{this, index}
+            ? previous->operandUses.end() - 1
+            : std::find_if(previous->operandUses.begin(), previous->operandUses.end(), [this, index](const IrUse& use) {
+                return use.user == this && use.operand == index;
+            });
         if (operandIt != previous->operandUses.end()) {
             previous->operandUses.erase(operandIt);
         }
diff --git a/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp b/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp
index 0849790845..f5a711b969 100644
--- a/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp
+++ b/core/shader/recompiler/IntermediateRepresentation/tests/UseRewrite.cpp
@@ -101,6 +101,23 @@ void CheckSimpleReplacement() {
     Require(source->Opcode() == IrOpcode::IAdd32 && source->Parent() == &graph.block);
 }
 
+void CheckTailArgumentRemoval() {
+    Graph graph(4);
+    auto* source = graph.Value(0);
+    auto* first = graph.Value(1);
+    auto* last = graph.Value(2);
+    first->AddArgument(source);
+    last->AddArgument(source);
+    last->AddArgument(source);
+    last->ReplaceArgument(0, nullptr);
+    Require(source->OperandUses() == std::vector<IrUse>({{first, 0}, {last, 1}}));
+    last->ReplaceArgument(1, graph.Value(3));
+    Require(source->OperandUses() == std::vector<IrUse>({{first, 0}}));
+    Require(graph.Value(3)->OperandUses() == std::vector<IrUse>({{last, 1}}));
+    first->Invalidate();
+    Require(!source->HasUses() && first->Argument(0) == nullptr);
+}
+
 void CheckSelfAndEmpty() {
     Graph graph(3);
     graph.Value(2)->AddArgument(graph.Value(0));
@@ -223,6 +240,7 @@ int main() {
     try {
         const std::pair<const char*, void (*)()> cases[] = {
             {"ordered duplicate operands", CheckSimpleReplacement},
+            {"tail argument removal", CheckTailArgumentRemoval},
             {"self and empty replacement", CheckSelfAndEmpty},
             {"phi and identity rewriting", CheckPhiAndIdentity},
             {"allocation failure integrity", CheckAllocationFailure},
@@ -234,7 +252,7 @@ int main() {
             current = name;
             test();
         }
-        std::puts("7 IR rewrite suites passed; 2000 differential use graphs and 48000 mutation comparisons");
+        std::puts("8 IR rewrite suites passed; 2000 differential use graphs and 48000 mutation comparisons");
         return 0;
     } catch (const std::exception& error) {
         failureAfter = -1;

From 09622d3f5c2dd264d0d1c86ab9b70e5672a0490e Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:01:59 +0000
Subject: [PATCH 058/218] fix(relinker): reject a second PT_DYNAMIC segment

The PT_DYNAMIC loop used the first header and ignored any later one, so
the Linux target converted an input with two PT_DYNAMIC headers. A
second PT_DYNAMIC now fails with "Multiple PT_DYNAMIC segments" at its
file offset on every target.
---
 core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp | 3 ++-
 core/relinker/relinker/tests/test_dynamic_segment.py     | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
index 77044446d2..7e0c46265d 100644
--- a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
+++ b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
@@ -103,10 +103,11 @@ RelinkResult RelinkerPipeline::Relink() {
     for (const auto& ph : programHeaders) {
         if (ph.Type != PT_DYNAMIC)
             continue;
+        if (hasDynamicSegment)
+            throw RelinkerException("Multiple PT_DYNAMIC segments", ph.Offset);
 
         hasDynamicSegment = true;
         dynTags = elfReader->ReadDynamicTags(ph);
-        break;
     }
 
     if (!hasDynamicSegment)
diff --git a/core/relinker/relinker/tests/test_dynamic_segment.py b/core/relinker/relinker/tests/test_dynamic_segment.py
index 8822738f38..8045014d4e 100644
--- a/core/relinker/relinker/tests/test_dynamic_segment.py
+++ b/core/relinker/relinker/tests/test_dynamic_segment.py
@@ -22,10 +22,10 @@ def main():
     with tempfile.TemporaryDirectory(prefix="anyps5-dynamic-segment-") as directory:
         work = Path(directory)
 
-        def convert(name, image, error=None):
+        def convert(name, image, error=None, modes=([], ["--windows"])):
             source = work / (name + ".elf")
             source.write_bytes(image)
-            for mode in ([], ["--windows"]):
+            for mode in modes:
                 output = work / (name + (".exe" if mode else ".out"))
                 result = subprocess.run([str(relinker), "--skip-sce-module", *mode, str(source), str(output)],
                                         capture_output=True, text=True, timeout=20)
@@ -72,6 +72,10 @@ def main():
         struct.pack_into("<QQ", empty, 120 + 32, 0, 0)
         convert("empty", empty, "Unterminated dynamic segment")
 
+        duplicate = fixture()
+        duplicate[64 + 2 * 56:64 + 3 * 56] = duplicate[120:176]
+        convert("duplicate", duplicate, "Multiple PT_DYNAMIC segments", ([], ["--windows"], ["--macos"]))
+
     if failures:
         raise AssertionError(failures)
     print("Dynamic segment tests passed")

From b10424a47bf3efe4a07972d031879579999a687e Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:43:37 +0000
Subject: [PATCH 059/218] fix(relinker): require the Linux entry, relocation
 offsets and DT_PLTGOT in PT_LOAD memory

The Windows and macOS patchers reject an entry point outside executable
PT_LOAD memory and a relocation offset or DT_PLTGOT outside PT_LOAD memory
through WindowsLoadImage::GetRva. The Linux patcher copied these values
unchecked and reported success; with a bad entry or relocation offset the
output crashed with SIGSEGV at load.

LinuxElfPatcher::Patch now requires e_entry in an executable load and every
non-NONE RELA and JMPREL r_offset and DT_PLTGOT to fit inside one PT_LOAD's
MemorySize, in the fixed-base and --lazy-binding paths. A relocation needs
the bytes ld.so writes: 4 for PC32 and 32, the output symbol's st_size (at
least 1) for COPY, and 8 otherwise. DT_PLTGOT needs 8 bytes with eager
binding and 24 with --lazy-binding, where ld.so writes GOT[1] and GOT[2].
Two test fixtures that set e_entry to a file offset outside their only
PT_LOAD now use the matching virtual address.
---
 core/relinker/CMakeLists.txt                  |   2 +
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp  |  34 ++++++
 .../tests/test_linux_eh_frame_header.py       |   2 +-
 .../tests/test_linux_load_alignment.py        |   2 +-
 .../relinker/tests/test_linux_load_bounds.py  | 114 ++++++++++++++++++
 5 files changed, 152 insertions(+), 2 deletions(-)
 create mode 100644 core/relinker/relinker/tests/test_linux_load_bounds.py

diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index 5c4b89dfa8..7c091a9c5a 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -527,6 +527,8 @@ if(BUILD_TESTING)
         set_tests_properties(macos_tls_alu PROPERTIES TIMEOUT 60)
         add_test(NAME linux_load_alignment COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_load_alignment.py $<TARGET_FILE:relinker>)
+        add_test(NAME linux_load_bounds COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_load_bounds.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_eh_frame_header COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_eh_frame_header.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_dynamic_strings COMMAND ${Python3_EXECUTABLE}
diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 7453d82aca..883abd7e46 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -22,6 +22,8 @@ namespace Elfpatcher::Linux {
 namespace {
 
 constexpr std::uint64_t kLinuxUserAddressEnd = 0x800000000000;
+constexpr std::uint64_t kLazyPltGotBytes = 24;
+constexpr std::uint64_t kPltGotEntryBytes = 8;
 
 std::string Hex(const std::uint64_t value) {
     std::ostringstream text;
@@ -103,6 +105,31 @@ void RequireFileRange(const std::vector<std::uint8_t>& buf, const Domain::Progra
         throw Domain::RelinkerException("PT_LOAD at " + Hex(load.MappedAddress) + " has file bytes outside the input");
 }
 
+void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std::uint64_t address, const std::uint64_t size, const std::uint32_t flags, const std::string& what) {
+    for (const auto& header : headers)
+        if (header.Type == PT_LOAD && (header.Flags & flags) == flags && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
+            return;
+    const auto range = size > 1 ? " (" + std::to_string(size) + " bytes) does not fit inside " : std::string(" is not inside ");
+    throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
+}
+
+std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry, const std::vector<std::uint8_t>& symbols) {
+    const auto info = Io::ReadU64(relocations, entry + 8);
+    switch (static_cast<std::uint32_t>(info)) {
+    case R_X86_64_PC32:
+    case R_X86_64_32:
+        return 4;
+    case R_X86_64_COPY: {
+        const auto symbol = info >> 32;
+        if (symbol >= symbols.size() / kSymEntrySize)
+            throw Domain::RelinkerException("COPY relocation symbol index " + std::to_string(symbol) + " is outside the dynamic symbol table");
+        return std::max<std::uint64_t>(Io::ReadU64(symbols, static_cast<std::size_t>(symbol * kSymEntrySize + 16)), 1);
+    }
+    default:
+        return 8;
+    }
+}
+
 void SeparateSharedLoadPages(std::vector<std::uint8_t>& buf, std::vector<Domain::ProgramHeader>& headers) {
     std::vector<std::size_t> loads;
     for (std::size_t index = 0; index < headers.size(); ++index) {
@@ -358,6 +385,13 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
         throw Domain::RelinkerException("--trace-imports requires libc.prx among the libraries");
     if (_fixedBase)
         RequireOnlyDependencies(dynSection.DynamicSegmentData);
+    RequireLoaded(originalHeaders, Io::ReadU64(sourceElf, kEhdrEntryOffset), 1, PF_X, "e_entry");
+    for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
+        for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
+            if (static_cast<std::uint32_t>(Io::ReadU64(*relocationTable, entry + 8)) != R_X86_64_NONE)
+                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry, dynSection.DynSymData), 0, name);
+    if (!dynSection.RelaPltData.empty())
+        RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
     const std::uint64_t base = _fixedBase.value_or(0);
     const auto address = [this, base](const std::uint64_t vaddr) {
diff --git a/core/relinker/relinker/tests/test_linux_eh_frame_header.py b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
index a80a1eb1ed..88d77abe53 100644
--- a/core/relinker/relinker/tests/test_linux_eh_frame_header.py
+++ b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
@@ -18,7 +18,7 @@ def fixture(header_count, with_frame=True):
     image = bytearray(0x8000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16,
-                     3, 62, 1, 0x4000, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
+                     3, 62, 1, 0, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
     image[0x4000:0x4006] = b"\xb8\x2a\x00\x00\x00\xc3"
     tags = [(5, 0x600), (10, 1), (6, 0x620), (11, 24), (7, 0x700), (8, 0), (9, 24), (0, 0)]
     struct.pack_into("<IIQQQQQQ", image, 64,
diff --git a/core/relinker/relinker/tests/test_linux_load_alignment.py b/core/relinker/relinker/tests/test_linux_load_alignment.py
index 51008e9392..0a549b05ec 100644
--- a/core/relinker/relinker/tests/test_linux_load_alignment.py
+++ b/core/relinker/relinker/tests/test_linux_load_alignment.py
@@ -14,7 +14,7 @@ def fixture():
     image = bytearray(0x8000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16,
-                     3, 62, 1, 0x4000, 64, 0, 0, 64, 56, 6, 64, 0, 0)
+                     3, 62, 1, 0, 64, 0, 0, 64, 56, 6, 64, 0, 0)
     image[0x4000:0x4006] = b"\xb8\x2a\x00\x00\x00\xc3"
     tags = [(5, 0x600), (10, 1), (6, 0x620), (11, 24), (7, 0x700), (8, 0), (9, 24), (0, 0)]
     struct.pack_into("<IIQQQQQQ", image, 64,
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
new file mode 100644
index 0000000000..d75d394cdf
--- /dev/null
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -0,0 +1,114 @@
+"""Check that a Linux relink rejects an entry point, relocation offset or DT_PLTGOT outside PT_LOAD memory."""
+
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from test_jmprel_table_bounds import fixture
+
+PT_LOAD = 1
+PT_SCE_RELRO = 0x61000010
+PF_W = 2
+PF_R = 4
+R_X86_64_PC32 = 2
+R_X86_64_COPY = 5
+R_X86_64_32 = 10
+E_ENTRY = 24
+SPARE_HEADER = 64 + 3 * 56
+PLTGOT_VALUE = 0x400 + 9 * 16 + 8
+SYMBOL_SIZE = 0x620 + 24 + 16
+OUTSIDE = 0x2000
+
+
+def with_bss(image):
+    struct.pack_into("<IIQQQQQQ", image, SPARE_HEADER, PT_LOAD, PF_R | PF_W, 0x1000, 0x1000, 0x1000, 0, 0x1000, 0x1000)
+    return image
+
+
+def with_relro(image):
+    struct.pack_into("<IIQQQQQQ", image, SPARE_HEADER, PT_SCE_RELRO, PF_R, 0, 0x1000, 0x1000, 0, 0x1000, 1)
+    return with_pltgot(image, 0x1800)
+
+
+def with_entry(image, entry):
+    struct.pack_into("<Q", image, E_ENTRY, entry)
+    return image
+
+
+def with_pltgot(image, value):
+    struct.pack_into("<Q", image, PLTGOT_VALUE, value)
+    return image
+
+
+def with_symbol_size(image, size):
+    struct.pack_into("<Q", image, SYMBOL_SIZE, size)
+    return image
+
+
+def relink(relinker, work, name, image, options, error):
+    source = work / (name + ".elf")
+    output = work / (name + ".out")
+    source.write_bytes(image)
+    result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
+                            capture_output=True, text=True, timeout=20)
+    if error is None:
+        assert result.returncode == 0 and output.exists(), (name, options, result.returncode, result.stdout, result.stderr)
+        output.unlink()
+    else:
+        assert result.returncode == 2 and error in result.stderr and not output.exists(), (
+            name, options, result.returncode, result.stdout, result.stderr)
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    cases = [
+        ("plt-valid", fixture(linux=True), None),
+        ("rela-valid", fixture(linux=True, data_relocations=True), None),
+        ("rela-in-bss", with_bss(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
+        ("none-outside", fixture(linux=True, data_relocations=True, relocation_type=0, symbol_index=0, target=OUTSIDE), None),
+        ("rela-in-relro", with_relro(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
+        ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
+        ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
+        ("abs32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFC), None),
+        ("copy-load-tail", with_symbol_size(
+            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFC), 4), None),
+        ("copy-load-last-byte", with_symbol_size(
+            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFF), 4), None),
+        ("entry-outside", with_entry(fixture(linux=True), 0x7FFFF000),
+         "e_entry 0x7ffff000 is not inside an executable PT_LOAD segment"),
+        ("entry-not-executable", with_entry(with_bss(fixture(linux=True)), 0x1000),
+         "e_entry 0x1000 is not inside an executable PT_LOAD segment"),
+        ("rela-outside", fixture(linux=True, data_relocations=True, target=OUTSIDE),
+         "RELA r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
+        ("rela-past-load-end", fixture(linux=True, data_relocations=True, target=0xFFC),
+         "RELA r_offset 0xffc (8 bytes) does not fit inside a PT_LOAD segment"),
+        ("abs32-past-load-end", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFE),
+         "RELA r_offset 0xffe (4 bytes) does not fit inside a PT_LOAD segment"),
+        ("copy-outside", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=OUTSIDE),
+         "RELA r_offset 0x2000 is not inside a PT_LOAD segment"),
+        ("jmprel-outside", fixture(linux=True, target=OUTSIDE),
+         "JMPREL r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
+    ]
+    with tempfile.TemporaryDirectory(prefix="anyps5-linux-load-bounds-") as directory:
+        work = Path(directory)
+        for name, image, error in cases:
+            for options in ([], ["--lazy-binding"]):
+                relink(relinker, work, name, image, options, error)
+        pltgot_cases = [
+            ("pltgot-outside", OUTSIDE, "DT_PLTGOT 0x2000 (8 bytes) does not fit inside a PT_LOAD segment",
+             "DT_PLTGOT 0x2000 (24 bytes) does not fit inside a PT_LOAD segment"),
+            ("pltgot-load-tail", 0xFF0, None, "DT_PLTGOT 0xff0 (24 bytes) does not fit inside a PT_LOAD segment"),
+            ("pltgot-lazy-fits", 0xFE8, None, None),
+        ]
+        for name, pltgot, eager_error, lazy_error in pltgot_cases:
+            image = with_pltgot(fixture(linux=True), pltgot)
+            relink(relinker, work, name, image, [], eager_error)
+            relink(relinker, work, name, image, ["--lazy-binding"], lazy_error)
+    print("Linux load bounds tests passed")
+
+
+if __name__ == "__main__":
+    main()

From 3f18aed2a5cc379230ceab9b5fa45c3325dc7645 Mon Sep 17 00:00:00 2001
From: JAB-dev <68183649+JAB-dev@users.noreply.github.com>
Date: Fri, 23 Oct 2026 23:54:03 +0200
Subject: [PATCH 060/218] fix(libSceNgs2): clamp the mastering gain to +-32 as
 the PS5 module does

The PS5 libSceNgs2.native (firmware 3.20 and 4.03) accepts every value of the mastering gain param 0x30000004 with return code 0, clamps each level to [-32, 32] (so +-inf gives +-32) and keeps NaN, which then gives NaN samples. Ours threw on NaN and inf and did not clamp. A NaN sample in a PCM_I16L render buffer now throws, since the PS5 conversion was only measured into float buffers.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .../libs/prx/libSceNgs2.native/src/Render.cpp |  1 +
 core/libs/prx/libSceNgs2.native/src/Voice.cpp |  6 +-
 .../libSceNgs2.native/tests/Ngs2Render.cpp    | 90 ++++++++++++++++++-
 docs/dev/debt/libSceNgs2.native.md            |  2 +-
 4 files changed, 92 insertions(+), 7 deletions(-)

diff --git a/core/libs/prx/libSceNgs2.native/src/Render.cpp b/core/libs/prx/libSceNgs2.native/src/Render.cpp
index fa764d375a..6a7b3a3780 100644
--- a/core/libs/prx/libSceNgs2.native/src/Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Render.cpp
@@ -297,6 +297,7 @@ static void WriteOutput(const Ngs2RenderBufferInfo& output, const std::vector<fl
     }
     auto* pcm = static_cast<std::int16_t*>(output.buffer);
     for (std::size_t i = 0; i < mix.size(); i++) {
+        if (std::isnan(mix[i])) throw std::runtime_error("NGS2: a NaN sample in a PCM_I16L render buffer is not implemented");
         pcm[i] = static_cast<std::int16_t>(std::min(std::lrint(std::clamp(mix[i], -1.0f, 1.0f) * 32768.0f), 32767L));
     }
 }
diff --git a/core/libs/prx/libSceNgs2.native/src/Voice.cpp b/core/libs/prx/libSceNgs2.native/src/Voice.cpp
index 8f9c3fabc4..2b8b3fbc9b 100644
--- a/core/libs/prx/libSceNgs2.native/src/Voice.cpp
+++ b/core/libs/prx/libSceNgs2.native/src/Voice.cpp
@@ -19,6 +19,7 @@ static constexpr std::uint8_t COMMAND_TYPE_INT = 3;
 static constexpr std::uint8_t COMMAND_TYPE_UINT = 4;
 static constexpr std::uint8_t COMMAND_TYPE_FLOAT_ARRAY = 0x11;
 static constexpr float MAX_MATRIX_LEVEL = 4.0f;
+static constexpr float MAX_MASTERING_GAIN = 32.0f;
 
 void Ngs2Voice::SetEvent(std::uint32_t eventId) {
     switch (eventId) {
@@ -375,9 +376,8 @@ static void ApplyParam(Ngs2Voice& voice, const Ngs2VoiceParamHeader& param) {
             }
             if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_GAIN) {
                 const auto& gain = ParamAs<Ngs2MasteringVoiceGainParam>(param);
-                if (!std::isfinite(gain.fbw_level) || !std::isfinite(gain.lfe_level)) APS5_INVALID_ARG_EX;
-                voice.fbwLevel = gain.fbw_level;
-                voice.lfeLevel = gain.lfe_level;
+                voice.fbwLevel = std::clamp(gain.fbw_level, -MAX_MASTERING_GAIN, MAX_MASTERING_GAIN);
+                voice.lfeLevel = std::clamp(gain.lfe_level, -MAX_MASTERING_GAIN, MAX_MASTERING_GAIN);
                 return;
             }
             if (param.id == SCE_NGS2_MASTERING_VOICE_PARAM_OUTPUT) {
diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
index c9f7cd7fcb..4c00de4180 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
@@ -872,9 +872,6 @@ static void TestMasteringGain() {
     Control(toQuad, SCE_NGS2_VOICE_PARAM_PORT_MATRIX, Ngs2VoicePortMatrixParam{{}, 0, 0});
     Patch(toQuad, quad);
     Event(toQuad, SCE_NGS2_VOICE_EVENT_PLAY);
-    bool rejected = false;
-    try { Control(stereo, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, NAN, 1.0f}); } catch (const std::exception&) { rejected = true; }
-    Require(rejected);
 
     std::vector<float> outStereo(Grain * 2, -1.0f);
     std::vector<float> outSurround(Grain * 6, -1.0f);
@@ -908,6 +905,90 @@ static void TestMasteringGain() {
     Require(sceNgs2SystemDestroy(loudSystem, nullptr) == SCE_NGS2_OK);
 }
 
+static void TestMasteringGainClampedLikePs5() {
+    const auto chain = [](std::uint32_t channels, std::uint32_t grains, uintptr_t& master) {
+        const auto system = CreateSystem();
+        master = Mastering(system, channels);
+        const std::vector<std::int16_t> pcm(Grain * grains, 16384);
+        const auto source = Sampler(system, pcm, 0);
+        const std::vector<float> levels(channels, 1.0f);
+        Control(source, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, channels, levels.data()});
+        Control(source, SCE_NGS2_VOICE_PARAM_PORT_MATRIX, Ngs2VoicePortMatrixParam{{}, 0, 0});
+        Patch(source, master);
+        Event(source, SCE_NGS2_VOICE_EVENT_PLAY);
+        return system;
+    };
+    const auto render = [](uintptr_t system, std::uint32_t channels) {
+        std::vector<float> out(Grain * channels, -1.0f);
+        const Ngs2RenderBufferInfo info{out.data(), out.size() * sizeof(float), SCE_NGS2_WAVEFORM_TYPE_PCM_F32L, channels};
+        Require(sceNgs2SystemRender(system, &info, 1) == SCE_NGS2_OK);
+        return out;
+    };
+    const auto expect = [](const std::vector<float>& out, std::uint32_t channels, float fbwOut, float lfeOut) {
+        for (std::uint32_t i = 0; i < Grain; i++) {
+            for (std::uint32_t channel = 0; channel < channels; channel++) {
+                const float level = channel == 3 && channels >= 6 ? lfeOut : fbwOut;
+                const float sample = out[i * channels + channel];
+                Require(std::isnan(level) ? std::isnan(sample) : sample == 0.5f * level);
+            }
+        }
+    };
+    const auto gain = [&](std::uint32_t channels, float fbw, float lfe, float fbwOut, float lfeOut) {
+        uintptr_t master = 0;
+        const auto system = chain(channels, 1, master);
+        Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, fbw, lfe});
+        expect(render(system, channels), channels, fbwOut, lfeOut);
+        Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+    };
+    const float inf = INFINITY;
+    for (const std::uint32_t channels : {6u, 8u}) {
+        gain(channels, 32.0f, 1.0f, 32.0f, 1.0f);
+        gain(channels, 33.0f, 1.0f, 32.0f, 1.0f);
+        gain(channels, 64.0f, 1.0f, 32.0f, 1.0f);
+        gain(channels, 1e30f, 1.0f, 32.0f, 1.0f);
+        gain(channels, inf, 1.0f, 32.0f, 1.0f);
+        gain(channels, -32.0f, 1.0f, -32.0f, 1.0f);
+        gain(channels, -33.0f, 1.0f, -32.0f, 1.0f);
+        gain(channels, -inf, 1.0f, -32.0f, 1.0f);
+        gain(channels, NAN, 1.0f, NAN, 1.0f);
+        gain(channels, 1.0f, 32.0f, 1.0f, 32.0f);
+        gain(channels, 1.0f, 33.0f, 1.0f, 32.0f);
+        gain(channels, 1.0f, 1e30f, 1.0f, 32.0f);
+        gain(channels, 1.0f, inf, 1.0f, 32.0f);
+        gain(channels, 1.0f, -33.0f, 1.0f, -32.0f);
+        gain(channels, 1.0f, -inf, 1.0f, -32.0f);
+        gain(channels, 1.0f, NAN, 1.0f, NAN);
+    }
+    gain(1, 0.5f, 2.0f, 0.5f, 0.5f);
+    gain(1, inf, NAN, 32.0f, 32.0f);
+    gain(2, -inf, 1e30f, -32.0f, -32.0f);
+    gain(2, 2.0f, 0.5f, 2.0f, 2.0f);
+
+    uintptr_t master = 0;
+    const auto system = chain(6, 4, master);
+    expect(render(system, 6), 6, 1.0f, 1.0f);
+    Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, 0.5f, 0.25f});
+    expect(render(system, 6), 6, 0.5f, 0.25f);
+    Event(master, SCE_NGS2_VOICE_EVENT_STOP_IMM);
+    Event(master, SCE_NGS2_VOICE_EVENT_PLAY);
+    expect(render(system, 6), 6, 0.5f, 0.25f);
+    Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_SETUP, Ngs2MasteringVoiceSetupParam{{}, 6, 0});
+    Event(master, SCE_NGS2_VOICE_EVENT_PLAY);
+    expect(render(system, 6), 6, 1.0f, 1.0f);
+    Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
+
+    const auto nanSystem = chain(1, 1, master);
+    Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, NAN, 1.0f});
+    bool threw = false;
+    try {
+        RenderI16(nanSystem);
+    } catch (const std::runtime_error&) {
+        threw = true;
+    }
+    Require(threw);
+    Require(sceNgs2SystemDestroy(nanSystem, nullptr) == SCE_NGS2_OK);
+}
+
 static uintptr_t RackVoice(uintptr_t rack, std::uint32_t index) {
     uintptr_t voice = 0;
     Require(sceNgs2RackGetVoiceHandle(rack, index, &voice) == SCE_NGS2_OK && voice != 0);
@@ -1590,6 +1671,9 @@ int main() {
     TestReverb();
     TestReverbSetup();
     TestSampleRate();
+
+    TestMasteringGainClampedLikePs5();
+
     TestSystemOptionFlags();
     TestUserData();
     TestPcmCallbackReset();
diff --git a/docs/dev/debt/libSceNgs2.native.md b/docs/dev/debt/libSceNgs2.native.md
index a49957e009..6233c551cc 100644
--- a/docs/dev/debt/libSceNgs2.native.md
+++ b/docs/dev/debt/libSceNgs2.native.md
@@ -14,7 +14,7 @@
 - [NGS2 submixer UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (control `0x20000004`) invokes the title's callback after input mixing on every playing grain, including silence. The 40-byte control and 48-byte process context follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/libraries/ngs2/ngs2_submixer.h). PPSA03747 installs a peak-meter callback; its code confirms the channel pointers, user data 0, channel count, grain size and sample-rate offsets and returns 0. Other user data words are preserved. Flags are assumed to be 1 after registration/restart and 0 thereafter, following UserFx2's first-process convention; this callback does not inspect them. Null handlers disable the effect, setup clears it, and nonzero callback results throw. These lifecycle and error semantics are unverified on console hardware.
 - [NGS2 voice callback after setup](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler or mixer setup clears the voice callback with the rest of the voice state. PPSA18216 registers a block-end callback for a streamed music voice, later sets the same voice up again for one-shot ATRAC9 blocks with user data 0, and registers the callback again before it streams again; its callback dereferences the block's user data, so it must not run for the one-shot blocks. A setup made from inside the voice's own callback clears that callback as well, so a callback that sets its voice up again and queues the next block runs once instead of for every block; PPSA18216 never sets a voice up from inside its callback, so that ordering is unverified. Unverified on console hardware.
 - [NGS2 ATRAC9 streaming](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) keeps waveform duration and skip counts across compressed input blocks. The shared `APPEND` flag (2), called `ONLY_DATA` in the compressed-data reference, ignores an ATRAC9 continuation block's sample, skip and repeat counts, following [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/bb98f26433fa9e711c219aac1711fe8ecba5bf3a/src/libs/ngs2.cpp); PPSA03747 confirms a 262044-byte initial buffer declaring 11310532 samples, followed by 16384-byte buffers with flags 3. Incomplete superframes are retained until more input arrives. Input-block completion callbacks allow refills; the final callback of a logical waveform waits for its buffered PCM to drain, preserving the existing complete-block repeat behaviour. This buffering, callback timing, decoded-byte accounting and starvation silence are unverified on hardware. A closed ATRAC9 stream ending before its declared samples throws; fragmented ATRAC9 waveforms with repeats are unsupported. PCM streaming retains its existing append validation and early-close behaviour.
-- [NGS2 mastering voice gain](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - the param id 0x30000004 is taken from PPSA22520 and the layout from [shadPS4](https://github.com/shadps4-emu/shadPS4)'s `OrbisNgs2MasteringVoiceGainParam`; no reference gives the units or range. The levels are assumed to be linear factors applied when the mastering voice is mixed into the render buffer, so the voice's own samples stay unscaled; the LFE level applies to channel 3 of 6- and 8-channel voices, assuming the L R C LFE order of the AudioOut2 entries above, and the full-band level to the rest. Negative levels are accepted, and a new setup resets both levels to 1
+- [NGS2 mastering voice gain](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a NaN sample in a PCM_I16L render buffer throws, because PS5 firmware 3.20 and 4.03 were measured only into float buffers, where a NaN gain gives NaN samples. Measured there: param 0x30000004 (id seen in PPSA22520) sets linear full-band and LFE factors on the mastering output, applied from the next render without a ramp; each is clamped to [-32, 32] with NaN kept, and every value returns 0. The LFE level acts on channel 3 of 6- and 8-channel voices and the full-band level on every other channel, 1- and 2-channel voices included; a mastering setup resets both to 1, and STOP_IMM plus PLAY keeps them
 - [NGS2 stereo mastering voice into a surround buffer](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - PPSA21402 renders a 2-channel mastering voice into a 6- or 8-channel render buffer, which the mixing stage rejected. The console's conversion is unknown: the left and right channels are assumed to go to the first two buffer channels (front left and right) and the remaining channels stay silent, with no centre, LFE or surround content. Any other channel count mismatch still throws
 - [NGS2 voices without a format](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler voice whose setup has no format (all zero) accepts an add of no waveform blocks without `APPEND`, which only applies `RESET` and the `CONTINUE` state, and matrix levels with no levels, which clear that matrix. PPSA36591 sets such a voice up, adds no blocks and sets no levels when a button is pressed at its title screen. Whether the console returns success or an error there is not measured; blocks with data, `APPEND` and an empty matrix on a voice with a format are still refused
 - [NGS2 silent waveform blocks](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native): flag `0x10` (named `SILENCE` here; no public reference names it) lets a waveform block declare samples without data. PPSA04867 adds one block with flags `0x11`, `data_size` 0 and `num_samples` 16385, then another with flags `0x11` and a fully specified 0x800-byte, 1024-sample mono block, which takes the ordinary path. A dataless block under the flag outputs `num_samples` frames of silence, reports them through `decoded_data_size`, and finishes like a complete block; a dataless block without the flag still throws as not fitting its data. The flag's real name, its interaction with ATRAC9 and repeats, and the console's `waveform_data` for silent blocks are unverified on hardware

From aaa33a3f3e32e4fea93567add4fd5836dc4b75e2 Mon Sep 17 00:00:00 2001
From: Danigamer05 <96824289+Danigamer05@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:42:06 +0200
Subject: [PATCH 061/218] fix(keyboard): preserve raw keys and ignore the Kana
 LED

---
 .../prx/libSceKeyboard/src/keyboard_impl.cpp  | 10 ++-
 .../prx/libSceKeyboard/tests/Keyboard.cpp     | 67 ++++++++++++++++++-
 docs/dev/debt/libSceKeyboard.md               |  2 +-
 3 files changed, 69 insertions(+), 10 deletions(-)

diff --git a/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp b/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
index 954040b147..ba9d9bfff8 100644
--- a/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
+++ b/core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp
@@ -175,17 +175,15 @@ int GetKey2Char(std::int32_t handle, std::int32_t arrange, std::uint32_t ledStat
     {
         std::lock_guard lock(keyboardMutex);
         if (!initialized) return KEYBOARD_ERROR_NOT_INITIALIZED;
+        if (keyCode < 4 || keyCode > 231) return KEYBOARD_ERROR_INVALID_ARG;
         if (handle != KEYBOARD_HANDLE || !opened) return KEYBOARD_ERROR_INVALID_HANDLE;
     }
     if (charData == nullptr) return KEYBOARD_ERROR_INVALID_ARG;
     if (arrange != KEYBOARD_ARRANGEMENT_101 && arrange != KEYBOARD_ARRANGEMENT_106) return KEYBOARD_ERROR_INVALID_ARG;
-    if (arrange == KEYBOARD_ARRANGEMENT_106 && (ledState & KEYBOARD_LED_KANA) != 0) {
-        NotImplemented_nid_no_patch(__func__);
-        return KEYBOARD_ERROR_INVALID_ARG;
-    }
     *charData = {};
-    charData->char_code = character(arrange == KEYBOARD_ARRANGEMENT_106, ledState, modifierKey, keyCode);
-    charData->processed = charData->char_code != 0;
+    const std::uint16_t converted = character(arrange == KEYBOARD_ARRANGEMENT_106, ledState, modifierKey, keyCode);
+    charData->char_code = converted != 0 ? converted : keyCode;
+    charData->processed = converted != 0;
     charData->length = charData->processed ? 1 : 0;
     return KEYBOARD_OK;
 }
diff --git a/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp b/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
index 0307b994df..1b063419a0 100644
--- a/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
+++ b/core/libs/prx/libSceKeyboard/tests/Keyboard.cpp
@@ -4,7 +4,11 @@
 #include "SDL_events.h"
 #include "SDL_keyboard.h"
 
+#include <cstdio>
 #include <cstdlib>
+#include <cstring>
+#include <initializer_list>
+#include <source_location>
 #include <stdexcept>
 
 extern "C" {
@@ -19,7 +23,11 @@ int APS5_VABI sceKeyboardConnectPort(void);
 int APS5_VABI sceKeyboardDisconnectAll(void);
 }
 
-static void Require(bool value) { if (!value) std::abort(); }
+static void Require(bool value, std::source_location location = std::source_location::current()) {
+    if (value) return;
+    std::fprintf(stderr, "%s:%u: keyboard assertion failed\n", location.file_name(), location.line());
+    std::abort();
+}
 
 static SDL_Event KeyEvent(Uint32 type, SDL_Scancode scancode, Uint16 mod = 0, Uint8 repeat = 0) {
     SDL_Event event{};
@@ -34,14 +42,63 @@ static SDL_Event KeyEvent(Uint32 type, SDL_Scancode scancode, Uint16 mod = 0, Ui
 static std::uint16_t Char(std::uint32_t led, std::uint32_t modifierKey, std::uint16_t keyCode, std::int32_t arrange = KEYBOARD_ARRANGEMENT_101) {
     KeyboardCharData data{};
     Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, led, modifierKey, keyCode, &data) == KEYBOARD_OK);
-    Require(data.processed == (data.char_code != 0) && data.length == (data.processed ? 1 : 0));
-    return data.char_code;
+    Require(data.processed ? data.char_code != 0 : data.char_code == keyCode);
+    Require(data.length == (data.processed ? 1 : 0));
+    return data.processed ? data.char_code : 0;
 }
 
 static std::uint16_t Jis(std::uint32_t modifierKey, std::uint16_t keyCode, std::uint32_t led = 0) {
     return Char(led, modifierKey, keyCode, KEYBOARD_ARRANGEMENT_106);
 }
 
+static void CheckInvalidKeys(bool opened) {
+    constexpr std::uint16_t invalidKeys[] = {0, 1, 2, 3, 232, 255, 256, 65535};
+    for (const auto key : invalidKeys) {
+        for (const auto handle : {KEYBOARD_HANDLE, 42}) {
+            KeyboardCharData data;
+            std::memset(&data, 0xa5, sizeof(data));
+            unsigned char before[sizeof(data)];
+            std::memcpy(before, &data, sizeof(data));
+            Require(sceKeyboardGetKey2Char(handle, KEYBOARD_ARRANGEMENT_101, 0, 0, key, &data) == KEYBOARD_ERROR_INVALID_ARG);
+            Require(std::memcmp(&data, before, sizeof(data)) == 0);
+            Require(sceKeyboardGetKey2Char(handle, KEYBOARD_ARRANGEMENT_106, KEYBOARD_LED_KANA, 0, key, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
+        }
+    }
+    for (const auto key : {std::uint16_t{4}, std::uint16_t{231}}) {
+        KeyboardCharData data{};
+        const auto expected = opened ? KEYBOARD_OK : KEYBOARD_ERROR_INVALID_HANDLE;
+        Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, KEYBOARD_ARRANGEMENT_101, 0, 0, key, &data) == expected);
+    }
+}
+
+static void CheckUnconvertedKeys() {
+    constexpr std::uint16_t unconvertedKeys[] = {0x29, 0x39, 0x3a, 0x4f, 0x59, 0x88, 0xe0, 0xe7};
+    for (const auto arrange : {KEYBOARD_ARRANGEMENT_101, KEYBOARD_ARRANGEMENT_106}) {
+        for (const auto key : unconvertedKeys) {
+            KeyboardCharData data{};
+            Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, 0, 0, key, &data) == KEYBOARD_OK);
+            Require(!data.processed && data.char_code == key);
+        }
+    }
+}
+
+static void CheckKanaLed() {
+    for (const auto arrange : {KEYBOARD_ARRANGEMENT_101, KEYBOARD_ARRANGEMENT_106}) {
+        for (const auto modifier : {std::uint8_t{0}, std::uint8_t{KEYBOARD_MOD_LEFT_SHIFT}, std::uint8_t{KEYBOARD_MOD_RIGHT_SHIFT}}) {
+            for (const auto led : {std::uint8_t{0}, std::uint8_t{KEYBOARD_LED_NUM_LOCK | KEYBOARD_LED_CAPS_LOCK}}) {
+                for (std::uint16_t key = 4; key <= 231; ++key) {
+                    KeyboardCharData withoutKana{};
+                    KeyboardCharData withKana{};
+                    Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, led, modifier, key, &withoutKana) == KEYBOARD_OK);
+                    Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, arrange, led | KEYBOARD_LED_KANA, modifier, key, &withKana) == KEYBOARD_OK);
+                    Require(withKana.processed == withoutKana.processed);
+                    Require(withKana.length == withoutKana.length && withKana.char_code == withoutKana.char_code);
+                }
+            }
+        }
+    }
+}
+
 int main() {
     KeyboardData data[16]{};
     KeyboardCharData charData{};
@@ -50,11 +107,15 @@ int main() {
     Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_NOT_INITIALIZED);
     Require(sceKeyboardInit() == KEYBOARD_OK);
     Require(sceKeyboardInit() == KEYBOARD_OK);
+    CheckInvalidKeys(false);
     Require(sceKeyboardOpen(1, 0, 1, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardOpen(1, 1, 0, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
     Require(sceKeyboardGetKey2Char(KEYBOARD_HANDLE, KEYBOARD_ARRANGEMENT_101, 0, 0, 0x04, &charData) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_HANDLE);
+    CheckInvalidKeys(true);
+    CheckUnconvertedKeys();
+    CheckKanaLed();
     Require(sceKeyboardOpen(1, 0, 0, nullptr) == KEYBOARD_ERROR_ALREADY_OPENED);
     Require(sceKeyboardGetConnection(42, &connected) == KEYBOARD_ERROR_INVALID_HANDLE);
     Require(sceKeyboardGetConnection(KEYBOARD_HANDLE, nullptr) == KEYBOARD_ERROR_INVALID_ARG);
diff --git a/docs/dev/debt/libSceKeyboard.md b/docs/dev/debt/libSceKeyboard.md
index ba3dcb499f..df0713a7ed 100644
--- a/docs/dev/debt/libSceKeyboard.md
+++ b/docs/dev/debt/libSceKeyboard.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): the original validates HID usages 4 through 231 before the handle and preserves unconverted HID usages in the output with `processed == 0`. The host instead accepts out-of-range usages and writes zero for unconverted keys. The original ignores the Kana LED, while the host throws for it. This partially implemented function contains `NotImplemented_nid_no_patch(__func__)`; its body is preserved under the requested restriction. One title (PPSA15246) disassembled for this entry calls it once with an output buffer cleared to 24 bytes, uses a character only when the result is 0 and the first output byte is nonzero, and then reads the 16-bit value at offset 8, which agrees with `processed` and `char_code` as laid out here. Which other output fields it reads and what its other arguments mean are not shown.
+- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): initialization, output length and reserved bytes remain unverified on a console; unconverted keys retain the host's length of 0. One title (PPSA15246) disassembled for this entry checks the first output byte and reads the 16-bit value at offset 8. Which other output fields it reads and what its other arguments mean are not shown.
 
 ### Unknown function info
 

From 38582fca52d17442bf194316b4f317ae569726ec Mon Sep 17 00:00:00 2001
From: Danigamer05 <96824289+Danigamer05@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:59:36 +0200
Subject: [PATCH 062/218] fix(pngdec): honor the 16-bit input attribute

---
 core/libs/prx/libScePngDec/Export.cpp |   5 +-
 core/libs/tests/GuestPngDec.cpp       | 114 ++++++++++++++++++++++++--
 docs/dev/debt/libScePngDec.md         |   2 +-
 3 files changed, 110 insertions(+), 11 deletions(-)

diff --git a/core/libs/prx/libScePngDec/Export.cpp b/core/libs/prx/libScePngDec/Export.cpp
index 8ff5827de0..84f183b51e 100644
--- a/core/libs/prx/libScePngDec/Export.cpp
+++ b/core/libs/prx/libScePngDec/Export.cpp
@@ -144,10 +144,6 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
     const std::optional<Decoder::Png::Header> header = Decoder::Png::ParseHeader(png);
     if (!header) return SCE_PNG_DEC_ERROR_INVALID_DATA;
     if (imageInfo) fillImageInfo(*header, imageInfo);
-    if (header->bitDepth == 16 && context->attribute == ATTRIBUTE_BIT_DEPTH_16) {
-        throw std::runtime_error("scePngDecDecode: 16-bit output is not implemented");
-    }
-
     const std::uint64_t rowSize = static_cast<std::uint64_t>(header->width) * BYTES_PER_PIXEL;
     const std::uint64_t pitch = param->image_pitch == 0 ? rowSize : param->image_pitch;
     if (param->image_pitch != 0 && (pitch < rowSize || (pitch & 3u) != 0)) return SCE_PNG_DEC_ERROR_INVALID_PARAM;
@@ -159,6 +155,7 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
     const std::uint64_t alignedWidth = (static_cast<std::uint64_t>(header->width) + 7u) & ~std::uint64_t{7u};
     const std::uint64_t alignedMaxWidth = (static_cast<std::uint64_t>(context->maxImageWidth) + 7u) & ~std::uint64_t{7u};
     if (alignedWidth > alignedMaxWidth) return SCE_PNG_DEC_ERROR_INVALID_WORK_MEMORY;
+    if (header->bitDepth > (8u << (context->attribute & 31u))) return SCE_PNG_DEC_ERROR_INVALID_WORK_MEMORY;
 
     const std::optional<Decoder::Png::Image> image = Decoder::Png::Decode(png);
     if (!image || image->width != header->width || image->height != header->height) return SCE_PNG_DEC_ERROR_DECODE_ERROR;
diff --git a/core/libs/tests/GuestPngDec.cpp b/core/libs/tests/GuestPngDec.cpp
index 4ee4031ad2..b8cd24a3f3 100644
--- a/core/libs/tests/GuestPngDec.cpp
+++ b/core/libs/tests/GuestPngDec.cpp
@@ -3,8 +3,12 @@
 #include "Decoder/Png.hpp"
 #include <algorithm>
 #include <cstdint>
+#include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <initializer_list>
+#include <source_location>
+#include <span>
 #include <stdexcept>
 #include <vector>
 
@@ -16,7 +20,11 @@ std::int32_t APS5_VABI scePngDecParseHeader(const PngDecParseParam*, PngDecImage
 std::int32_t APS5_VABI scePngDecDecode(void*, const PngDecDecodeParam*, PngDecImageInfo*);
 }
 
-static void Require(bool value) { if (!value) std::abort(); }
+static void Require(bool value, std::source_location location = std::source_location::current()) {
+    if (value) return;
+    std::fprintf(stderr, "%s:%u: PNG decoder assertion failed\n", location.file_name(), location.line());
+    std::abort();
+}
 
 template<typename TFunction>
 static bool ThrowsRuntimeError(TFunction function) {
@@ -46,6 +54,44 @@ static const std::uint8_t GRAY16[] = {
     0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
 };
 
+static const std::uint8_t GRAY16_TRNS[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x00, 0x07, 0x4D, 0x8E,
+    0xBB, 0x00, 0x00, 0x00, 0x02, 0x74, 0x52, 0x4E, 0x53, 0x12, 0x34, 0x2F, 0xD3, 0x49, 0x5E, 0x00,
+    0x00, 0x00, 0x12, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x10, 0x32, 0x11, 0x5A, 0xCD, 0xB0,
+    0xFA, 0x2C, 0x03, 0x03, 0x00, 0x0B, 0xDF, 0x02, 0x7C, 0x4E, 0x3C, 0x25, 0x55, 0x00, 0x00, 0x00,
+    0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
+};
+
+static const std::uint8_t RGB16_TRNS[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x02, 0x00, 0x00, 0x00, 0xAD, 0x44, 0x46,
+    0x30, 0x00, 0x00, 0x00, 0x06, 0x74, 0x52, 0x4E, 0x53, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0x89,
+    0xE4, 0x4E, 0xE6, 0x00, 0x00, 0x00, 0x23, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x10, 0x32,
+    0x09, 0xAB, 0x98, 0xB5, 0x47, 0xE8, 0x7F, 0xD8, 0xFF, 0x59, 0xFF, 0x19, 0xFE, 0x33, 0x30, 0x30,
+    0x36, 0x30, 0x32, 0x30, 0x34, 0x30, 0xFC, 0xFF, 0x0F, 0x00, 0x88, 0xFB, 0x0A, 0x69, 0xC3, 0x3F,
+    0x47, 0x19, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
+};
+
+static const std::uint8_t GRAY_ALPHA16[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x04, 0x00, 0x00, 0x00, 0x88, 0x2F, 0x19,
+    0xEC, 0x00, 0x00, 0x00, 0x19, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x63, 0x10, 0x32, 0xB9, 0xF7,
+    0x61, 0xF5, 0x59, 0x06, 0x20, 0xF8, 0xF7, 0xFF, 0xFF, 0x7F, 0xC6, 0x86, 0x46, 0x00, 0x48, 0x58,
+    0x08, 0x8A, 0x8F, 0xC8, 0x5C, 0x92, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, 0x42,
+    0x60, 0x82,
+};
+
+static const std::uint8_t RGBA16[] = {
+    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
+    0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x10, 0x06, 0x00, 0x00, 0x00, 0x22, 0x26, 0xD1,
+    0x67, 0x00, 0x00, 0x00, 0x2D, 0x49, 0x44, 0x41, 0x54, 0x78, 0x9C, 0x01, 0x22, 0x00, 0xDD, 0xFF,
+    0x00, 0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0x0D, 0xEF, 0xAB, 0xCD, 0x20, 0x01, 0xEE, 0xFE, 0xFF,
+    0xFF, 0x00, 0x00, 0x01, 0x80, 0x40, 0xFF, 0xAB, 0x00, 0x00, 0xFF, 0xFF, 0x01, 0x02, 0x7F, 0xFE,
+    0x80, 0xFF, 0x07, 0xD0, 0x10, 0x52, 0x90, 0xA2, 0xAC, 0x25, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45,
+    0x4E, 0x44, 0xAE, 0x42, 0x60, 0x82,
+};
+
 static std::vector<std::uint8_t> RgbPng() {
     std::vector<std::uint8_t> rgb(3 * 2 * 3);
     for (std::size_t i = 0; i < rgb.size(); ++i) rgb[i] = static_cast<std::uint8_t>(10 + i * 13);
@@ -70,6 +116,57 @@ static PngDecDecodeParam DecodeParam(const std::vector<std::uint8_t>& png, std::
     return param;
 }
 
+static void Check16BitImage(void* limitedHandle, void* enabledHandle, std::span<const std::uint8_t> png,
+                            std::initializer_list<std::uint8_t> expected, std::uint16_t colorSpace,
+                            std::uint32_t flags, std::uint32_t height = 2) {
+    constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
+    constexpr std::int32_t invalidParam = static_cast<std::int32_t>(0x80690003);
+    constexpr std::int32_t invalidWorkMemory = static_cast<std::int32_t>(0x80690005);
+    const std::vector<std::uint8_t> input(png.begin(), png.end());
+    const std::vector<std::uint8_t> expectedPixels(expected);
+    Require(expectedPixels.size() == 2 * height * 4);
+    for (const std::uint16_t format : {0, 1}) {
+        for (const std::uint32_t padding : {0, 8}) {
+            const std::uint32_t pitch = 8 + padding;
+            const std::uint32_t size = pitch * height;
+            std::vector<std::uint8_t> output(size + 16, 0xCC);
+            PngDecDecodeParam decode = DecodeParam(input, output);
+            decode.pixel_format = format;
+            decode.image_pitch = padding == 0 ? 0 : pitch;
+            decode.image_mem_size = size;
+            PngDecImageInfo info{};
+            Require(scePngDecDecode(limitedHandle, &decode, &info) == invalidWorkMemory);
+            Require(info.image_width == 2 && info.image_height == height && info.bit_depth == 16);
+            Require(info.color_space == colorSpace && info.image_flag == flags);
+            Require(std::all_of(output.begin(), output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+            Require(scePngDecDecode(enabledHandle, &decode, format == 0 ? &info : nullptr) == static_cast<std::int32_t>(2 << 16 | height));
+            Require(info.image_width == 2 && info.image_height == height && info.bit_depth == 16);
+            Require(info.color_space == colorSpace && info.image_flag == flags);
+            for (std::uint32_t y = 0; y < height; ++y) {
+                for (std::uint32_t x = 0; x < 2; ++x) {
+                    for (std::uint32_t channel = 0; channel < 4; ++channel) {
+                        const std::uint32_t inputChannel = format == 1 && channel < 3 ? 2 - channel : channel;
+                        Require(output[y * pitch + x * 4 + channel] == expectedPixels[y * 8 + x * 4 + inputChannel]);
+                    }
+                }
+                for (std::uint32_t offset = 8; offset < pitch; ++offset) Require(output[y * pitch + offset] == 0xCC);
+            }
+            Require(std::all_of(output.begin() + size, output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+            std::fill(output.begin(), output.end(), 0xCC);
+            decode.image_mem_size = size - 1;
+            for (void* handle : {limitedHandle, enabledHandle}) {
+                Require(scePngDecDecode(handle, &decode, &info) == (padding == 0 ? invalidSize : invalidParam));
+                Require(std::all_of(output.begin(), output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+                const auto validPitch = decode.image_pitch;
+                decode.image_pitch = 7;
+                Require(scePngDecDecode(handle, &decode, &info) == invalidParam);
+                Require(std::all_of(output.begin(), output.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
+                decode.image_pitch = validPitch;
+            }
+        }
+    }
+}
+
 int main() {
     constexpr std::int32_t invalidAddr = static_cast<std::int32_t>(0x80690001);
     constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
@@ -205,10 +302,10 @@ int main() {
     Require(info.image_flag == 2);
 
     const std::vector<std::uint8_t> gray16Png(GRAY16, GRAY16 + sizeof(GRAY16));
-    std::vector<std::uint8_t> gray16Image(2 * 4);
+    std::vector<std::uint8_t> gray16Image(2 * 4, 0xCC);
     decode = DecodeParam(gray16Png, gray16Image);
-    Require(scePngDecDecode(handle, &decode, &info) == (2 << 16 | 1));
-    Require(gray16Image == std::vector<std::uint8_t>({0x12, 0x12, 0x12, 0x77, 0xAB, 0xAB, 0xAB, 0x77}));
+    Require(scePngDecDecode(handle, &decode, &info) == invalidWorkMemory);
+    Require(std::all_of(gray16Image.begin(), gray16Image.end(), [](std::uint8_t byte) { return byte == 0xCC; }));
     Require(info.bit_depth == 16);
 
     decode = DecodeParam(rgbPng, image);
@@ -258,10 +355,15 @@ int main() {
     Require(deepSize == 85136);
     std::vector<unsigned char> deepMemory(static_cast<std::size_t>(deepSize));
     Require(scePngDecCreate(&deepParam, deepMemory.data(), static_cast<std::uint32_t>(deepSize), &deepHandle) == 0);
-    decode = DecodeParam(gray16Png, gray16Image);
-    Require(ThrowsRuntimeError([&] { scePngDecDecode(deepHandle, &decode, &info); }));
+    Check16BitImage(handle, deepHandle, GRAY16, {0x12, 0x12, 0x12, 0x77, 0xAB, 0xAB, 0xAB, 0x77}, 2, 0, 1);
+    Check16BitImage(handle, deepHandle, GRAY16_TRNS, {0x12, 0x12, 0x12, 0, 0x12, 0x12, 0x12, 0xFF, 0xAB, 0xAB, 0xAB, 0xFF, 0, 0, 0, 0xFF}, 2, 2);
+    Check16BitImage(handle, deepHandle, RGB16_TRNS, {0x12, 0x56, 0x9A, 0, 0x12, 0x56, 0x9A, 0xFF, 0xFF, 0, 0x80, 0xFF, 0, 0x80, 0xFF, 0xFF}, 3, 2);
+    Check16BitImage(handle, deepHandle, GRAY_ALPHA16, {0x12, 0x12, 0x12, 0xDE, 0xAB, 0xAB, 0xAB, 0, 0, 0, 0, 0xFF, 0xFF, 0xFF, 0xFF, 0x80}, 18, 0);
+    Check16BitImage(handle, deepHandle, RGBA16, {0x12, 0x56, 0x9A, 0x0D, 0xAB, 0x20, 0xEE, 0xFF, 0, 0x80, 0xFF, 0, 0xFF, 1, 0x7F, 0x80}, 19, 0);
     decode = DecodeParam(rgbPng, image);
     Require(scePngDecDecode(deepHandle, &decode, &info) == (3 << 16 | 2));
+    decode.pixel_format = 132;
+    Require(ThrowsRuntimeError([&] { scePngDecDecode(deepHandle, &decode, &info); }));
     Require(scePngDecDelete(deepHandle) == 0);
 
     Require(scePngDecDelete(nullptr) == invalidHandle);
diff --git a/docs/dev/debt/libScePngDec.md b/docs/dev/debt/libScePngDec.md
index 9449f5a2e9..5ab2fe8ca1 100644
--- a/docs/dev/debt/libScePngDec.md
+++ b/docs/dev/debt/libScePngDec.md
@@ -3,7 +3,7 @@
 ### Functional
 
 - [libScePngDec](../../../core/libs/prx/libScePngDec/Export.cpp): the supplied module confirms the work-memory size formula, 16-byte handle alignment, the first 24 bytes of its context, and Create/QueryMemorySize validation order. The host now exposes these values but still allocates decoder working storage on the host instead of using the guest work region.
-- [scePngDecDecode](../../../core/libs/prx/libScePngDec/Export.cpp): 16-bit output and the original's accepted pixel format 132 remain unsupported and throw. Malformed-image diagnostics and decoder scratch-memory behavior are not fully matched to the supplied module.
+- [scePngDecDecode](../../../core/libs/prx/libScePngDec/Export.cpp): the original's accepted pixel format 132 remains unsupported and throws. The input bit-depth limit and 16-to-8-bit conversion follow [Prosper's PS5 3.20 module analysis](https://github.com/mattias800/prosper/blob/550886e3677e4a2ef81ad1603bf313f6a9696de2/prosper/src/hle/util/hle_pngdec.cpp#L412-L414), not console measurements here. Malformed-image diagnostics and decoder scratch-memory behavior are not fully matched to the supplied module.
 
 ### Unknown function info
 

From c7a611466a391746f4b1e0ff656f5db2ea78f19e Mon Sep 17 00:00:00 2001
From: Danigamer05 <96824289+Danigamer05@users.noreply.github.com>
Date: Sat, 24 Oct 2026 03:12:33 +0200
Subject: [PATCH 063/218] fix(pngdec): require image info for large dimensions

---
 core/libs/prx/libScePngDec/Export.cpp |  4 +-
 core/libs/tests/GuestPngDec.cpp       | 68 +++++++++++++++++++++++++++
 2 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libScePngDec/Export.cpp b/core/libs/prx/libScePngDec/Export.cpp
index 8ff5827de0..0c6055dafe 100644
--- a/core/libs/prx/libScePngDec/Export.cpp
+++ b/core/libs/prx/libScePngDec/Export.cpp
@@ -144,6 +144,8 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
     const std::optional<Decoder::Png::Header> header = Decoder::Png::ParseHeader(png);
     if (!header) return SCE_PNG_DEC_ERROR_INVALID_DATA;
     if (imageInfo) fillImageInfo(*header, imageInfo);
+    const bool packedDimensions = header->width <= MAX_PACKED_DIMENSION && header->height <= MAX_PACKED_DIMENSION;
+    if (!imageInfo && !packedDimensions) return SCE_PNG_DEC_ERROR_INVALID_ADDR;
     if (header->bitDepth == 16 && context->attribute == ATTRIBUTE_BIT_DEPTH_16) {
         throw std::runtime_error("scePngDecDecode: 16-bit output is not implemented");
     }
@@ -178,7 +180,7 @@ int32_t APS5_VABI scePngDecDecode(void* handle, const PngDecDecodeParam* param,
         }
     }
 
-    if (header->width > MAX_PACKED_DIMENSION || header->height > MAX_PACKED_DIMENSION) return 0;
+    if (!packedDimensions) return 0;
     return static_cast<std::int32_t>(header->width << 16 | header->height);
 }
 
diff --git a/core/libs/tests/GuestPngDec.cpp b/core/libs/tests/GuestPngDec.cpp
index 4ee4031ad2..3032a19adc 100644
--- a/core/libs/tests/GuestPngDec.cpp
+++ b/core/libs/tests/GuestPngDec.cpp
@@ -70,6 +70,70 @@ static PngDecDecodeParam DecodeParam(const std::vector<std::uint8_t>& png, std::
     return param;
 }
 
+static void CheckDimensionReporting(std::uint32_t width, std::uint32_t height) {
+    constexpr std::int32_t invalidAddr = static_cast<std::int32_t>(0x80690001);
+    constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
+    constexpr std::int32_t invalidParam = static_cast<std::int32_t>(0x80690003);
+    constexpr std::int32_t invalidData = static_cast<std::int32_t>(0x80690010);
+    std::vector<std::uint8_t> rgb(static_cast<std::size_t>(width) * height * 3);
+    for (std::size_t i = 0; i < rgb.size(); ++i) rgb[i] = static_cast<std::uint8_t>(i * 13 + 7);
+    const auto png = Decoder::Png::Encode(rgb, width, height, 3);
+    const PngDecCreateParam create{sizeof(PngDecCreateParam), 0, width};
+    const auto memorySize = scePngDecQueryMemorySize(&create);
+    Require(memorySize > 0);
+    std::vector<std::uint8_t> memory(memorySize);
+    void* handle = nullptr;
+    Require(scePngDecCreate(&create, memory.data(), memorySize, &handle) == 0);
+    const bool packed = width <= 32767 && height <= 32767;
+    const auto result = packed ? static_cast<std::int32_t>(width << 16 | height) : 0;
+    for (const std::uint16_t format : {0, 1}) {
+        for (const std::uint32_t padding : {0, 8}) {
+            const std::uint32_t pitch = width * 4 + padding;
+            const std::uint32_t size = pitch * height;
+            std::vector<std::uint8_t> image(size + 16, 0xCC);
+            auto decode = DecodeParam(png, image);
+            decode.pixel_format = format;
+            decode.image_pitch = padding == 0 ? 0 : pitch;
+            decode.image_mem_size = size;
+            Require(scePngDecDecode(handle, &decode, nullptr) == (packed ? result : invalidAddr));
+            if (!packed) Require(std::all_of(image.begin(), image.end(), [](auto byte) { return byte == 0xCC; }));
+            PngDecImageInfo info{};
+            Require(scePngDecDecode(handle, &decode, &info) == result);
+            Require(info.image_width == width && info.image_height == height && info.color_space == 3 && info.bit_depth == 8 && info.image_flag == 0);
+            for (std::uint32_t y = 0; y < height; ++y) {
+                for (std::uint32_t x = 0; x < width; ++x) {
+                    for (std::uint32_t channel = 0; channel < 3; ++channel) {
+                        const auto inputChannel = format == 0 ? channel : 2 - channel;
+                        Require(image[y * pitch + x * 4 + channel] == rgb[(static_cast<std::size_t>(y) * width + x) * 3 + inputChannel]);
+                    }
+                    Require(image[y * pitch + x * 4 + 3] == 0x77);
+                }
+                for (std::uint32_t offset = width * 4; offset < pitch; ++offset) Require(image[y * pitch + offset] == 0xCC);
+            }
+            Require(std::all_of(image.begin() + size, image.end(), [](auto byte) { return byte == 0xCC; }));
+            if (packed) continue;
+            std::fill(image.begin(), image.end(), 0xCC);
+            decode.image_mem_size = 1;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidAddr);
+            Require(scePngDecDecode(handle, &decode, &info) == (padding == 0 ? invalidSize : invalidParam));
+            decode.image_mem_size = size;
+            decode.image_pitch = 1;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidAddr);
+            Require(scePngDecDecode(handle, &decode, &info) == invalidParam);
+            decode.image_mem_size = 0;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidSize);
+            decode.image_mem_size = size;
+            decode.pixel_format = 2;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidParam);
+            decode.pixel_format = format;
+            decode.png_mem_size = 8;
+            Require(scePngDecDecode(handle, &decode, nullptr) == invalidData);
+            Require(std::all_of(image.begin(), image.end(), [](auto byte) { return byte == 0xCC; }));
+        }
+    }
+    Require(scePngDecDelete(handle) == 0);
+}
+
 int main() {
     constexpr std::int32_t invalidAddr = static_cast<std::int32_t>(0x80690001);
     constexpr std::int32_t invalidSize = static_cast<std::int32_t>(0x80690002);
@@ -270,5 +334,9 @@ int main() {
     Require(scePngDecDelete(handle) == invalidHandle);
     Require(scePngDecDecode(handle, &decode, &info) == invalidHandle);
 
+    for (const std::uint32_t dimension : {32767, 32768, 65536}) {
+        CheckDimensionReporting(dimension, 1);
+        CheckDimensionReporting(1, dimension);
+    }
     return 0;
 }

From c917d982b120c755ce69514679e9734338d6ccb7 Mon Sep 17 00:00:00 2001
From: notaxeltv <notaxeltv@gmail.com>
Date: Thu, 15 Oct 2026 21:42:27 +0200
Subject: [PATCH 064/218] fix(libc): prefer nested prx/*.guest.prx for
 RelinkedModulePath

Unbound copies next to eboot concurrently LoadLibrary the same PE and leave Job0 with a null vtable; reuse the already-loaded nested guest module instead.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 core/libs/prx/libc/src/General.cpp     |  8 +++++++-
 core/libs/tests/GuestDynamicLoader.cpp | 16 ++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libc/src/General.cpp b/core/libs/prx/libc/src/General.cpp
index 34c4457efe..90865fdcbe 100644
--- a/core/libs/prx/libc/src/General.cpp
+++ b/core/libs/prx/libc/src/General.cpp
@@ -742,8 +742,14 @@ extern "C" std::filesystem::path RelinkedModulePath_nid_no_patch(const std::file
     const auto relinked = RelinkedModuleName(path);
     std::error_code error;
     if (std::filesystem::is_regular_file(relinked, error)) return relinked;
+    const auto parent = relinked.parent_path().empty() ? std::filesystem::path(".") : relinked.parent_path();
+    const auto name = relinked.filename();
+    for (const char* directory : {"prx", "sce_module", "sce_modules"}) {
+        const auto candidate = parent / directory / name;
+        if (std::filesystem::is_regular_file(candidate, error)) return candidate;
+    }
     NameMatch names[] = {{relinked.filename().string()}, {path.filename().string(), std::nullopt, false, true}};
-    MatchNames(relinked.parent_path().empty() ? "." : relinked.parent_path(), names);
+    MatchNames(parent, names);
     if (names[0].ambiguous || names[0].path) return MatchedModuleOrPath(path, relinked, names[0]);
     return names[1].path ? *names[1].path : path;
 }
diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index 1307264c64..5719677c3e 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -218,6 +218,22 @@ int main(int argc, char** argv) {
     std::error_code notEmpty;
     if (createdLibs) std::filesystem::remove("libs", notEmpty);
 
+    const std::filesystem::path nestedRoot = "anyps5-relinked-prx-dir-for-test";
+    const std::filesystem::path nestedGuest = nestedRoot / "Engine.Render.prx";
+    const std::filesystem::path nestedRelinked = nestedRoot / "prx" / "Engine.Render.prx.guest.prx";
+    std::filesystem::create_directories(nestedRelinked.parent_path());
+    {
+        std::ofstream elf(nestedGuest, std::ios::binary);
+        elf.write("\x7f" "ELF", 4);
+    }
+    std::filesystem::copy_file(argv[1], nestedRelinked, std::filesystem::copy_options::overwrite_existing);
+    void* nested = dlopen_nid_postfix(nestedGuest.string().c_str(), 2);
+    Require(nested != nullptr);
+    add = reinterpret_cast<Add>(dlsym_nid_postfix(nested, "GuestModuleAdd"));
+    Require(add && add(20, 22) == 42);
+    Require(dlclose_nid_postfix(nested) == 0);
+    std::filesystem::remove_all(nestedRoot);
+
     void* pinned = dlopen_nid_postfix(argv[1], 2);
     add = reinterpret_cast<Add>(dlsym_nid_postfix(pinned, "GuestModuleAdd"));
     Require(add && _sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);

From e2dda5eba0037be211cb7b9489e461e1c12c4dbd Mon Sep 17 00:00:00 2001
From: xXPBSXx <20614131+xXPBSXx@users.noreply.github.com>
Date: Fri, 23 Oct 2026 04:33:39 +0200
Subject: [PATCH 065/218] fix(libc): prefer a same-directory relinked module
 over nested prx folders

RelinkedModulePath looked in prx, sce_module and sce_modules before the
case-insensitive match in the module's own directory, so a stray nested file
could shadow a module next to the title. Check the directory of the module
first, then the nested folders, and match the nested names case-insensitively.

Tests: a same-directory module with a differently cased name wins over an
exact-case nested file, and a nested module is found case-insensitively.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/General.cpp     | 10 ++++----
 core/libs/tests/GuestDynamicLoader.cpp | 32 ++++++++++++++++++++++++++
 2 files changed, 37 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libc/src/General.cpp b/core/libs/prx/libc/src/General.cpp
index 90865fdcbe..310eaf01bf 100644
--- a/core/libs/prx/libc/src/General.cpp
+++ b/core/libs/prx/libc/src/General.cpp
@@ -743,14 +743,14 @@ extern "C" std::filesystem::path RelinkedModulePath_nid_no_patch(const std::file
     std::error_code error;
     if (std::filesystem::is_regular_file(relinked, error)) return relinked;
     const auto parent = relinked.parent_path().empty() ? std::filesystem::path(".") : relinked.parent_path();
-    const auto name = relinked.filename();
-    for (const char* directory : {"prx", "sce_module", "sce_modules"}) {
-        const auto candidate = parent / directory / name;
-        if (std::filesystem::is_regular_file(candidate, error)) return candidate;
-    }
     NameMatch names[] = {{relinked.filename().string()}, {path.filename().string(), std::nullopt, false, true}};
     MatchNames(parent, names);
     if (names[0].ambiguous || names[0].path) return MatchedModuleOrPath(path, relinked, names[0]);
+    for (const char* directory : {"prx", "sce_module", "sce_modules"}) {
+        NameMatch nested[] = {{relinked.filename().string()}};
+        MatchNames(parent / directory, nested);
+        if (nested[0].ambiguous || nested[0].path) return MatchedModuleOrPath(path, relinked, nested[0]);
+    }
     return names[1].path ? *names[1].path : path;
 }
 
diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index 5719677c3e..548b4a8f98 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -234,6 +234,38 @@ int main(int argc, char** argv) {
     Require(dlclose_nid_postfix(nested) == 0);
     std::filesystem::remove_all(nestedRoot);
 
+    const std::filesystem::path layeredRoot = "anyps5-relinked-prx-layers-for-test";
+    const std::filesystem::path layeredGuest = layeredRoot / "Engine.Layers.prx";
+    std::filesystem::create_directories(layeredRoot / "prx");
+    {
+        std::ofstream elf(layeredGuest, std::ios::binary);
+        elf.write("" "ELF", 4);
+        std::ofstream broken(layeredRoot / "prx" / "Engine.Layers.prx.guest.prx", std::ios::binary);
+        broken << "not a module";
+    }
+    std::filesystem::copy_file(argv[1], layeredRoot / "ENGINE.LAYERS.PRX.GUEST.PRX", std::filesystem::copy_options::overwrite_existing);
+    void* layered = dlopen_nid_postfix(layeredGuest.string().c_str(), 2);
+    Require(layered != nullptr);
+    add = reinterpret_cast<Add>(dlsym_nid_postfix(layered, "GuestModuleAdd"));
+    Require(add && add(19, 23) == 42);
+    Require(dlclose_nid_postfix(layered) == 0);
+    std::filesystem::remove_all(layeredRoot);
+
+    const std::filesystem::path foldedRoot = "anyps5-relinked-prx-folded-for-test";
+    const std::filesystem::path foldedGuest = foldedRoot / "Engine.Folded.prx";
+    std::filesystem::create_directories(foldedRoot / "prx");
+    {
+        std::ofstream elf(foldedGuest, std::ios::binary);
+        elf.write("" "ELF", 4);
+    }
+    std::filesystem::copy_file(argv[1], foldedRoot / "prx" / "ENGINE.FOLDED.PRX.GUEST.PRX", std::filesystem::copy_options::overwrite_existing);
+    void* folded = dlopen_nid_postfix(foldedGuest.string().c_str(), 2);
+    Require(folded != nullptr);
+    add = reinterpret_cast<Add>(dlsym_nid_postfix(folded, "GuestModuleAdd"));
+    Require(add && add(10, 32) == 42);
+    Require(dlclose_nid_postfix(folded) == 0);
+    std::filesystem::remove_all(foldedRoot);
+
     void* pinned = dlopen_nid_postfix(argv[1], 2);
     add = reinterpret_cast<Add>(dlsym_nid_postfix(pinned, "GuestModuleAdd"));
     Require(add && _sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);

From c7cd45c0da49e8a6e2cdff118ea9f2e8e041dad6 Mon Sep 17 00:00:00 2001
From: harisibrar1 <207127467+harisibrar1@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:45:22 -0400
Subject: [PATCH 066/218] fix(libkernel): return EINTR from pselect when its
 mask unblocks a pending signal

FreeBSD's kern_pselect installs the mask and kern_select sleeps with
PCATCH, so a pending signal that the new mask unblocks makes the call
return EINTR once the descriptors have been scanned. Here the handler ran
inside the mask swap and select then waited the full timeout, or forever
with no timeout. The swap now reports whether a handler ran, and pselect
then scans the descriptors once without waiting: a ready descriptor, a
zero timeout or an invalid argument keep select's answer, and otherwise
the call fails with EINTR and leaves the descriptor sets unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../libs/prx/libkernel/Socket/src/Pselect.cpp | 68 ++++++++++++++----
 .../libs/prx/libkernel/System/src/Signals.cpp | 70 +++++++++++--------
 core/libs/tests/GuestKernelSysPselect.cpp     | 69 ++++++++++++++++++
 docs/dev/debt/libkernel.md                    |  2 +-
 4 files changed, 166 insertions(+), 43 deletions(-)

diff --git a/core/libs/prx/libkernel/Socket/src/Pselect.cpp b/core/libs/prx/libkernel/Socket/src/Pselect.cpp
index 931cc83a54..66996aadfa 100644
--- a/core/libs/prx/libkernel/Socket/src/Pselect.cpp
+++ b/core/libs/prx/libkernel/Socket/src/Pselect.cpp
@@ -1,32 +1,76 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
 #include <cstdint>
+#include <cstring>
 
 extern "C" {
 
 int* APS5_VABI __error_nid_postfix();
 int APS5_VABI select_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout);
 int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
+int APS5_VABI SetSignalMaskCatching_nid_no_patch(const void* set, void* previousSet);
+
+}
+
+namespace {
+
+constexpr int SetMask = 3;
+constexpr int Eintr = 4;
+constexpr int DescriptorLimit = 1024;
+
+struct Timeval {
+    std::int64_t seconds;
+    std::int64_t microseconds;
+};
+
+using SavedSet = std::array<std::uint64_t, DescriptorLimit / 64>;
+
+void Save(SavedSet& saved, const void* set, std::size_t bytes) {
+    if (set != nullptr) std::memcpy(saved.data(), set, bytes);
+}
+
+void Restore(void* set, const SavedSet& saved, std::size_t bytes) {
+    if (set != nullptr) std::memcpy(set, saved.data(), bytes);
+}
+
+int ScanAfterCaughtSignal(int nfds, void* readfds, void* writefds, void* exceptfds, const Timeval* wait) {
+    const bool validWait = wait == nullptr || (wait->seconds >= 0 && wait->microseconds >= 0 && wait->microseconds < 1000000);
+    if (nfds < 0 || nfds > DescriptorLimit || !validWait) return select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
+    const std::size_t bytes = static_cast<std::size_t>((nfds + 63) / 64) * sizeof(std::uint64_t);
+    SavedSet read{}, write{}, except{};
+    Save(read, readfds, bytes);
+    Save(write, writefds, bytes);
+    Save(except, exceptfds, bytes);
+    const Timeval zero{};
+    const int result = select_nid_postfix(nfds, readfds, writefds, exceptfds, &zero);
+    if (result != 0 || (wait != nullptr && wait->seconds == 0 && wait->microseconds == 0)) return result;
+    Restore(readfds, read, bytes);
+    Restore(writefds, write, bytes);
+    Restore(exceptfds, except, bytes);
+    *__error_nid_postfix() = Eintr;
+    return -1;
+}
+
+}
+
+extern "C" {
 
 int APS5_VABI pselect_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout, const void* sigmask) {
-    constexpr int SetMask = 3;
-    struct Timeval {
-        std::int64_t seconds;
-        std::int64_t microseconds;
-    } limit{};
+    Timeval limit{};
     const Timeval* wait = nullptr;
     if (timeout != nullptr) {
         const auto* spec = static_cast<const std::int64_t*>(timeout);
         limit = {spec[0], spec[1] / 1000};
         wait = &limit;
     }
+    if (sigmask == nullptr) return select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
     std::uint32_t previous[4]{};
-    if (sigmask != nullptr && sigprocmask_nid_postfix(SetMask, sigmask, previous) != 0) return -1;
-    const int result = select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
-    if (sigmask != nullptr) {
-        const int error = *__error_nid_postfix();
-        sigprocmask_nid_postfix(SetMask, previous, nullptr);
-        *__error_nid_postfix() = error;
-    }
+    const bool caught = SetSignalMaskCatching_nid_no_patch(sigmask, previous) != 0;
+    const int result = caught ? ScanAfterCaughtSignal(nfds, readfds, writefds, exceptfds, wait)
+                              : select_nid_postfix(nfds, readfds, writefds, exceptfds, wait);
+    const int error = *__error_nid_postfix();
+    sigprocmask_nid_postfix(SetMask, previous, nullptr);
+    *__error_nid_postfix() = error;
     return result;
 }
 
diff --git a/core/libs/prx/libkernel/System/src/Signals.cpp b/core/libs/prx/libkernel/System/src/Signals.cpp
index 0137030675..2a5b941662 100644
--- a/core/libs/prx/libkernel/System/src/Signals.cpp
+++ b/core/libs/prx/libkernel/System/src/Signals.cpp
@@ -478,6 +478,45 @@ namespace {
 constexpr int SsDisable = 4;
 constexpr std::size_t MinSignalStackSize = 2048;
 thread_local GuestStack alternateStack{nullptr, 0, SsDisable};
+
+int ChangeSignalMask(int how, const GuestSignalSet* set, GuestSignalSet* previousSet, bool* caught) {
+    if (set != nullptr && (how < 1 || how > 3)) { *__error_nid_postfix() = 22; return -1; }
+    {
+        std::lock_guard lock(registration);
+        if (previousSet != nullptr) {
+            previousSet->bits[0] = blockedMask.load();
+            for (int word = 1; word < 4; ++word) previousSet->bits[word] = blockedMaskExtra[word - 1].load();
+        }
+        if (set != nullptr) {
+            switch (how) {
+                case 1:
+                    blockedMask.fetch_or(set->bits[0] & ~UnblockableSignals);
+                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_or(set->bits[word]);
+                    break;
+                case 2:
+                    blockedMask.fetch_and(~set->bits[0]);
+                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_and(~set->bits[word]);
+                    break;
+                case 3:
+                    blockedMask.store(set->bits[0] & ~UnblockableSignals);
+                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].store(set->bits[word]);
+                    break;
+            }
+        }
+    }
+    std::atomic_thread_fence(std::memory_order_seq_cst);
+    for (int guest = 1; guest <= MaxSignal; ++guest) {
+        if (SignalBlocked(guest) || !Deliverable(guest) || !TakePending(guest)) continue;
+        if (DeliverPendingSignal(guest) && caught != nullptr) *caught = true;
+    }
+    return 0;
+}
+}
+
+extern "C" int APS5_VABI SetSignalMaskCatching_nid_no_patch(const GuestSignalSet* set, GuestSignalSet* previousSet) {
+    bool caught = false;
+    ChangeSignalMask(GuestSigsetmask, set, previousSet, &caught);
+    return caught ? 1 : 0;
 }
 
 extern "C" {
@@ -560,36 +599,7 @@ int APS5_VABI sigaltstack_nid_postfix(const GuestStack* stack, GuestStack* previ
     return 0;
 }
 int APS5_VABI _sigprocmask_nid_postfix(int how, const GuestSignalSet* set, GuestSignalSet* previousSet) {
-    if (set != nullptr && (how < 1 || how > 3)) { *__error_nid_postfix() = 22; return -1; }
-    {
-        std::lock_guard lock(registration);
-        if (previousSet != nullptr) {
-            previousSet->bits[0] = blockedMask.load();
-            for (int word = 1; word < 4; ++word) previousSet->bits[word] = blockedMaskExtra[word - 1].load();
-        }
-        if (set != nullptr) {
-            switch (how) {
-                case 1:
-                    blockedMask.fetch_or(set->bits[0] & ~UnblockableSignals);
-                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_or(set->bits[word]);
-                    break;
-                case 2:
-                    blockedMask.fetch_and(~set->bits[0]);
-                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].fetch_and(~set->bits[word]);
-                    break;
-                case 3:
-                    blockedMask.store(set->bits[0] & ~UnblockableSignals);
-                    for (int word = 1; word < 4; ++word) blockedMaskExtra[word - 1].store(set->bits[word]);
-                    break;
-            }
-        }
-    }
-    std::atomic_thread_fence(std::memory_order_seq_cst);
-    for (int guest = 1; guest <= MaxSignal; ++guest) {
-        if (SignalBlocked(guest) || !Deliverable(guest) || !TakePending(guest)) continue;
-        DeliverPendingSignal(guest);
-    }
-    return 0;
+    return ChangeSignalMask(how, set, previousSet, nullptr);
 }
 
 int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet) {
diff --git a/core/libs/tests/GuestKernelSysPselect.cpp b/core/libs/tests/GuestKernelSysPselect.cpp
index e3924a7f43..e3fbee46ed 100644
--- a/core/libs/tests/GuestKernelSysPselect.cpp
+++ b/core/libs/tests/GuestKernelSysPselect.cpp
@@ -15,10 +15,14 @@ int APS5_VABI close_nid_postfix(int descriptor);
 std::int64_t APS5_VABI write_nid_postfix(int descriptor, const char* buffer, std::int64_t size);
 int APS5_VABI sigprocmask_nid_postfix(int how, const void* set, void* previousSet);
 int APS5_VABI pselect_nid_postfix(int nfds, void* readfds, void* writefds, void* exceptfds, const void* timeout, const void* sigmask);
+using Handler = void (APS5_VABI *)(int);
+Handler APS5_VABI signal_nid_postfix(int guest, Handler handler);
+int APS5_VABI raise_nid_postfix(int guest);
 }
 
 namespace {
 
+constexpr int Eintr = 4;
 constexpr int Einval = 22;
 constexpr int SigBlock = 1;
 constexpr int SigSetmask = 3;
@@ -59,6 +63,17 @@ bool Same(const SignalSet& left, const SignalSet& right) {
     return std::memcmp(left.bits, right.bits, sizeof(left.bits)) == 0;
 }
 
+int caught = 0;
+
+void APS5_VABI Count(int) {
+    ++caught;
+}
+
+void RaiseBlocked(const SignalSet& blocked) {
+    Require(sigprocmask_nid_postfix(SigBlock, &blocked, nullptr) == 0);
+    Require(raise_nid_postfix(SigUsr1) == 0 && caught == 0);
+}
+
 }
 
 int main() {
@@ -101,6 +116,60 @@ int main() {
         const Timespec zero{0, 0};
         Require(pselect_nid_postfix(-1, nullptr, nullptr, nullptr, &zero, nullptr) == -1 && Error() == Einval);
     }
+    Require(signal_nid_postfix(SigUsr1, Count) != reinterpret_cast<Handler>(static_cast<std::uintptr_t>(-1)));
+    const SignalSet empty{};
+    {
+        RaiseBlocked(blocked);
+        const SignalSet withUsr1 = CurrentMask();
+        DescriptorSet read{};
+        read.Add(writer);
+        const DescriptorSet original = read;
+        const Timespec limit{0, 300000000};
+        const auto start = std::chrono::steady_clock::now();
+        Require(pselect_nid_postfix(writer + 1, read.words.data(), nullptr, nullptr, &limit, &empty) == -1 && Error() == Eintr);
+        Require(std::chrono::steady_clock::now() - start < std::chrono::milliseconds(150));
+        Require(caught == 1);
+        Require(read.words == original.words);
+        Require(Same(CurrentMask(), withUsr1));
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, nullptr, &empty) == -1 && Error() == Eintr && caught == 1);
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        DescriptorSet read{};
+        read.Add(reader);
+        const Timespec limit{0, 300000000};
+        Require(pselect_nid_postfix(reader + 1, read.words.data(), nullptr, nullptr, &limit, &empty) == 1 && caught == 1);
+        Require(read.Has(reader));
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        const Timespec zero{0, 0};
+        DescriptorSet read{};
+        read.Add(writer);
+        Require(pselect_nid_postfix(writer + 1, read.words.data(), nullptr, nullptr, &zero, &empty) == 0 && caught == 1);
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        const Timespec invalid{0, 1000000000};
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, &invalid, &empty) == -1 && Error() == Einval && caught == 1);
+        caught = 0;
+    }
+    {
+        RaiseBlocked(blocked);
+        const Timespec limit{0, 200000000};
+        const auto start = std::chrono::steady_clock::now();
+        Require(pselect_nid_postfix(0, nullptr, nullptr, nullptr, &limit, &blocked) == 0 && caught == 0);
+        Require(std::chrono::steady_clock::now() - start >= std::chrono::milliseconds(150));
+        Require(sigprocmask_nid_postfix(SigSetmask, &empty, nullptr) == 0 && caught == 1);
+        caught = 0;
+    }
     Require(sigprocmask_nid_postfix(SigSetmask, &before, nullptr) == 0);
     Require(close_nid_postfix(reader) == 0 && close_nid_postfix(writer) == 0);
     std::puts("pselect passed");
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 63512e62d1..b3200f639e 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -158,7 +158,7 @@
 - [sceKernelGetFsSandboxRandomWord](../../../core/libs/prx/libkernel/System/src/Sandbox.cpp) (libkernel) returns a fixed directory name, `gkbHtXc3Wq`. On the console the name is the process's randomized path (syscall 602, `randomized_path`), and the sandbox exposes system files under it, such as `common/lib` and `common/cert`. Nothing is mounted under the name here, so `/gkbHtXc3Wq/common/...` resolves under the guest root like any other path and does not exist, except `/gkbHtXc3Wq/common/cert/CA_LIST.cer`, which [SandboxCertificates.cpp](../../../core/libs/prx/libkernel/File/src/SandboxCertificates.cpp) serves from the host trust store
 - [ktimer_create, ktimer_settime, ktimer_gettime, ktimer_getoverrun, ktimer_delete](../../../core/libs/prx/libkernel/Time/Ktimer.cpp) (libkernel) - a `SIGEV_SIGNAL` or `SIGEV_THREAD_ID` timer, and one created with a null `sigevent` (FreeBSD defaults it to `SIGEV_SIGNAL`), throws, because delivering a guest signal from a timer is not modelled. A non-zero value under one tick rounds up to 1 ms, as FreeBSD 11 does at hz 1000; the console's hz is not measured (`kern.clockrate` is unanswered). `SIGEV_NONE` timers on `CLOCK_REALTIME` and `CLOCK_MONOTONIC` follow `kern_time.c`: ids 3 to 31 (`EAGAIN` when full), `EINVAL` for another clock, a bad notify type or signal, an id that is not live or a bad `itimerspec` field, and `TIMER_ABSTIME` (1). Expiry is worked out from the guest clock when the timer is read, and `ktimer_getoverrun` returns 0, as FreeBSD only updates it when a signal is accepted
 - [The sandbox CA list](../../../core/libs/prx/libkernel/File/src/SandboxCertificates.cpp) (libkernel), `/<sandbox word>/common/cert/CA_LIST.cer`, is a PEM bundle of the host's trust anchors, written once per process to `cert_cache/CA_LIST.cer` in the run directory with the owner write bit cleared: on Windows the current user's `ROOT` store, filtered through Disallowed and the combined EKU extension/property for TLS server authentication (Windows fetches missing roots on demand, so a root that was never fetched is absent), elsewhere `SSL_CERT_FILE` or the first of `/etc/ssl/certs/ca-certificates.crt`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/ssl/ca-bundle.pem` and `/etc/ssl/cert.pem` that exists. On macOS, `/etc/ssl/cert.pem` is a static snapshot and does not reflect roots added to or distrusted in the Keychain. Existing guest files, explicit aliases and blocked mounts take precedence over the provider. The PEM snapshot does not carry Windows CTL restrictions beyond EKU, native revocation policy or later trust-store changes. Without any certificate the path does not exist. The console file's format is unverified: only that bundled OpenSSL accepts a PEM bundle there is shown (ProsperoRadio PPSA99001 and SwanStation PPSA98510, #5001). The other entries of the console's `common/cert` directory, the directory itself (it does not exist here) and the error a write open gets (`EACCES` from the host here) are unverified
-- [pselect](../../../core/libs/prx/libkernel/Socket/src/Pselect.cpp) (libkernel) sets the signal mask with `sigprocmask`, calls `select` and restores the mask, as FreeBSD 11 `kern_pselect` does, but the swap is not atomic with the wait: a signal that becomes deliverable between the swap and the wait is not guaranteed to interrupt it
+- [pselect](../../../core/libs/prx/libkernel/Socket/src/Pselect.cpp) (libkernel) sets the signal mask, calls `select` and restores the mask, as FreeBSD 11 `kern_pselect` does. A pending signal that the new mask unblocks has its handler run during the swap, and `pselect` then returns `EINTR` unless a descriptor is already ready, the timeout is zero or an argument is invalid, as FreeBSD's `kern_select` decides before it sleeps. A signal raised during the wait, including one sent by another thread, does not interrupt it, because `select` has no `EINTR` path; and the mask is the process-wide one, so it applies to every thread for the duration of the call
 - [getcontext and setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) and [makecontext](../../../core/libs/prx/libSceLibcInternal/UserContext.cpp) (libSceLibcInternal) use FreeBSD 11's amd64 `ucontext_t` (`mcontext` at 0x10, `mc_len` 800, `uc_link` at 0x330, `uc_stack` at 0x338, 0x370 bytes), the layout homebrew built against FreeBSD's headers passes: PPSA99039's OpenSSL `ASYNC` (`crypto/async/arch/async_posix.c`) captures into a 0x370-byte stack buffer. `getcontext` writes the 0x330 bytes before `uc_link`, as FreeBSD's `UC_COPY_SIZE`. The console's own layout for these functions is not verified; the exception handler's context is a different one (see `sceKernelRaiseException`)
 - [getcontext and setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) keep the 512-byte FXSAVE image in `mc_fpstate` (x87, MXCSR, XMM0-15), so the upper halves of YMM0-15 are neither saved nor restored, and `getcontext` leaves `mc_xfpustate` and `mc_xfpustate_len` 0. `getcontext` sets `mc_fpformat` and `mc_ownedfp` to FreeBSD's `_MC_FPFMT_XMM` and `_MC_FPOWNED_FPU`, `mc_cs` and `mc_ss` to the host selectors, and `mc_flags`, `mc_fsbase` and `mc_gsbase` to 0. `setcontext` loads `mc_fpstate` whatever `mc_fpformat` and `mc_ownedfp` say, and restores neither the segment selectors, `mc_fsbase` and `mc_gsbase` nor the extended state, which FreeBSD restores when `mc_flags` asks for them
 - [setcontext](../../../core/libs/prx/libkernel/System/src/UserContext.cpp) (libkernel) and [longjmp](../../../core/libs/prx/libc/src/JumpBuffer.cpp) (libc) on Windows set the thread's stack bounds in the TEB to the stack they switch to: a `makecontext` stack, or else the committed region around the target stack pointer. A switch to any other guest stack, such as a context built by hand, gets the bounds of that region only

From 698697cbc74ffe79f62f8c72c3a273063827c774 Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Sat, 24 Oct 2026 02:53:35 -0300
Subject: [PATCH 067/218] fix(libkernel): throw for an unmeasured unbalanced
 thread atexit decrement on a module

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libkernel/System/src/Rtld.cpp | 6 ++----
 core/libs/tests/GuestDynamicLoader.cpp      | 2 +-
 docs/dev/debt/libkernel.md                  | 2 +-
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/core/libs/prx/libkernel/System/src/Rtld.cpp b/core/libs/prx/libkernel/System/src/Rtld.cpp
index 4a11c90be5..044ae1ef1c 100644
--- a/core/libs/prx/libkernel/System/src/Rtld.cpp
+++ b/core/libs/prx/libkernel/System/src/Rtld.cpp
@@ -66,10 +66,8 @@ int releaseThreadAtexitImage(const void* address, const char* caller) {
     {
         std::lock_guard lock(threadAtexitMutex);
         const auto found = threadAtexitReferences.find(image);
-        if (found == threadAtexitReferences.end()) {
-            APS5_LOG_OUT("%s: image holds no thread atexit reference", caller);
-            return 0;
-        }
+        if (found == threadAtexitReferences.end())
+            throw std::runtime_error(std::string(caller) + ": image holds no thread atexit reference");
         handle = found->second;
         threadAtexitReferences.erase(found);
     }
diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index 6013ae1f19..afcc355f26 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -229,7 +229,7 @@ int main(int argc, char** argv) {
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
-    Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&Require)) == 0);
+    Require(ThrowsRuntimeError([] { _sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&Require)); }));
     int local = 0;
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(&local) == -1);
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(nullptr) == -1);
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index b8804e2c64..3db94d8388 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -77,7 +77,7 @@
 - [Map hints inside a reservation](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMapDirectMemory` and the flexible and anonymous maps place a mapping without `MAP_FIXED` at its hint address when the whole range lies in a range still reserved by `sceKernelReserveVirtualRange`, as if `MAP_FIXED` were set. Taken from PPSA01474, which reserves 64 GiB and then maps its heaps inside it with hints and no `MAP_FIXED`, and uses the hint addresses afterwards; not measured on the console. Hints outside a reservation, or over a range that is partly mapped, stay hints
 - [Fixed anonymous mmap](../../../core/libs/prx/libkernel/DirectMemory/PosixMemory.cpp) (libkernel) - `MAP_PRIVATE | MAP_ANON | MAP_FIXED` replaces the requested range through the existing guest mapping machinery and zeroes the new memory. `MAP_EXCL` is checked under the allocation-registry mutation lock, including virtual reservations, and returns `ENOMEM` without changing an occupied range; without `MAP_FIXED` it is `EINVAL`. Lengths are rounded to 16 KiB and fixed addresses must be aligned. The complete rounded range must lie inside the guest arena or, for POSIX fixed anonymous `mmap` on Windows, one current or registered native thread stack; other mapping APIs do not opt into stack replacement. Native stack replacement keeps the reservation, decommits and recommits fresh pages, and rejects foreign allocations, ranges spanning reservations and host `PAGE_GUARD` pages before mutation. Current-stack ranges must end at least 64 KiB below the active host frame; callers replacing another thread's stack must coordinate with that thread. If recommitting fails, the call returns `ENOMEM` with the range still reserved; thread cleanup attempts to recommit it before restoring write access. This follows FreeBSD 11.4 [argument validation and rounding](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L226-L299), [fixed replacement](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1455-L1464), and [collision errno](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1604-L1613). The console behaviour has not been measured. AnyPS5 starts the guest arena at 0x200000000, so the fixed path rejects the low 0x400000 address requested by PICO-8 PPSA99808. The console address-space layout is unmeasured; executable placement outside the host arena is tracked in #5217. Static catalog disassembly finds `0x1012` in PPSA98001/PPSA99808 and `0x5012` in PPSA99808; these titles were not run.
 - [Mapping hints with no room above them](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - a mapping without `MAP_FIXED` whose hint lies above the guest address space, or has no free range at or above it, is placed from the bottom of the guest arena, as FreeBSD 11.4's [`vm_mmap_object`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_mmap.c#L1569) retries through [`vm_map_find_min`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/vm/vm_map.c#L1555-L1584) from its minimum address. FreeBSD's minimum is the end of the largest possible data segment rather than the start of the arena, and the console's address-space layout is not measured. PS5CEMU-HAR (PPSA99360) gives `sceKernelReserveVirtualRange` a hint near its own code, which is a host address here because the relinked executable lies outside the guest arena, so its JIT gets memory more than 2 GiB from its code and does not start
-- [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in a payload process on a PS5 (firmware 13.60), Increment returns -1 for an address outside every module (null, stack, heap) and 0 otherwise, and Decrement never fails, also without a matching Increment; the console's Decrement returns nothing, here 0. The module's `ref_count` did not change on the console. As in [fpPS4](https://github.com/red-prig/fpPS4), Increment here takes a reference on the image and Decrement releases one. The variants without the leading underscore are not exported by firmware 13.60's `libkernel_sys`; here they match
+- [_sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement](../../../core/libs/prx/libkernel/System/src/Rtld.cpp) (libkernel) - the argument is the `dso` address a title's `libc.prx` passes to `__cxa_thread_atexit` (PPSA14632), which fails when Increment returns nonzero. As in a payload process on a PS5 (firmware 13.60), Increment returns -1 for an address outside every module (null, stack, heap) and 0 otherwise, and Decrement never fails on an address outside every module or after a matching Increment; the console's Decrement returns nothing, here 0. A Decrement on a module's address without a matching Increment was not measured and throws here. The module's `ref_count` did not change on the console. As in [fpPS4](https://github.com/red-prig/fpPS4), Increment here takes a reference on the image and Decrement releases one. The variants without the leading underscore are not exported by firmware 13.60's `libkernel_sys`; here they match
 - [tcgetattr, tcsetattr](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel) - every file and pipe descriptor is taken as not a terminal (`ENOTTY`), and a socket gets `EADDRNOTAVAIL` for `AF_INET` and `EOPNOTSUPP` otherwise, as FreeBSD's `in_control` and `pru_control_notsupp` answer a termios ioctl; what descriptors 0 to 2 of a title are on the console, and whether any of them is a terminal there, is unknown
 - [cfsetspeed](../../../core/libs/prx/libkernel/File/src/Terminal.cpp) (libkernel, NID `C1MQ6OaXRjo`) - console behavior and module/library versions are unverified. The prototype, uint32 speed and 44-byte termios layout (input speed at 36, output speed at 40) follow the public PS5 payload SDK [termios.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/termios.h) and [sys/_termios.h](https://github.com/ps5-payload-dev/sdk/blob/a7685ce8e97ce1f8a4f38253a41d54241c9124f1/include/freebsd/sys/_termios.h). The module association follows its libkernel stub table and the NID rehashes to the aerolib name. Both speed fields accept every uint32 value and no flags or control characters change, as [FreeBSD 11.4 termios.c](https://github.com/freebsd/freebsd-src/blob/d106002967eff712894ab8b5337bbbff106ce5e0/lib/libc/gen/termios.c) does. No terminal I/O is performed. Null pointers throw where the reference dereferences them.
 - [select](../../../core/libs/prx/libkernel/Socket/src/Socket.cpp) (libkernel) - descriptor 0 is never reported readable and descriptors 1 and 2 are always writable, as for a console title with no input; reads from descriptor 0 still go to the host stdin. `/dev/random` and `/dev/urandom` follow `randomdev_poll` for a seeded device under [`selscan`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_generic.c#L1178-L1236), which asks once with the flags of every set the descriptor is in: in the read set they are readable and reported in no other set, and otherwise they are reported in the write and exception sets they were asked in. A regular file, a directory or a file read from app0.zar is always readable and writable and never in the exception set, as `vop_stdpoll` answers, on every host. Guest sockets and libSceNet sockets are polled. A kqueue is readable while one of its events is triggered and is never writable or in the exception set, as FreeBSD 11.4's [`kqueue_poll`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/kern_event.c#L1900-L1924) answers, on every host. Other descriptors are polled through the host on Linux, while on Windows pipes are checked every millisecond with the readiness test `poll` uses and any other descriptor throws. Dungeons (PPSA16064) selects on descriptor 0, and RetroArch (PPSA99169) selects on its web server's wake-up pipe next to its listening socket

From 138bde1cd60be574bf79782d161ec4a0cf956ff3 Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Sat, 24 Oct 2026 03:08:51 -0300
Subject: [PATCH 068/218] test(libkernel): drop the assertion on the
 unsupported thread atexit decrement

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/tests/GuestDynamicLoader.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/core/libs/tests/GuestDynamicLoader.cpp b/core/libs/tests/GuestDynamicLoader.cpp
index afcc355f26..d9de8873df 100644
--- a/core/libs/tests/GuestDynamicLoader.cpp
+++ b/core/libs/tests/GuestDynamicLoader.cpp
@@ -229,7 +229,6 @@ int main(int argc, char** argv) {
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(add)) == 0);
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
     Require(_sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&ThrowsRuntimeError<void (*)()>)) == 0);
-    Require(ThrowsRuntimeError([] { _sceKernelRtldThreadAtexitDecrement_nid_postfix(reinterpret_cast<const void*>(&Require)); }));
     int local = 0;
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(&local) == -1);
     Require(_sceKernelRtldThreadAtexitIncrement_nid_postfix(nullptr) == -1);

From e7d3411eeab5079cfc87dc89b751c3e2dc147ee7 Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 14:51:33 -0400
Subject: [PATCH 069/218] fix(libc): compute nextafter and nextafterf with
 FreeBSD msun's algorithm, as titles' libc.prx does

nextafter and nextafterf returned the host's functions. On Windows they
set ERANGE for a step from zero to the smallest subnormal, which the
titles' copies do not, and pick a different NaN when both arguments are
NaNs. The titles' copies are FreeBSD msun's s_nextafter.c and
s_nextafterf.c with ERANGE at msun's overflow and underflow returns; both
functions now compute that, choosing the NaN explicitly so the compiler
cannot reorder msun's x + y.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/Math.cpp | 54 +++++++++++++++++++++++++++--
 core/libs/tests/GuestMath.cpp   | 60 +++++++++++++++++++++++++++++++++
 docs/dev/debt/libc.md           |  1 +
 3 files changed, 113 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp
index 0a834bdebc..9f365e60e1 100644
--- a/core/libs/prx/libc/src/Math.cpp
+++ b/core/libs/prx/libc/src/Math.cpp
@@ -834,8 +834,58 @@ float APS5_VABI cbrtf_nid_postfix(float x) {
     return static_cast<float>(T);
 }
 float APS5_VABI remainderf_nid_postfix(float x, float y) { return std::remainder(x, y); }
-float APS5_VABI nextafterf_nid_postfix(float x, float y) { return std::nextafter(x, y); }
-double APS5_VABI nextafter_nid_postfix(double x, double y) { return std::nextafter(x, y); }
+float APS5_VABI nextafterf_nid_postfix(float x, float y) {
+    const std::uint32_t ux = std::bit_cast<std::uint32_t>(x);
+    const std::uint32_t uy = std::bit_cast<std::uint32_t>(y);
+    if ((ux & 0x7fffffffu) > 0x7f800000u || (uy & 0x7fffffffu) > 0x7f800000u) {
+        volatile float sum = x + y;
+        (void)sum;
+        return std::bit_cast<float>(((ux & 0x7fffffffu) > 0x7f800000u ? ux : uy) | 0x00400000u);
+    }
+    if (x == y) {
+        return y;
+    }
+    if ((ux & 0x7fffffffu) == 0) {
+        return std::bit_cast<float>((uy & 0x80000000u) | 1u);
+    }
+    const bool towardZero = (x > 0.0f) == (x > y);
+    const std::uint32_t next = towardZero ? ux - 1 : ux + 1;
+    const std::uint32_t exponent = next & 0x7f800000u;
+    if (exponent == 0x7f800000u) {
+        errno = ERANGE;
+        return x + x;
+    }
+    if (exponent == 0) {
+        errno = ERANGE;
+    }
+    return std::bit_cast<float>(next);
+}
+double APS5_VABI nextafter_nid_postfix(double x, double y) {
+    const std::uint64_t ux = std::bit_cast<std::uint64_t>(x);
+    const std::uint64_t uy = std::bit_cast<std::uint64_t>(y);
+    if ((ux & 0x7fffffffffffffffull) > 0x7ff0000000000000ull || (uy & 0x7fffffffffffffffull) > 0x7ff0000000000000ull) {
+        volatile double sum = x + y;
+        (void)sum;
+        return std::bit_cast<double>(((ux & 0x7fffffffffffffffull) > 0x7ff0000000000000ull ? ux : uy) | 0x0008000000000000ull);
+    }
+    if (x == y) {
+        return y;
+    }
+    if ((ux & 0x7fffffffffffffffull) == 0) {
+        return std::bit_cast<double>((uy & 0x8000000000000000ull) | 1u);
+    }
+    const bool towardZero = (x > 0.0) == (x > y);
+    const std::uint64_t next = towardZero ? ux - 1 : ux + 1;
+    const std::uint64_t exponent = next & 0x7ff0000000000000ull;
+    if (exponent == 0x7ff0000000000000ull) {
+        errno = ERANGE;
+        return x + x;
+    }
+    if (exponent == 0) {
+        errno = ERANGE;
+    }
+    return std::bit_cast<double>(next);
+}
 int APS5_VABI __isfinite_nid_postfix(double x) { return std::isfinite(x) ? 1 : 0; }
 int APS5_VABI __isnan_nid_postfix(double x) { return std::isnan(x) ? 1 : 0; }
 int APS5_VABI __isinf_nid_postfix(double x) { return std::isinf(x) ? 1 : 0; }
diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp
index 161769a12f..911314e7c0 100644
--- a/core/libs/tests/GuestMath.cpp
+++ b/core/libs/tests/GuestMath.cpp
@@ -712,6 +712,65 @@ static void CheckExpm1ConsoleBits() {
     }
 }
 
+static void CheckNextafterConsoleBits() {
+    constexpr struct {
+        std::uint64_t x;
+        std::uint64_t y;
+        std::uint64_t expected;
+        int expectedErrno;
+    } cases[] = {
+        {0x0000000000000000ull, 0x3ff0000000000000ull, 0x0000000000000001ull, 0},
+        {0x8000000000000000ull, 0xbff0000000000000ull, 0x8000000000000001ull, 0},
+        {0x0000000000000001ull, 0x0000000000000000ull, 0x0000000000000000ull, ERANGE},
+        {0x8000000000000001ull, 0x3ff0000000000000ull, 0x8000000000000000ull, ERANGE},
+        {0x0010000000000000ull, 0x0000000000000000ull, 0x000fffffffffffffull, ERANGE},
+        {0x000fffffffffffffull, 0x3ff0000000000000ull, 0x0010000000000000ull, 0},
+        {0x7fefffffffffffffull, 0x7ff0000000000000ull, 0x7ff0000000000000ull, ERANGE},
+        {0xffefffffffffffffull, 0xfff0000000000000ull, 0xfff0000000000000ull, ERANGE},
+        {0x7ff0000000000000ull, 0x0000000000000000ull, 0x7fefffffffffffffull, 0},
+        {0x3ff0000000000000ull, 0x4000000000000000ull, 0x3ff0000000000001ull, 0},
+        {0x3ff0000000000000ull, 0x3ff0000000000000ull, 0x3ff0000000000000ull, 0},
+        {0x8000000000000000ull, 0x0000000000000000ull, 0x0000000000000000ull, 0},
+        {0x7ff0000000000001ull, 0x3ff0000000000000ull, 0x7ff8000000000001ull, 0},
+        {0x3ff0000000000000ull, 0xfff8000000000123ull, 0xfff8000000000123ull, 0},
+        {0x7ff8000000000123ull, 0xfff8000000000456ull, 0x7ff8000000000123ull, 0},
+        {0xfff8000000000456ull, 0x7ff0000000000001ull, 0xfff8000000000456ull, 0},
+    };
+    for (const auto& item : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(nextafter_nid_postfix(std::bit_cast<double>(item.x), std::bit_cast<double>(item.y))) == item.expected);
+        Require(errno == (item.expectedErrno != 0 ? item.expectedErrno : 1234));
+    }
+    constexpr struct {
+        std::uint32_t x;
+        std::uint32_t y;
+        std::uint32_t expected;
+        int expectedErrno;
+    } floatCases[] = {
+        {0x00000000u, 0x3f800000u, 0x00000001u, 0},
+        {0x80000000u, 0xbf800000u, 0x80000001u, 0},
+        {0x00000001u, 0x00000000u, 0x00000000u, ERANGE},
+        {0x80000001u, 0x3f800000u, 0x80000000u, ERANGE},
+        {0x00800000u, 0x00000000u, 0x007fffffu, ERANGE},
+        {0x007fffffu, 0x3f800000u, 0x00800000u, 0},
+        {0x7f7fffffu, 0x7f800000u, 0x7f800000u, ERANGE},
+        {0xff7fffffu, 0xff800000u, 0xff800000u, ERANGE},
+        {0x7f800000u, 0x00000000u, 0x7f7fffffu, 0},
+        {0x3f800000u, 0x40000000u, 0x3f800001u, 0},
+        {0x3f800000u, 0x3f800000u, 0x3f800000u, 0},
+        {0x80000000u, 0x00000000u, 0x00000000u, 0},
+        {0x7f800001u, 0x3f800000u, 0x7fc00001u, 0},
+        {0x3f800000u, 0xffc00123u, 0xffc00123u, 0},
+        {0x7fc00123u, 0xffc00456u, 0x7fc00123u, 0},
+        {0xffc00456u, 0x7f800001u, 0xffc00456u, 0},
+    };
+    for (const auto& item : floatCases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint32_t>(nextafterf_nid_postfix(std::bit_cast<float>(item.x), std::bit_cast<float>(item.y))) == item.expected);
+        Require(errno == (item.expectedErrno != 0 ? item.expectedErrno : 1234));
+    }
+}
+
 static void CheckAsinl() {
     const struct { std::uint64_t inputMantissa; std::uint16_t inputSignExponent; std::uint64_t outputMantissa; std::uint16_t outputSignExponent; } cases[] = {
         {0, 0x0000, 0, 0x0000}, {0, 0x8000, 0, 0x8000},
@@ -1669,6 +1728,7 @@ int main() {
     CheckLongDouble();
     CheckNearbyintl();
     CheckExpm1ConsoleBits();
+    CheckNextafterConsoleBits();
     CheckAsinl();
     Require(scalbn_nid_postfix(0.75, -2) == 0.1875);
     Require(scalbnf_nid_postfix(0.75f, 4) == 12.f);
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index 675a798cb5..0a6ee75ab4 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -100,6 +100,7 @@
 - [lgamma and signgam](../../../core/libs/prx/libc/src/Math.cpp) (libc) - `lgamma` returns the host's `lgamma` and stores the sign of Γ(x) in the exported `signgam` (NID `5gOOC0kzW0c`, starting at 0 as in FreeBSD 11's [`s_signgam.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/s_signgam.c)) by the rules of [`e_lgamma_r.c`](https://github.com/freebsd/freebsd-src/blob/stable/11/lib/msun/src/e_lgamma_r.c): -1 for -0 and for a negative non-integer whose floor is odd, 1 otherwise, including poles, infinities and NaN. Taken from the FreeBSD source, not measured on the console. The NID is in the aerolib symbol list; no title is known to read `signgam`. PPSA99004 imports `lgamma`
 - [coshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows FreeBSD msun's [`e_coshf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_coshf.c), using the `expm1f` and `expf` paths already inlined for `sinhf` below; the Windows UCRT differed from the `libc.prx` copies in PPSA07923 and PPSA13934 on 500,554 and 500,614 of 20 million inputs in the #9707 survey. The exact system `libSceLibcInternal` behavior and the FMA-contracted `libc.prx` results remain unverified
 - [expm1](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_expm1.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_expm1.c) with `huge` read at run time, and sets `ERANGE` only when a finite argument overflows to infinity, as the titles' `libc.prx` does. It gives the same bits and `errno` as the `expm1` bundled with PPSA07923 and PPSA05916 on 320 million random and 47,222 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 43,433 of the random ones.
+- [nextafter and nextafterf](../../../core/libs/prx/libc/src/Math.cpp) (libc) do not compare floating-point exceptions, and their inputs are checked by sampling, not exhaustively. They are FreeBSD msun's [`s_nextafter.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafter.c) and [`s_nextafterf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafterf.c), with `ERANGE` at msun's overflow and underflow returns as the titles' `libc.prx` sets it; a step away from zero returns early and sets none. The copies bundled with eleven titles give the same bits and `errno` on 4,000,784 sampled pairs per function on a Windows host.
 - [sinhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `sinhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_sinhf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_sinhf.c) from before `__ldexp_expf`, which squares `expf(|x| / 2)` between `logf(FLT_MAX)` and the overflow threshold, calling msun's [`expm1f`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_expm1f.c) and [`expf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_expf.c), whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets `errno` to `ERANGE` before returning `x * 1e37`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system `libSceLibcInternal`, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return `libc.prx`, has the same code is assumed
 - [acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (`y0f`, `y1f`, `ynf` follow the console at `+-0`). As in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x56410), `lgammal` does not store the sign in `signgam`; `hypotl` returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. [hypot3, hypot3f and hypot3l](../../../core/libs/prx/libc/src/Math.cpp) follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two
 - [asinl](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `asinl` of the `libc.prx` bundled with PPSA28319 (disassembly), FreeBSD msun's [`e_asinl.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/src/e_asinl.c) with the ld80 [`invtrig.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/ld80/invtrig.c) coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, so a NaN argument also sets `EDOM`; msun itself sets no `errno`. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word `0x37f`), but guest threads do not set it: on Windows a thread started by `_beginthreadex` runs at 53 bits (`0x27f`), where `asinl(0.75)` returns mantissa `0xd91a98ae3406e000` instead of `0xd91a98ae3406e041`. The system `libSceLibcInternal` that RetroArch (PPSA99169) imports is assumed to have the same code

From 676a0e007250a92f8f768e95cb4cbf713abc57cc Mon Sep 17 00:00:00 2001
From: atharvjairath <54663702+atharvjairath@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:40:33 +0530
Subject: [PATCH 070/218] feat(fiber): execute contextless fibers on the caller
 stack

---
 core/libs/prx/libSceFiber/CMakeLists.txt |   4 +-
 core/libs/prx/libSceFiber/Export.cpp     |  46 ++++--
 core/libs/tests/Fiber.cpp                | 198 ++++++++++++++++++++++-
 docs/dev/debt/libSceFiber.md             |   2 +-
 4 files changed, 230 insertions(+), 20 deletions(-)

diff --git a/core/libs/prx/libSceFiber/CMakeLists.txt b/core/libs/prx/libSceFiber/CMakeLists.txt
index 883b7fc154..ef08d950c5 100644
--- a/core/libs/prx/libSceFiber/CMakeLists.txt
+++ b/core/libs/prx/libSceFiber/CMakeLists.txt
@@ -8,9 +8,11 @@ if(BUILD_TESTING)
     target_include_directories(fiber_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(fiber_tests PRIVATE libSceFiber libc)
     add_test(NAME fiber COMMAND fiber_tests)
+    add_test(NAME fiber_contextless COMMAND fiber_tests --contextless)
     add_asan_test_options(fiber detect_stack_use_after_return=0)
+    add_asan_test_options(fiber_contextless detect_stack_use_after_return=0)
     if(WIN32)
-        set_tests_properties(fiber PROPERTIES ENVIRONMENT_MODIFICATION
+        set_tests_properties(fiber fiber_contextless PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFiber>")
     endif()
 endif()
diff --git a/core/libs/prx/libSceFiber/Export.cpp b/core/libs/prx/libSceFiber/Export.cpp
index e214387ae3..535bf1d7e9 100644
--- a/core/libs/prx/libSceFiber/Export.cpp
+++ b/core/libs/prx/libSceFiber/Export.cpp
@@ -107,14 +107,17 @@ static bool TraceFibers() {
 static void CompletePendingSuspend() {
     auto& thread = ThreadState();
     if (thread.pendingSuspend) {
-        thread.pendingSuspend->state.store(FiberState::Suspended, std::memory_order_release);
+        auto* fiber = thread.pendingSuspend;
+        const auto state = fiber->context ? FiberState::Suspended : FiberState::Idle;
+        if (!fiber->context) fiber->savedStack = nullptr;
+        fiber->state.store(state, std::memory_order_release);
         thread.pendingSuspend = nullptr;
     }
 }
 
 #ifdef _WIN32
 
-extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void* load);
+extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void** load, Fiber* start);
 extern "C" void Aps5FiberTrampoline_nid_no_patch();
 
 asm(R"(
@@ -144,7 +147,12 @@ Aps5FiberSwitchStack_nid_no_patch:
     stmxcsr 0xa0(%rsp)
     fnstcw 0xa4(%rsp)
     mov %rsp, (%rcx)
-    mov %rdx, %rsp
+    mov (%rdx), %rsp
+    test %r8, %r8
+    jz 1f
+    mov %r8, %r12
+    jmp Aps5FiberTrampoline_nid_no_patch
+1:
     movaps 0x00(%rsp), %xmm6
     movaps 0x10(%rsp), %xmm7
     movaps 0x20(%rsp), %xmm8
@@ -215,7 +223,7 @@ static void UnpinStack(const void* context, std::uint64_t bytes) {
 
 #else
 
-extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void* load);
+extern "C" void Aps5FiberSwitchStack_nid_no_patch(void** save, void** load, Fiber* start);
 extern "C" void Aps5FiberTrampoline_nid_no_patch();
 
 asm(".text\n"
@@ -230,7 +238,12 @@ asm(".text\n"
     stmxcsr 0(%rsp)
     fnstcw 4(%rsp)
     mov %rsp, (%rdi)
-    mov %rsi, %rsp
+    mov (%rsi), %rsp
+    test %rdx, %rdx
+    jz 1f
+    mov %rdx, %r12
+    jmp )" APS5_ASM_SYMBOL("Aps5FiberTrampoline_nid_no_patch") R"(
+1:
     ldmxcsr 0(%rsp)
     fldcw 4(%rsp)
     add $8, %rsp
@@ -338,6 +351,7 @@ static std::uint8_t* StackTop(const Fiber* fiber) {
 }
 
 static std::uint64_t* SizedWindow(const Fiber* fiber) {
+    if (!fiber->context) return nullptr;
     return reinterpret_cast<std::uint64_t*>(StackTop(fiber) - fiber->contextSize);
 }
 
@@ -363,6 +377,10 @@ static Fiber* AsFiber(FiberObject* object) {
 
 extern "C" [[noreturn]] void Aps5FiberMain_nid_no_patch(Fiber* fiber) {
     CompletePendingSuspend();
+    if (!fiber->context && fiber->setFpuRegisters) {
+        _mm_setcsr(FIBER_DEFAULT_MXCSR);
+        asm volatile("fldcw %0" : : "m"(FIBER_DEFAULT_FPU_CONTROL));
+    }
     fiber->entry(fiber->argOnInitialize, ThreadState().transfer);
     throw std::runtime_error(std::string("sceFiber: entry function of fiber '") + fiber->name + "' returned");
 }
@@ -393,13 +411,7 @@ static bool AcquireForResume(Fiber* target) {
         }
         if (state != FiberState::Idle && state != FiberState::Suspended) return false;
         if (target->state.compare_exchange_weak(state, FiberState::Running, std::memory_order_acq_rel)) {
-            if (state == FiberState::Idle) {
-                if (!target->context) {
-                    target->state.store(FiberState::Idle, std::memory_order_release);
-                    throw std::runtime_error(std::string("sceFiber: fiber '") + target->name + "' has no context; running a fiber on the stack of its caller is not supported");
-                }
-                PrepareInitialStack(target);
-            }
+            if (state == FiberState::Idle && target->context) PrepareInitialStack(target);
             return true;
         }
     }
@@ -447,7 +459,7 @@ static int32_t AcquireWithContext(Fiber* target, void* addr_context, uint64_t si
 
 static void Resume(Fiber* target, void** save, std::uint64_t argOnRun) {
     const auto* frame = static_cast<const InitialFrame*>(target->savedStack);
-    if (frame->returnAddress == 0) {
+    if (target->context && frame->returnAddress == 0) {
         std::fprintf(stderr, "[fiber] resuming '%s' with a wiped context: saved=%p context=%p size=0x%llx\n", target->name, target->savedStack,
                      static_cast<void*>(target->context), static_cast<unsigned long long>(target->contextSize));
         const auto* words = static_cast<const std::uint64_t*>(target->savedStack);
@@ -457,8 +469,8 @@ static void Resume(Fiber* target, void** save, std::uint64_t argOnRun) {
     }
     ThreadState().current = target;
     ThreadState().transfer = argOnRun;
-    SetBounds(FiberBounds(target));
-    Aps5FiberSwitchStack_nid_no_patch(save, target->savedStack);
+    SetBounds(target->context ? FiberBounds(target) : ThreadState().threadBounds);
+    Aps5FiberSwitchStack_nid_no_patch(save, target->context ? &target->savedStack : &ThreadState().threadStack, target->context ? nullptr : target);
 }
 
 static int32_t InitializeFiber(FiberObject* object, const char* name, GuestFiberEntry entry, uint64_t arg_on_initialize, void* addr_context, uint64_t size_context, uint32_t flags) {
@@ -559,7 +571,7 @@ int32_t APS5_VABI sceFiberReturnToThread(uint64_t arg_on_return, uint64_t* arg_o
     ThreadState().current = nullptr;
     ThreadState().transfer = arg_on_return;
     SetBounds(ThreadState().threadBounds);
-    Aps5FiberSwitchStack_nid_no_patch(&self->savedStack, ThreadState().threadStack);
+    Aps5FiberSwitchStack_nid_no_patch(&self->savedStack, &ThreadState().threadStack, nullptr);
     CompletePendingSuspend();
     if (arg_on_run) *arg_on_run = ThreadState().transfer;
     return SCE_OK;
@@ -582,7 +594,7 @@ int32_t APS5_VABI sceFiberGetInfo(FiberObject* object, FiberInfo* fiber_info) {
     fiber_info->size_context = fiber->contextSize;
     std::memcpy(fiber_info->name, fiber->name, sizeof(fiber_info->name));
     fiber_info->size_context_margin = static_cast<uint64_t>(-1);
-    if (fiber->contextSizeCheck) {
+    if (fiber->contextSizeCheck && fiber->context) {
         const auto* words = SizedWindow(fiber);
         const auto* end = words + fiber->contextSize / sizeof(std::uint64_t);
         fiber_info->size_context_margin = static_cast<uint64_t>(std::find_if(words, end, [](std::uint64_t word) { return word != FIBER_CONTEXT_FILL; }) - words) * sizeof(std::uint64_t);
diff --git a/core/libs/tests/Fiber.cpp b/core/libs/tests/Fiber.cpp
index f6b532900b..d8a6880d7c 100644
--- a/core/libs/tests/Fiber.cpp
+++ b/core/libs/tests/Fiber.cpp
@@ -4,6 +4,7 @@
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <string_view>
 #include <thread>
 #include <xmmintrin.h>
 #ifdef _WIN32
@@ -325,6 +326,195 @@ void RunInternalOptions() {
     Require(sceFiberFinalize(fiber) == 0, "finalize fpu defaults fiber");
 }
 
+std::array<FiberStorage, 2> g_contextlessStorage;
+std::array<unsigned, 2> g_contextlessEntries{};
+alignas(16) std::array<unsigned char, 65536> g_transitionContext;
+FiberStorage g_transitionStorage;
+auto* const g_transition = reinterpret_cast<FiberObject*>(&g_transitionStorage);
+std::uintptr_t g_callerStack = 0;
+std::uint64_t g_contextlessFramePointer = 0;
+unsigned g_contextlessHops = 0;
+#ifdef _WIN32
+void* g_callerBase = nullptr;
+void* g_callerLimit = nullptr;
+#endif
+
+FiberObject* Contextless(unsigned index) {
+    return reinterpret_cast<FiberObject*>(&g_contextlessStorage[index]);
+}
+
+void APS5_VABI ContextlessEntry(std::uint64_t index, std::uint64_t run) {
+    ++g_contextlessEntries[index];
+    auto* self = Contextless(index);
+    FiberObject* current = nullptr;
+    Require(sceFiberGetSelf(&current) == 0 && current == self, "contextless entry self");
+    FiberInfo info{};
+    info.size = sizeof(info);
+    Require(sceFiberGetInfo(self, &info) == 0, "contextless entry info");
+    if (info.addr_context) {
+        Require(run == 90, "attaching after contextless execution restarts entry");
+        for (;;) sceFiberReturnToThread(run + 1, &run);
+    }
+    Require(info.size_context == 0 && info.size_context_margin == ~0ull, "contextless info has no stack or margin");
+    std::uint64_t framePointer = 0;
+    Require(sceFiberGetThreadFramePointerAddress(&framePointer) == 0 && framePointer == g_contextlessFramePointer, "contextless entry preserves the caller frame pointer");
+    Require(sceFiberRun_nid_postfix(self, 0, nullptr) == FiberErrorPermission, "contextless entry cannot run a fiber");
+    Require(sceFiberSwitch(self, 0, nullptr) == FiberErrorState, "contextless entry cannot switch to itself");
+    Require(sceFiberFinalize(self) == FiberErrorState, "contextless entry cannot finalize itself");
+    volatile std::uint64_t marker = 0;
+    const auto address = reinterpret_cast<std::uintptr_t>(&marker);
+    Require(address < g_callerStack && g_callerStack - address < 32768, "contextless execution uses calling thread stack");
+    _mm_setcsr(_mm_getcsr() ^ 0x8000u);
+#ifdef _WIN32
+    const auto* tib = reinterpret_cast<const NT_TIB*>(NtCurrentTeb());
+    Require(tib->StackBase == g_callerBase && tib->StackLimit == g_callerLimit, "contextless execution restores thread stack bounds");
+#endif
+    if (run == 2) {
+        sceFiberSwitch(Contextless(1), 1, nullptr);
+    } else if (run == 3) {
+        _sceFiberAttachContextAndSwitch(g_transition, g_transitionContext.data(), g_transitionContext.size(), 50, nullptr);
+    } else if (run == 4) {
+        sceFiberSwitch(g_transition, 70, nullptr);
+    } else if (run == 5) {
+        if (++g_contextlessHops < 1024) sceFiberSwitch(Contextless(1 - index), 5, nullptr);
+        sceFiberReturnToThread(999, nullptr);
+    } else {
+        Require(run == 1, "contextless run argument");
+        sceFiberReturnToThread(200 + index, nullptr);
+    }
+    Require(false, "contextless fiber must restart rather than resume after yielding");
+}
+
+void APS5_VABI TransitionEntry(std::uint64_t, std::uint64_t run) {
+    Require(run == 50, "contextless source attaches target");
+    Require(sceFiberReturnToThread(777, &run) == 0 && run == 55, "attached target resumes after contextless source");
+    Require(_sceFiberAttachContextAndSwitch(Contextless(1), nullptr, 0, 1, &run) == 0 && run == 60, "attached source resumes after contextless target");
+    Require(sceFiberSwitch(Contextless(0), 4, &run) == 0 && run == 70, "contextless target switches back to suspended attached source");
+    for (;;) sceFiberReturnToThread(778, nullptr);
+}
+
+[[gnu::noinline]] std::int32_t RunContextless(FiberObject* fiber, std::uint64_t run, std::uint64_t* returned, bool attach = false) {
+    register std::uint64_t savedRbx asm("rbx") = 0x123456789abcdef0ull;
+    register std::uint64_t savedR12 asm("r12") = 0x23456789abcdef01ull;
+    register std::uint64_t savedR13 asm("r13") = 0x3456789abcdef012ull;
+    register std::uint64_t savedR14 asm("r14") = 0x456789abcdef0123ull;
+    register std::uint64_t savedR15 asm("r15") = 0x56789abcdef01234ull;
+    asm volatile("" : "+r"(savedRbx), "+r"(savedR12), "+r"(savedR13), "+r"(savedR14), "+r"(savedR15));
+    g_contextlessFramePointer = reinterpret_cast<std::uint64_t>(__builtin_frame_address(0));
+    const auto result = attach ? _sceFiberAttachContextAndRun(fiber, nullptr, 0, run, returned) : sceFiberRun_nid_postfix(fiber, run, returned);
+    asm volatile("" : "+r"(savedRbx), "+r"(savedR12), "+r"(savedR13), "+r"(savedR14), "+r"(savedR15) : : "memory");
+    Require(savedRbx == 0x123456789abcdef0ull && savedR12 == 0x23456789abcdef01ull && savedR13 == 0x3456789abcdef012ull && savedR14 == 0x456789abcdef0123ull && savedR15 == 0x56789abcdef01234ull, "contextless return restores caller nonvolatile registers");
+    return result;
+}
+
+void RunContextlessTransitions() {
+    volatile std::uint64_t marker = 0;
+    g_callerStack = reinterpret_cast<std::uintptr_t>(&marker);
+#ifdef _WIN32
+    const auto* tib = reinterpret_cast<const NT_TIB*>(NtCurrentTeb());
+    g_callerBase = tib->StackBase;
+    g_callerLimit = tib->StackLimit;
+#endif
+    for (unsigned index = 0; index < 2; ++index) {
+        Require(_sceFiberInitializeWithInternalOptionImpl(Contextless(index), "contextless", ContextlessEntry, index, nullptr, 0, nullptr, 0x10, 0) == 0, "initialize contextless transition fiber with size checking");
+    }
+    Require(_sceFiberInitializeImpl_nid_postfix(g_transition, "transition", TransitionEntry, 0, nullptr, 0, nullptr, 0) == 0, "initialize transition target");
+    std::uint64_t returned = 0;
+    const auto csr = _mm_getcsr();
+    Require(RunContextless(Contextless(0), 1, &returned) == 0 && returned == 200, "first contextless run");
+    Require(_mm_getcsr() == csr, "contextless return restores thread MXCSR");
+    Require(RunContextless(Contextless(0), 1, &returned) == 0 && returned == 200 && g_contextlessEntries[0] == 2, "contextless return discards continuation");
+    Require(RunContextless(Contextless(0), 2, &returned, true) == 0 && returned == 201, "contextless to contextless switch");
+    Require(RunContextless(Contextless(1), 1, &returned) == 0 && returned == 201 && g_contextlessEntries[1] == 2, "contextless switch target restarts");
+    Require(RunContextless(Contextless(0), 3, &returned) == 0 && returned == 777, "contextless to attached switch");
+    Require(RunContextless(g_transition, 55, &returned) == 0 && returned == 201, "attached to contextless switch");
+    Require(RunContextless(g_transition, 60, &returned) == 0 && returned == 778, "switch through contextless entry back to attached fiber");
+    Require(_sceFiberAttachContextAndRun(Contextless(0), g_firstContext.data(), g_firstContext.size(), 90, &returned) == 0 && returned == 91, "attach after abandoning contextless stack");
+    Require(sceFiberRun_nid_postfix(Contextless(0), 100, &returned) == 0 && returned == 101 && g_contextlessEntries[0] == 6, "attached continuation persists after contextless runs");
+    std::thread([&] {
+        volatile std::uint64_t workerMarker = 0;
+        g_callerStack = reinterpret_cast<std::uintptr_t>(&workerMarker);
+#ifdef _WIN32
+        const auto* workerTib = reinterpret_cast<const NT_TIB*>(NtCurrentTeb());
+        g_callerBase = workerTib->StackBase;
+        g_callerLimit = workerTib->StackLimit;
+#endif
+        Require(RunContextless(Contextless(1), 1, &returned) == 0 && returned == 201 && g_contextlessEntries[1] == 4, "contextless fiber restarts on another thread's stack");
+    }).join();
+    Require(sceFiberFinalize(Contextless(0)) == 0 && sceFiberFinalize(Contextless(1)) == 0 && sceFiberFinalize(g_transition) == 0, "finalize contextless transition fibers");
+    g_callerStack = reinterpret_cast<std::uintptr_t>(&marker);
+#ifdef _WIN32
+    g_callerBase = tib->StackBase;
+    g_callerLimit = tib->StackLimit;
+#endif
+    for (unsigned index = 0; index < 2; ++index) {
+        Require(_sceFiberInitializeImpl_nid_postfix(Contextless(index), "restart loop", ContextlessEntry, index, nullptr, 0, nullptr, 0) == 0, "initialize contextless restart loop");
+    }
+    Require(RunContextless(Contextless(0), 5, &returned) == 0 && returned == 999 && g_contextlessHops == 1024, "contextless switch loop reuses the caller stack");
+    Require(RunContextless(Contextless(1), 1, nullptr, true) == 0, "contextless run permits a null return output");
+    Require(sceFiberFinalize(Contextless(0)) == 0 && sceFiberFinalize(Contextless(1)) == 0, "finalize contextless restart loop");
+}
+
+std::uint16_t ReadFpuControl() {
+    std::uint16_t control = 0;
+    asm volatile("fnstcw %0" : "=m"(control));
+    return control;
+}
+
+void WriteFpuControl(std::uint16_t control) {
+    asm volatile("fldcw %0" : : "m"(control));
+}
+
+constexpr std::uint64_t ContextlessInitializeArgument = 0xfedcba9876543210ull;
+constexpr std::uint64_t ContextlessRunArgument = 0x8123456789abcdefull;
+constexpr std::uint32_t ContextlessCsr = 0x7f80;
+constexpr std::uint16_t ContextlessControl = 0x0b7f;
+unsigned g_contextlessOptionEntries = 0;
+
+void APS5_VABI ContextlessOptionsEntry(std::uint64_t initialized, std::uint64_t run) {
+    Require(initialized == ContextlessInitializeArgument && run == ContextlessRunArgument, "contextless entry keeps 64-bit arguments");
+    ++g_contextlessOptionEntries;
+    const auto result = (static_cast<std::uint64_t>(ReadFpuControl()) << 32) | _mm_getcsr();
+    _mm_setcsr(0x1f80);
+    WriteFpuControl(0x037f);
+    sceFiberReturnToThread(result, nullptr);
+    Require(false, "contextless options entry cannot resume after returning");
+}
+
+void APS5_VABI ContextlessFpuSource(std::uint64_t, std::uint64_t target) {
+    _mm_setcsr(ContextlessCsr);
+    WriteFpuControl(ContextlessControl);
+    sceFiberSwitch(reinterpret_cast<FiberObject*>(target), ContextlessRunArgument, nullptr);
+    Require(false, "contextless FPU source is not resumed");
+}
+
+void RunContextlessOptions() {
+    FiberStorage storage{};
+    FiberStorage sourceStorage{};
+    auto* fiber = reinterpret_cast<FiberObject*>(&storage);
+    auto* source = reinterpret_cast<FiberObject*>(&sourceStorage);
+    const auto callerCsr = _mm_getcsr();
+    const auto callerControl = ReadFpuControl();
+    for (const auto flags : {0u, 0x100u}) {
+        Require(_sceFiberInitializeWithInternalOptionImpl(fiber, "contextless options", ContextlessOptionsEntry, ContextlessInitializeArgument, nullptr, 0, nullptr, flags, 0) == 0, "initialize contextless FPU options");
+        _mm_setcsr(ContextlessCsr);
+        WriteFpuControl(ContextlessControl);
+        const auto expected = flags ? (0x037full << 32) | 0x9fc0u : (static_cast<std::uint64_t>(ContextlessControl) << 32) | ContextlessCsr;
+        std::uint64_t returned = 0;
+        for (unsigned restart = 0; restart < 2; ++restart) {
+            Require(sceFiberRun_nid_postfix(fiber, ContextlessRunArgument, &returned) == 0 && returned == expected, "contextless FPU policy applies on each run");
+            Require(_mm_getcsr() == ContextlessCsr && ReadFpuControl() == ContextlessControl, "contextless return restores caller FPU registers");
+        }
+        _mm_setcsr(callerCsr);
+        WriteFpuControl(callerControl);
+        Require(_sceFiberInitializeImpl_nid_postfix(source, "FPU source", ContextlessFpuSource, 0, g_transitionContext.data(), g_transitionContext.size(), nullptr, 0) == 0, "initialize attached FPU source");
+        Require(sceFiberRun_nid_postfix(source, reinterpret_cast<std::uint64_t>(fiber), &returned) == 0 && returned == expected, "contextless switch inherits or resets the source FPU registers");
+        Require(_mm_getcsr() == callerCsr && ReadFpuControl() == callerControl, "contextless switch restores the original caller FPU registers");
+        Require(sceFiberFinalize(fiber) == 0 && sceFiberFinalize(source) == 0, "finalize contextless FPU options");
+    }
+    Require(g_contextlessOptionEntries == 6, "contextless FPU entry restarts on runs and switches");
+}
+
 [[gnu::noinline]] std::int32_t RunFirst(std::uint64_t* returned) {
     g_threadFramePointer = reinterpret_cast<std::uint64_t>(__builtin_frame_address(0));
     const std::int32_t result = sceFiberRun_nid_postfix(g_first, 100, returned);
@@ -334,7 +524,13 @@ void RunInternalOptions() {
 
 }
 
-int main() {
+int main(int argc, char** argv) {
+    if (argc == 2 && std::string_view(argv[1]) == "--contextless") {
+        RunContextlessTransitions();
+        RunContextlessOptions();
+        return 0;
+    }
+    Require(argc == 1, "known test arguments");
     RunSmallContextFirst();
     FiberObject* self = nullptr;
     Require(sceFiberGetSelf(&self) == FiberErrorPermission, "no fiber on the thread");
diff --git a/docs/dev/debt/libSceFiber.md b/docs/dev/debt/libSceFiber.md
index f1c33e85c3..da142ae02b 100644
--- a/docs/dev/debt/libSceFiber.md
+++ b/docs/dev/debt/libSceFiber.md
@@ -8,6 +8,6 @@
 
 - [_sceFiberInitializeWithInternalOptionImpl](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - its signature and the flag values `0x1` (no ulobjmgr registration), `0x10` (context size check) and `0x100` (start with MXCSR `0x9fc0` and x87 control word `0x037f`) follow shadPS4's [initialize implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L150-L153) and [flags](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.h#L27-L32). Not measured on a console. `0x1` has no effect because no ulobjmgr exists; other flag bits throw. shadPS4 also sets `0x100` for `build_version` 3.50 and later in every initialize; `opt_param` and `build_version` are ignored.
 - [_sceFiberAttachContextAndRun, _sceFiberAttachContextAndSwitch](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - signatures and behaviour follow shadPS4's [run](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L260-L261), [switch](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L336-L337) and [attach](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L46-L79) implementations, not measured on a console. A context is attached only to an idle fiber initialized without one; a fiber that already has a context, or is not idle, returns `SCE_FIBER_ERROR_INVALID`. A size that is not a multiple of 16 returns `SCE_FIBER_ERROR_ALIGNMENT` as in initialize, where shadPS4 returns `SCE_FIBER_ERROR_INVALID`.
-- [Fibers without a context](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - running or switching to a fiber initialized without a context, before one is attached, throws. On the console such a fiber runs on the stack of its caller, per shadPS4's [run implementation](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L297-L313).
+- [Fibers without a context](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - caller-stack execution and restart after yielding follow shadPS4 at commit `f68923fe807f657348e6719ce658bcbd0a2b1c72` ([run](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L238-L307), [switch](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L309-L360), [return](https://github.com/shadps4-emu/shadPS4/blob/f68923fe807f657348e6719ce658bcbd0a2b1c72/src/core/libraries/fiber/fiber.cpp#L376-L401)), not measurements on a PS5. The original calling thread stack is reused even when switching from an attached fiber; contextless continuations are discarded.
 - [_sceFiberGetThreadFramePointerAddress](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber, NID `0dy4JtMUcMQ`) forwards to `sceFiberGetThreadFramePointerAddress`; that the argument list matches is inferred from the export without the underscore, as for the underscore Ult exports, not measured
 - [Fiber stacks](../../../core/libs/prx/libSceFiber/Export.cpp) (libSceFiber) - a fiber whose context is smaller than 64 KiB runs on an mmap'd host stack of its context size plus 1 MiB, so host calls made from it (21 KiB deep when PPSA01341 reaches SPIRV-Tools from a 16 KiB context) do not overwrite the contexts packed next to it; a larger context is the stack, as on the console. PPSA05684 needs the second: its job fibers have 64 KiB and 512 KiB contexts, the 512 KiB ones at 1 MiB-aligned addresses, and find their job record by masking the stack pointer (`~0xfffff` for the 512 KiB ones), which a host stack breaks (the game waits forever in GameInit, or faults later in a 64 KiB fiber). The 64 KiB limit is chosen between these two titles, not measured: a title with small contexts that also derives state from the stack pointer, or one whose host calls exceed what is left of a large context, is not covered

From 182e2a227f47286536d9852340badc8e088e5581 Mon Sep 17 00:00:00 2001
From: JAB-dev <68183649+JAB-dev@users.noreply.github.com>
Date: Sat, 24 Oct 2026 12:25:45 +0200
Subject: [PATCH 071/218] docs(libSceNgs2): say that the mastering gain ramps
 after its first value

PS5 firmware 3.20 and 4.03 apply the first full-band and LFE gain a voice receives flat and ramp every later change over the next grain in eight lanes, as RESULTS15 measured; the entry said the levels never ramp. The clamp, the NaN handling and this change's behaviour are unchanged, and the missing ramp stays listed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 docs/dev/debt/libSceNgs2.native.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceNgs2.native.md b/docs/dev/debt/libSceNgs2.native.md
index 6233c551cc..424692743e 100644
--- a/docs/dev/debt/libSceNgs2.native.md
+++ b/docs/dev/debt/libSceNgs2.native.md
@@ -14,7 +14,7 @@
 - [NGS2 submixer UserFx](../../../core/libs/prx/libSceNgs2.native/src/Custom.cpp) (control `0x20000004`) invokes the title's callback after input mixing on every playing grain, including silence. The 40-byte control and 48-byte process context follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/945dbc3cc3eee80ac3e053b438502ed936fa6bb2/src/core/libraries/ngs2/ngs2_submixer.h). PPSA03747 installs a peak-meter callback; its code confirms the channel pointers, user data 0, channel count, grain size and sample-rate offsets and returns 0. Other user data words are preserved. Flags are assumed to be 1 after registration/restart and 0 thereafter, following UserFx2's first-process convention; this callback does not inspect them. Null handlers disable the effect, setup clears it, and nonzero callback results throw. These lifecycle and error semantics are unverified on console hardware.
 - [NGS2 voice callback after setup](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler or mixer setup clears the voice callback with the rest of the voice state. PPSA18216 registers a block-end callback for a streamed music voice, later sets the same voice up again for one-shot ATRAC9 blocks with user data 0, and registers the callback again before it streams again; its callback dereferences the block's user data, so it must not run for the one-shot blocks. A setup made from inside the voice's own callback clears that callback as well, so a callback that sets its voice up again and queues the next block runs once instead of for every block; PPSA18216 never sets a voice up from inside its callback, so that ordering is unverified. Unverified on console hardware.
 - [NGS2 ATRAC9 streaming](../../../core/libs/prx/libSceNgs2.native/src/Atrac9.cpp) keeps waveform duration and skip counts across compressed input blocks. The shared `APPEND` flag (2), called `ONLY_DATA` in the compressed-data reference, ignores an ATRAC9 continuation block's sample, skip and repeat counts, following [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/bb98f26433fa9e711c219aac1711fe8ecba5bf3a/src/libs/ngs2.cpp); PPSA03747 confirms a 262044-byte initial buffer declaring 11310532 samples, followed by 16384-byte buffers with flags 3. Incomplete superframes are retained until more input arrives. Input-block completion callbacks allow refills; the final callback of a logical waveform waits for its buffered PCM to drain, preserving the existing complete-block repeat behaviour. This buffering, callback timing, decoded-byte accounting and starvation silence are unverified on hardware. A closed ATRAC9 stream ending before its declared samples throws; fragmented ATRAC9 waveforms with repeats are unsupported. PCM streaming retains its existing append validation and early-close behaviour.
-- [NGS2 mastering voice gain](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a NaN sample in a PCM_I16L render buffer throws, because PS5 firmware 3.20 and 4.03 were measured only into float buffers, where a NaN gain gives NaN samples. Measured there: param 0x30000004 (id seen in PPSA22520) sets linear full-band and LFE factors on the mastering output, applied from the next render without a ramp; each is clamped to [-32, 32] with NaN kept, and every value returns 0. The LFE level acts on channel 3 of 6- and 8-channel voices and the full-band level on every other channel, 1- and 2-channel voices included; a mastering setup resets both to 1, and STOP_IMM plus PLAY keeps them
+- [NGS2 mastering voice gain](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a NaN sample in a PCM_I16L render buffer throws, because PS5 firmware 3.20 and 4.03 were measured only into float buffers, where a NaN gain gives NaN samples. Measured there: param 0x30000004 (id seen in PPSA22520) sets linear full-band and LFE factors on the mastering output, applied from the next render, flat for the first gain a voice receives and ramped over the next grain in eight lanes after that, which this change does not implement; each is clamped to [-32, 32] with NaN kept, and every value returns 0. The LFE level acts on channel 3 of 6- and 8-channel voices and the full-band level on every other channel, 1- and 2-channel voices included; a mastering setup resets both to 1, and STOP_IMM plus PLAY keeps them
 - [NGS2 stereo mastering voice into a surround buffer](../../../core/libs/prx/libSceNgs2.native/src/Render.cpp) (libSceNgs2.native) - PPSA21402 renders a 2-channel mastering voice into a 6- or 8-channel render buffer, which the mixing stage rejected. The console's conversion is unknown: the left and right channels are assumed to go to the first two buffer channels (front left and right) and the remaining channels stay silent, with no centre, LFE or surround content. Any other channel count mismatch still throws
 - [NGS2 voices without a format](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native) - a sampler voice whose setup has no format (all zero) accepts an add of no waveform blocks without `APPEND`, which only applies `RESET` and the `CONTINUE` state, and matrix levels with no levels, which clear that matrix. PPSA36591 sets such a voice up, adds no blocks and sets no levels when a button is pressed at its title screen. Whether the console returns success or an error there is not measured; blocks with data, `APPEND` and an empty matrix on a voice with a format are still refused
 - [NGS2 silent waveform blocks](../../../core/libs/prx/libSceNgs2.native/src/Voice.cpp) (libSceNgs2.native): flag `0x10` (named `SILENCE` here; no public reference names it) lets a waveform block declare samples without data. PPSA04867 adds one block with flags `0x11`, `data_size` 0 and `num_samples` 16385, then another with flags `0x11` and a fully specified 0x800-byte, 1024-sample mono block, which takes the ordinary path. A dataless block under the flag outputs `num_samples` frames of silence, reports them through `decoded_data_size`, and finishes like a complete block; a dataless block without the flag still throws as not fitting its data. The flag's real name, its interaction with ATRAC9 and repeats, and the console's `waveform_data` for silent blocks are unverified on hardware

From 5362dcaaf08eb33cf237a5ac6720235352cae08b Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sat, 24 Oct 2026 12:00:40 +0000
Subject: [PATCH 072/218] fix(relinker): validate every entry of the Linux run
 path

LinuxElfPatcher wrote --rpath into DT_RUNPATH unchanged, so an empty
entry (an empty value, a leading or trailing colon, or a double colon)
reached the output, where glibc searches the working directory for it,
while the macOS and Windows outputs reject empty run paths. The guest
module rule that each entry is absolute or begins with $ORIGIN only
looked at the start of the whole value, so "$ORIGIN/libs:" or
"$ORIGIN:relative/libs" passed. The Linux patcher now rejects an empty
entry with the message the macOS patcher uses, the guest rule checks
every colon-separated entry, and USAGE.md says so.
---
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp         |  2 ++
 .../relinker/src/guest/GuestModuleBuilder.cpp        |  7 ++++++-
 core/relinker/relinker/tests/test_guest_runpath.py   |  3 ++-
 .../relinker/tests/test_linux_dynamic_strings.py     | 12 +++++++++++-
 docs/user/USAGE.md                                   |  2 +-
 5 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index b2f84ae52d..fbcb56c44e 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -347,6 +347,8 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     const std::vector<Codegen::TrampolineSite>& trampolines)
 {
     const auto dynSection = ImportsByNid(sourceDynSection);
+    if (runPath.empty() || runPath.front() == ':' || runPath.back() == ':' || runPath.find("::") != std::string::npos)
+        throw Domain::RelinkerException("Empty Linux run path component is not supported");
     if (dependencyDiagnostics)
         throw Domain::RelinkerException("Linux target does not support --windows-diagnostics");
     if (_fixedBase && lazyBinding)
diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
index 31dc35aa0d..b5ab411899 100644
--- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
+++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
@@ -378,7 +378,12 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
     };
     for (const auto index : order) if (!windows && !deferred(index)) addNeeded("$ORIGIN/" + appDirectory(images[index]) + "/" + images[index].OutputName);
     for (const auto& name : hostLibraries) addNeeded(name);
-    if (!windows && runPath != "$ORIGIN" && !runPath.starts_with("$ORIGIN/") && !runPath.starts_with("$ORIGIN:") && !runPath.starts_with('/')) throw Domain::RelinkerException("Guest Linux run path must be absolute or begin with $ORIGIN");
+    if (!windows) for (std::size_t begin = 0; begin <= runPath.size();) {
+        const auto end = std::min(runPath.find(':', begin), runPath.size());
+        const auto component = std::string_view(runPath).substr(begin, end - begin);
+        if (component != "$ORIGIN" && !component.starts_with("$ORIGIN/") && !component.starts_with('/')) throw Domain::RelinkerException("Guest Linux run path must be absolute or begin with $ORIGIN");
+        begin = end + 1;
+    }
     const auto outputDirectory = outputPath.parent_path().lexically_normal();
     std::vector<GuestArtifact> artifacts;
     for (const auto index : order) {
diff --git a/core/relinker/relinker/tests/test_guest_runpath.py b/core/relinker/relinker/tests/test_guest_runpath.py
index e5238ab66f..b5ad7d3701 100644
--- a/core/relinker/relinker/tests/test_guest_runpath.py
+++ b/core/relinker/relinker/tests/test_guest_runpath.py
@@ -52,7 +52,8 @@ def main():
                     if resolved != expected or (label.startswith("absolute") and actual != run_path):
                         failures.append((str(relative), label, actual, str(resolved), str(expected)))
                     checked += 1
-        for index, run_path in enumerate(("relative/libs", "C:/host/libs", "C:\\host\\libs", "\\\\server\\share")):
+        for index, run_path in enumerate(("relative/libs", "C:/host/libs", "C:\\host\\libs", "\\\\server\\share",
+                                          "$ORIGIN/libs:", "$ORIGIN::/opt/libs", "$ORIGIN:relative/libs", "/opt/libs:")):
             output = work / f"invalid-{index}.elf"
             result = subprocess.run([str(relinker), "--rpath", run_path, str(source), str(output)],
                                     capture_output=True, text=True, timeout=20)
diff --git a/core/relinker/relinker/tests/test_linux_dynamic_strings.py b/core/relinker/relinker/tests/test_linux_dynamic_strings.py
index 82c72cbbef..4dd3e1a453 100644
--- a/core/relinker/relinker/tests/test_linux_dynamic_strings.py
+++ b/core/relinker/relinker/tests/test_linux_dynamic_strings.py
@@ -56,7 +56,8 @@ def main():
         source = Path(directory) / "input.elf"
         source.write_bytes(fixture())
         for name, options, expected in (("default", [], b"$ORIGIN/libs"),
-                                        ("custom", ["--rpath", "/opt/anyps5/lib"], b"/opt/anyps5/lib")):
+                                        ("custom", ["--rpath", "/opt/anyps5/lib"], b"/opt/anyps5/lib"),
+                                        ("list", ["--rpath", "/opt/anyps5/lib:$ORIGIN/libs"], b"/opt/anyps5/lib:$ORIGIN/libs")):
             output = Path(directory) / (name + ".elf")
             result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
                                     capture_output=True, text=True, timeout=20)
@@ -70,6 +71,15 @@ def main():
                 raise AssertionError((name, "DT_RUNPATH is outside DT_STRSZ", run_path, tags[DT_STRSZ]))
             if dynstr_section_size(elf) != tags[DT_STRSZ]:
                 raise AssertionError((name, ".dynstr size differs from DT_STRSZ", dynstr_section_size(elf), tags[DT_STRSZ]))
+        for index, run_path in enumerate(("", ":$ORIGIN/libs", "$ORIGIN/libs:", "/opt/a::/opt/b")):
+            for target in ([], ["--lazy-binding"]):
+                output = Path(directory) / f"empty-{index}-{len(target)}.elf"
+                result = subprocess.run([str(relinker), "--skip-sce-module", *target, "--rpath", run_path, str(source), str(output)],
+                                        capture_output=True, text=True, timeout=20)
+                if result.returncode != 2 or "Empty Linux run path component" not in result.stderr:
+                    raise AssertionError((run_path, target, result.returncode, result.stdout, result.stderr))
+                if output.exists():
+                    raise AssertionError((run_path, target, "an empty run path component created an output"))
     print("Linux dynamic string tests passed")
 
 
diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md
index 83eb743254..10f79179fe 100644
--- a/docs/user/USAGE.md
+++ b/docs/user/USAGE.md
@@ -74,7 +74,7 @@ All switches are disabled by default. `unused-filter` defaults to `0`; `--rpath`
 | `unused-filter=1`             | Filter unused non-PLT imports using control-flow and GOT access analysis, treating address-taken code as reachable; preserve PLT imports.                                                                                                                                                                                                                                                                                                                                   |
 | `unused-filter=2`             | Apply strict unused-import analysis and compact the PLT. Unsupported analysis cases cause an error.                                                                                                                                                                                                                                                                                                                                                                         |
 | `--registry`                  | Write `<output-stem>.registry.json` beside the output executable, and `<output-stem>.<module>.registry.json` for each converted bundled module.                                                                                                                                                                                                                                                                                                                             |
-| `--rpath <path>`              | Set the system library search path. Quote `$ORIGIN` to prevent shell expansion, for example `--rpath '$ORIGIN/libs'` in Bash or PowerShell. Linux guest modules require an absolute path or a path beginning with `$ORIGIN`. Windows requires a nonempty ASCII path and supports `$ORIGIN` as the executable directory.                                                                                                                                                     |
+| `--rpath <path>`              | Set the system library search path. Quote `$ORIGIN` to prevent shell expansion, for example `--rpath '$ORIGIN/libs'` in Bash or PowerShell. On Linux every colon-separated entry must be nonempty, and with guest modules each must be absolute or begin with `$ORIGIN`. Windows requires a nonempty ASCII path and supports `$ORIGIN` as the executable directory.                                                                                                         |
 | `--autorun`                   | Run the output after conversion, print its exit code, and wait for Enter. Adds executable permissions for Linux output. Requires the target OS and prepared runtime layout.                                                                                                                                                                                                                                                                                                 |
 | `--sce-module-path <path>`    | Parent of the module directories, not the module directory itself. Default: input ELF parent; relative input paths resolve from the process working directory. Explicit absolute path: used directly. Explicit relative path (including `.` and `..`): relative to the process working directory. Output path has no effect. Requires one nonempty value; repeats, nonexistent or nondirectory paths, access failures, and combination with `--skip-sce-module` are errors. |
 | `--module-dir <dir>`          | Relink the ELF modules of a directory under the module parent directory, besides `sce_module`/`sce_modules`/`prx`; outputs keep the relative path. Needed modules are mapped at startup. On Linux, modules in these extra directories initialize only when explicitly loaded, with the arguments from `sceKernelLoadStartModule` (for example Unity plugins in `Media/Plugins`). A module another module needs initializes at startup on Windows and macOS; one only the executable needs initializes when explicitly loaded on Windows and at startup on macOS. Other modules initialize when loaded. Repeatable; `.` is the parent itself, without the input ELF. Conflicts with `--skip-sce-module`.  |

From 0d17917ef8ad78c39b3d195707cd515a12d73945 Mon Sep 17 00:00:00 2001
From: Eduardo Ruiz <eduardo@edubox.org>
Date: Sat, 24 Oct 2026 13:04:42 +0200
Subject: [PATCH 073/218] feat(libc): export std::underflow_error type info,
 vtable and destructor

Minecraft Legends (PPSA05510) imports _ZTISt15underflow_error (NID
oNRAB0Zs2+0). Add it next to overflow_error, with the same single-inheritance
record over runtime_error, its vtable and the destructor that releases the
allocated message.
---
 core/libs/prx/libc/CMakeLists.txt             |  9 +++++
 .../libc/src/exception/StandardExceptions.cpp |  4 ++
 core/libs/tests/GuestUnderflowError.cpp       | 38 +++++++++++++++++++
 3 files changed, 51 insertions(+)
 create mode 100644 core/libs/tests/GuestUnderflowError.cpp

diff --git a/core/libs/prx/libc/CMakeLists.txt b/core/libs/prx/libc/CMakeLists.txt
index fec849ae2f..f40d14968a 100644
--- a/core/libs/prx/libc/CMakeLists.txt
+++ b/core/libs/prx/libc/CMakeLists.txt
@@ -880,6 +880,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_bad_optional_access PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
+    add_test_executable(guest_underflow_error_tests ${LIBS_INCLUDE_DIR}/tests/GuestUnderflowError.cpp)
+    target_include_directories(guest_underflow_error_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_underflow_error_tests PRIVATE libc)
+    configure_windows_unwind(guest_underflow_error_tests)
+    add_test(NAME guest_underflow_error COMMAND guest_underflow_error_tests)
+    if(WIN32)
+        set_tests_properties(guest_underflow_error PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+    endif()
     if(UNIX)
         add_test_executable(exception_personality_tests ${LIBS_INCLUDE_DIR}/tests/ExceptionPersonality.cpp)
         target_include_directories(exception_personality_tests PRIVATE ${LIBS_INCLUDE_DIR})
diff --git a/core/libs/prx/libc/src/exception/StandardExceptions.cpp b/core/libs/prx/libc/src/exception/StandardExceptions.cpp
index 003a1af171..12b666ed71 100644
--- a/core/libs/prx/libc/src/exception/StandardExceptions.cpp
+++ b/core/libs/prx/libc/src/exception/StandardExceptions.cpp
@@ -508,6 +508,10 @@ LibcException::TypeRecord _ZTISt14overflow_error_nid_postfix {LibcException::Sin
 LibcException::ExceptionVtable _ZTVSt14overflow_error_nid_postfix {0, &_ZTISt14overflow_error_nid_postfix, LibcException::GuestDestroyMessage_nid_no_patch, LibcException::GuestDeleteMessage_nid_no_patch, LibcException::GuestMessageWhat_nid_no_patch};
 void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
 
+LibcException::TypeRecord _ZTISt15underflow_error_nid_postfix {LibcException::SingleTypeVtable + 2, "St15underflow_error", &_ZTISt13runtime_error_nid_postfix};
+LibcException::ExceptionVtable _ZTVSt15underflow_error_nid_postfix {0, &_ZTISt15underflow_error_nid_postfix, LibcException::GuestDestroyMessage_nid_no_patch, LibcException::GuestDeleteMessage_nid_no_patch, LibcException::GuestMessageWhat_nid_no_patch};
+void APS5_VABI _ZNSt15underflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
+
 LibcException::TypeRecord _ZTINSt8ios_base7failureE_nid_postfix {LibcException::SingleTypeVtable + 2, "NSt8ios_base7failureE", &_ZTISt12system_error_nid_postfix};
 LibcException::ExceptionVtable _ZTVNSt8ios_base7failureE_nid_postfix {0, &_ZTINSt8ios_base7failureE_nid_postfix, LibcException::GuestDestroyMessage_nid_no_patch, LibcException::GuestDeleteMessage_nid_no_patch, LibcException::GuestMessageWhat_nid_no_patch};
 void APS5_VABI _ZNSt8ios_base7failureD1Ev_nid_postfix(LibcException::ExceptionObject* self) { LibcException::DestroyMessage(self); }
diff --git a/core/libs/tests/GuestUnderflowError.cpp b/core/libs/tests/GuestUnderflowError.cpp
new file mode 100644
index 0000000000..4f91d5cfe3
--- /dev/null
+++ b/core/libs/tests/GuestUnderflowError.cpp
@@ -0,0 +1,38 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <cstddef>
+#include <cstdlib>
+#include <cstring>
+
+struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
+struct Object { const void* vtable; const char* message; };
+struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const void* what; };
+
+extern "C" {
+extern const TypeRecord _ZTISt13runtime_error_nid_postfix;
+extern const TypeRecord _ZTISt15underflow_error_nid_postfix;
+extern const Vtable _ZTVSt13runtime_error_nid_postfix;
+extern const Vtable _ZTVSt15underflow_error_nid_postfix;
+void APS5_VABI _ZNSt13runtime_errorC1EPKc_nid_postfix(Object*, const char*);
+void APS5_VABI _ZNSt15underflow_errorD1Ev_nid_postfix(Object*);
+}
+
+static void Require(bool value) { if (!value) std::abort(); }
+
+int main() {
+    const auto& type = _ZTISt15underflow_error_nid_postfix;
+    const auto& runtimeType = _ZTISt13runtime_error_nid_postfix;
+    Require(std::strcmp(type.name, "St15underflow_error") == 0);
+    Require(type.base == &runtimeType && type.vtable == runtimeType.vtable);
+    const auto& table = _ZTVSt15underflow_error_nid_postfix;
+    const auto& runtimeTable = _ZTVSt13runtime_error_nid_postfix;
+    Require(table.offset == 0 && table.type == &type);
+    Require(table.destroy == runtimeTable.destroy && table.deleteObject == runtimeTable.deleteObject && table.what == runtimeTable.what);
+    Object object{};
+    _ZNSt13runtime_errorC1EPKc_nid_postfix(&object, "value too small");
+    Require(object.message != nullptr && std::strcmp(object.message, "value too small") == 0);
+    _ZNSt15underflow_errorD1Ev_nid_postfix(&object);
+    Require(object.message == nullptr);
+    _ZNSt15underflow_errorD1Ev_nid_postfix(&object);
+    Require(object.message == nullptr);
+    return 0;
+}

From 0d68a3e34f8f4aa1d6e1dc3b01442f02d111d620 Mon Sep 17 00:00:00 2001
From: mrfelek <17274927+mrfelek@users.noreply.github.com>
Date: Sat, 24 Oct 2026 10:53:33 +0000
Subject: [PATCH 074/218] fix(libSceGameUpdate): answer no update instead of
 throwing on request creation

Requests use the module's 8 slots with ids from 0x20000000 and
sceGameUpdateCheck answers no update, as the PS5 3.20 module does
when its patch service reports 0x80412883 (prosper's reading;
KytyPS5 also answers no update). Hot Wheels Infinite Rush
(PPSA22408) aborted on the throw at its title screen.

AI-assisted. Tested by me on my own machine.
---
 core/libs/prx/libSceGameUpdate/Export.cpp | 94 +++++++++++++++++++----
 core/libs/tests/GuestGameUpdate.cpp       | 38 ++++++++-
 docs/dev/debt/libSceGameUpdate.md         |  6 +-
 3 files changed, 122 insertions(+), 16 deletions(-)

diff --git a/core/libs/prx/libSceGameUpdate/Export.cpp b/core/libs/prx/libSceGameUpdate/Export.cpp
index f8527db000..bee980659d 100644
--- a/core/libs/prx/libSceGameUpdate/Export.cpp
+++ b/core/libs/prx/libSceGameUpdate/Export.cpp
@@ -1,6 +1,7 @@
-#include <atomic>
+#include <array>
 #include <cstdint>
 #include <cstddef>
+#include <mutex>
 #include <stdexcept>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
@@ -10,20 +11,45 @@ static constexpr int SCE_GAME_UPDATE_ERROR_ALREADY_INITIALIZED = static_cast<int
 static constexpr int SCE_GAME_UPDATE_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80412803);
 static constexpr int SCE_GAME_UPDATE_ERROR_INVALID_SIZE = static_cast<int>(0x80412804);
 static constexpr int SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND = static_cast<int>(0x80412805);
+static constexpr int SCE_GAME_UPDATE_ERROR_TOO_MANY_REQUESTS = static_cast<int>(0x80412806);
+static constexpr int SCE_GAME_UPDATE_ERROR_ABORTED = static_cast<int>(0x80412807);
+static constexpr int FIRST_REQUEST_ID = 0x20000000;
+static constexpr int LAST_REQUEST_ID = 0x2FFFFFFF;
 
 static_assert(sizeof(GameUpdateCheckParam) == 0x30);
 static_assert(sizeof(GameUpdateCheckResult) == 0x30);
 
-static std::atomic<bool> initialized{false};
+struct Request {
+    int id;
+    bool aborted;
+};
 
-static int checkRequestId(int requestId) {
+static std::mutex stateMutex;
+static bool initialized = false;
+static int nextRequestId = FIRST_REQUEST_ID;
+static std::array<Request, 8> requests{};
+
+static Request* findRequest(int requestId) {
+    for (Request& request : requests) {
+        if (request.id != 0 && request.id == requestId) {
+            return &request;
+        }
+    }
+    return nullptr;
+}
+
+static int checkRequestId(int requestId, Request** request) {
     if (requestId <= 0) {
         return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
     }
-    if (!initialized.load()) {
+    if (!initialized) {
         return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
     }
-    return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
+    *request = findRequest(requestId);
+    if (*request == nullptr) {
+        return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
+    }
+    return 0;
 }
 
 static bool hasNonZeroReserved(const GameUpdateCheckParam* param) {
@@ -38,7 +64,13 @@ static bool hasNonZeroReserved(const GameUpdateCheckParam* param) {
 extern "C" {
 
 int APS5_VABI sceGameUpdateAbortRequest(int requestId) {
-    return checkRequestId(requestId);
+    std::lock_guard lock(stateMutex);
+    Request* request = nullptr;
+    if (int error = checkRequestId(requestId, &request); error != 0) {
+        return error;
+    }
+    request->aborted = true;
+    return 0;
 }
 
 int APS5_VABI sceGameUpdateCheck(int requestId, const GameUpdateCheckParam* param, GameUpdateCheckResult* result) {
@@ -54,18 +86,44 @@ int APS5_VABI sceGameUpdateCheck(int requestId, const GameUpdateCheckParam* para
     if (param->option != 0 || hasNonZeroReserved(param)) {
         return SCE_GAME_UPDATE_ERROR_INVALID_ARGUMENT;
     }
-    return checkRequestId(requestId);
+    std::lock_guard lock(stateMutex);
+    Request* request = nullptr;
+    if (int error = checkRequestId(requestId, &request); error != 0) {
+        return error;
+    }
+    if (request->aborted) {
+        return SCE_GAME_UPDATE_ERROR_ABORTED;
+    }
+    result->found = false;
+    result->addcont_found = false;
+    return 0;
 }
 
 int APS5_VABI sceGameUpdateCreateRequest(void) {
-    if (!initialized.load()) {
+    std::lock_guard lock(stateMutex);
+    if (!initialized) {
         return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
     }
-    throw std::runtime_error("sceGameUpdateCreateRequest: patch service request creation is not implemented");
+    for (Request& request : requests) {
+        if (request.id != 0) {
+            continue;
+        }
+        const int requestId = nextRequestId;
+        nextRequestId = requestId == LAST_REQUEST_ID ? FIRST_REQUEST_ID : requestId + 1;
+        request = {requestId, false};
+        return requestId;
+    }
+    return SCE_GAME_UPDATE_ERROR_TOO_MANY_REQUESTS;
 }
 
 int APS5_VABI sceGameUpdateDeleteRequest(int requestId) {
-    return checkRequestId(requestId);
+    std::lock_guard lock(stateMutex);
+    Request* request = nullptr;
+    if (int error = checkRequestId(requestId, &request); error != 0) {
+        return error;
+    }
+    *request = {};
+    return 0;
 }
 
 int APS5_VABI sceGameUpdateGetAddcontLatestVersion(uint32_t serviceLabel, const NpUnifiedEntitlementLabel* entitlementLabel, GameUpdateAddcontVersionInfo* info) {
@@ -76,23 +134,31 @@ int APS5_VABI sceGameUpdateGetAddcontLatestVersion(uint32_t serviceLabel, const
     if (entitlementLabel == nullptr) {
         return SCE_GAME_UPDATE_ERROR_INVALID_ARGUMENT;
     }
-    if (!initialized.load()) {
-        return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
+    {
+        std::lock_guard lock(stateMutex);
+        if (!initialized) {
+            return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
+        }
     }
     throw std::runtime_error("sceGameUpdateGetAddcontLatestVersion: entitlement version lookup is not implemented");
 }
 
 int APS5_VABI sceGameUpdateInitialize(void) {
-    if (initialized.exchange(true)) {
+    std::lock_guard lock(stateMutex);
+    if (initialized) {
         return SCE_GAME_UPDATE_ERROR_ALREADY_INITIALIZED;
     }
+    initialized = true;
     return 0;
 }
 
 int APS5_VABI sceGameUpdateTerminate(void) {
-    if (!initialized.exchange(false)) {
+    std::lock_guard lock(stateMutex);
+    if (!initialized) {
         return SCE_GAME_UPDATE_ERROR_NOT_INITIALIZED;
     }
+    initialized = false;
+    requests = {};
     return 0;
 }
 
diff --git a/core/libs/tests/GuestGameUpdate.cpp b/core/libs/tests/GuestGameUpdate.cpp
index c46d451c83..b77beb64c3 100644
--- a/core/libs/tests/GuestGameUpdate.cpp
+++ b/core/libs/tests/GuestGameUpdate.cpp
@@ -67,6 +67,42 @@ static void TestRequestArguments(int notInitialized, int invalidArgument, int in
     Require(sceGameUpdateTerminate() == 0);
 }
 
+static void TestRequestLifecycle(int notFound) {
+    constexpr int tooManyRequests = static_cast<int>(0x80412806);
+    constexpr int aborted = static_cast<int>(0x80412807);
+    GameUpdateCheckParam param{};
+    param.size = sizeof(param);
+    GameUpdateCheckResult result{};
+    std::memset(&result, 0xAB, sizeof(result));
+    result.size = sizeof(result);
+    const auto original = result;
+
+    int ids[8];
+    for (int& id : ids) {
+        id = sceGameUpdateCreateRequest();
+        Require(id >= 0x20000000 && id <= 0x2FFFFFFF);
+    }
+    Require(ids[0] != ids[1]);
+    Require(sceGameUpdateCreateRequest() == tooManyRequests);
+
+    Require(sceGameUpdateCheck(ids[0], &param, &result) == 0);
+    Require(!result.found && !result.addcont_found);
+    Require(std::memcmp(&result, &original, 8) == 0);
+    Require(std::memcmp(reinterpret_cast<const char*>(&result) + 10, reinterpret_cast<const char*>(&original) + 10, sizeof(result) - 10) == 0);
+
+    Require(sceGameUpdateAbortRequest(ids[1]) == 0);
+    Require(sceGameUpdateCheck(ids[1], &param, &result) == aborted);
+
+    Require(sceGameUpdateDeleteRequest(ids[3]) == 0);
+    Require(sceGameUpdateDeleteRequest(ids[3]) == notFound);
+    Require(sceGameUpdateCheck(ids[3], &param, &result) == notFound);
+    Require(sceGameUpdateCreateRequest() >= 0x20000000);
+
+    Require(sceGameUpdateTerminate() == 0);
+    Require(sceGameUpdateInitialize() == 0);
+    Require(sceGameUpdateCheck(ids[0], &param, &result) == notFound);
+}
+
 int main() {
     constexpr int notInitialized = static_cast<int>(0x80412801);
     constexpr int invalidArgument = static_cast<int>(0x80412803);
@@ -100,7 +136,7 @@ int main() {
     const auto original = info;
     RequireThrows([&] { sceGameUpdateGetAddcontLatestVersion(0, &label, &info); });
     Require(std::memcmp(&info, &original, sizeof(info)) == 0);
-    RequireThrows([] { sceGameUpdateCreateRequest(); });
+    TestRequestLifecycle(notFound);
 
     Require(sceGameUpdateTerminate() == 0);
     Require(sceGameUpdateTerminate() == notInitialized);
diff --git a/docs/dev/debt/libSceGameUpdate.md b/docs/dev/debt/libSceGameUpdate.md
index fd8f0f341a..88f35c8e6d 100644
--- a/docs/dev/debt/libSceGameUpdate.md
+++ b/docs/dev/debt/libSceGameUpdate.md
@@ -1,7 +1,11 @@
 # libSceGameUpdate technical debt
 
+### Silent stubs
+
+- [sceGameUpdateCreateRequest, sceGameUpdateCheck](../../../core/libs/prx/libSceGameUpdate/Export.cpp) (libSceGameUpdate) - requests are kept in the module's 8 slots with ids from `0x20000000` (a ninth returns `0x80412806`, an aborted request's Check `0x80412807`), as [prosper](https://github.com/mattias800/prosper) reads the PS5 3.20 `libSceGameUpdate.sprx`. Check never asks a patch service: it always answers no update (`found` and the byte after it cleared, the rest of the result untouched, return 0), which is what the module returns when its service reports `0x80412883`; KytyPS5 also answers no update. What the service returns on an offline console is not measured. The answer only decides whether a title offers a patch. Hot Wheels Infinite Rush (PPSA22408) aborted on the throw in sceGameUpdateCreateRequest at its title screen. Closes when: measured on a PS5
+
 ### Functional
 
-- [libSceGameUpdate](../../../core/libs/prx/libSceGameUpdate/Export.cpp): initialization tracks host state but does not connect the patch service. Request creation and entitlement version lookup throw instead of fabricating an offline error or a successful no-update result. The original maintains eight service-backed requests with IDs starting at `0x20000000`; the service's offline response is still unknown. Check, Abort and Delete implement argument/state checks but have no live requests to operate on.
+- [libSceGameUpdate](../../../core/libs/prx/libSceGameUpdate/Export.cpp): initialization tracks host state but does not connect the patch service. Entitlement version lookup throws.
 - [sceGameUpdateCheck](../../../core/libs/prx/libSceGameUpdate/Export.cpp): option zero is supported for argument validation. The original additionally permits option one when a kernel platform predicate succeeds; that platform mode is not modeled.
 - [sceGameUpdateGetAddcontLatestVersion](../../../core/libs/prx/libSceGameUpdate/Export.cpp): the supplied module confirms a 20-byte entitlement-label input and a 48-byte service output. Null pointers are rejected before initialization is checked. There is no local output-size validation or blanket clearing of the output; the host leaves it untouched when the missing service causes an exception.

From 20311903c3a1eb112619396ac2bf0984f3d72af8 Mon Sep 17 00:00:00 2001
From: mrfelek <17274927+mrfelek@users.noreply.github.com>
Date: Fri, 23 Oct 2026 01:42:44 +0200
Subject: [PATCH 075/218] fix(shader): read a buffer V#'s presence at run time
 instead of specializing it

A buffer V#'s presence came from the dispatch's V# snapshot as the
specialization constant BufferBase + 2, which buildSpecializedModule
turns into a literal. One guest program then compiled to two SPIR-V
modules, one with the buffer bound and one with it still null, each a
separate pipeline. descriptor() now reads presence from the V# words at
run time, as registration modules already do, and the formatted-buffer
helper takes it from its valid parameter.

AI-assisted. Tested by me on my own machine.
---
 .../libSceAgcDriver/tests/GuardedMemoryLoads.cpp  | 15 +++++++--------
 .../Optimization/src/DescriptorBindingBuilder.cpp |  1 -
 .../SpirvBackend/src/SpirvRuntimeBuffer.cpp       |  7 ++++---
 3 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp b/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp
index e20b23d8d5..452bac82c4 100644
--- a/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/GuardedMemoryLoads.cpp
@@ -32,7 +32,7 @@ struct LoadCase {
     std::uint32_t components = 1;
 };
 
-std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint32_t offset, std::uint32_t records, bool robust) {
+std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint32_t offset, std::uint32_t records, bool robust, bool valid = true) {
     IrProgram program;
     program.SetWaveSize(32);
     program.Resources().stage = IrShaderStage::Compute;
@@ -76,7 +76,8 @@ std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint
         program.Metadata().bindings.pushDataStartDword = 0;
         program.Metadata().bindings.memoryOffsetCount = 1;
         auto& size = constant(records);
-        auto& handle = emit(IrOpcode::GetBufferResource, IrType::BufferResource, {&zero, &zero, &size, &zero});
+        auto& base = constant(valid ? 0x100u : 0u);
+        auto& handle = emit(IrOpcode::GetBufferResource, IrType::BufferResource, {&base, &zero, &size, &zero});
         emit(test.opcode, test.type, {&handle, &zero, &address, &zero, &enabled});
     } else {
         if (test.kind == ResourceKind::Gds) program.Metadata().bindings.descriptors.push_back({DescriptorBindingKind::Gds, {0}});
@@ -104,8 +105,8 @@ std::vector<std::uint32_t> emitLoad(const LoadCase& test, bool active, std::uint
 
 class AccessTrace {
 public:
-    AccessTrace(const std::vector<std::uint32_t>& module, std::uint32_t misalignment = 0, bool valid = true)
-        : words(module), misalignment(misalignment), valid(valid) {
+    AccessTrace(const std::vector<std::uint32_t>& module, std::uint32_t misalignment = 0)
+        : words(module), misalignment(misalignment) {
         require(words.size() >= 5, "SPIR-V module header is missing");
         for (std::size_t offset = 5; offset < words.size();) {
             const auto count = words[offset] >> 16;
@@ -206,7 +207,6 @@ private:
             const auto spec = specializations.at(id);
             if (spec == PipelineSpecialization::BufferBase) return 0;
             if (spec == PipelineSpecialization::BufferBase + 1) return 0x30001000;
-            if (spec == PipelineSpecialization::BufferBase + 2) return valid;
             if (spec == PipelineSpecialization::BufferBase + 3) return misalignment;
             if (spec == PipelineSpecialization::PushDataOffset) return 0;
             throw std::runtime_error("unexpected specialization in access fixture");
@@ -250,7 +250,6 @@ private:
 
     const std::vector<std::uint32_t>& words;
     std::uint32_t misalignment;
-    bool valid;
     std::uint32_t entryFunction = 0;
     std::map<std::uint32_t, std::span<const std::uint32_t>> definitions;
     std::map<std::uint32_t, std::string> names;
@@ -281,8 +280,8 @@ std::uint32_t ldsLength(const std::vector<std::uint32_t>& words) {
 }
 
 void expectReads(const LoadCase& test, bool robust, bool active, std::uint32_t offset, std::vector<std::uint32_t> expected, std::uint32_t records = 64, std::uint32_t misalignment = 0, bool valid = true) {
-    const auto module = emitLoad(test, active, offset, records, robust);
-    const auto actual = AccessTrace(module, misalignment, valid).Run();
+    const auto module = emitLoad(test, active, offset, records, robust, valid);
+    const auto actual = AccessTrace(module, misalignment).Run();
     if (actual != expected) {
         std::string detail = std::string(robust ? "robust" : "plain") + " guest reads:";
         for (const auto index : actual) detail += " " + std::to_string(index);
diff --git a/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp b/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
index b3c679dc2e..1119918ed0 100644
--- a/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
+++ b/core/shader/recompiler/Optimization/src/DescriptorBindingBuilder.cpp
@@ -343,7 +343,6 @@ DescriptorBindingPlan DescriptorBindingBuilder::Prepare(const IrBindingLayout& l
             const auto first = PipelineSpecialization::BufferBase + index * PipelineSpecialization::BufferWords;
             plan.specialization.push_back({first, descriptor.dwords[1] & 0xffff0000u});
             plan.specialization.push_back({first + 1u, descriptor.dwords[3]});
-            plan.specialization.push_back({first + 2u, present ? 1u : 0u});
             plan.specialization.push_back({first + 3u, misalignment});
         }
         if (buffer.formattedReadMask != 0u) {
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
index f3736dc698..01fe275817 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvRuntimeBuffer.cpp
@@ -107,7 +107,9 @@ RuntimeDescriptor descriptor(SpirvValueEmitContext& context, const IrValue& inst
     }
     if (memory.gpuDescriptor) faultIf(context, instruction, invalid, base, 0u, BdaAbi::FaultReason::InvalidDescriptor);
     const auto stride = field(state, word1, 16u, 14u);
-    const auto present = runtime ? both(state, nonzero(state, context.Arg(*handle, 2u)), Binary(state, spv::OpLogicalOr, TypeBool(state), nonzero(state, context.Arg(*handle, 0u)), nonzero(state, field(state, word1, 0u, 16u)))) : nonzero(state, state.module.SpecializationConstant(u32, first + 2u, 0u));
+    auto baseHigh = runtime ? word1 : context.Arg(*handle, 1u);
+    if (!runtime && GcnGuestShaders()) baseHigh = Binary(state, spv::OpBitwiseAnd, u32, baseHigh, ConstantU32(state, GcnBufferWord1Mask));
+    const auto present = both(state, nonzero(state, context.Arg(*handle, 2u)), Binary(state, spv::OpLogicalOr, TypeBool(state), nonzero(state, context.Arg(*handle, 0u)), nonzero(state, field(state, baseHigh, 0u, 16u))));
     const auto valid = memory.gpuDescriptor ? both(state, Unary(state, spv::OpLogicalNot, TypeBool(state), invalid), Binary(state, spv::OpINotEqual, TypeBool(state), base, BdaConstant(state, 0u))) : present;
     return {base, context.Arg(*handle, 2u), stride, word3, both(state, nonzero(state, stride), nonzero(state, field(state, word1, 31u, 1u))), index, valid};
 }
@@ -668,8 +670,7 @@ std::uint32_t formattedCall(SpirvValueEmitContext& context, const IrValue& instr
             const auto word1 = state.module.SpecializationConstant(u32, first, 0u);
             const auto stride = field(state, word1, 16u, 14u);
             const auto swizzle = both(state, nonzero(state, stride), nonzero(state, field(state, word1, 31u, 1u)));
-            const auto valid = nonzero(state, state.module.SpecializationConstant(u32, first + 2u, 0u));
-            shared = {ConstantU32(state, 0u), parameters[3], stride, state.module.SpecializationConstant(u32, first + 1u, 0u), swizzle, parameters[0], valid, parameters[1], parameters[2]};
+            shared = {ConstantU32(state, 0u), parameters[3], stride, state.module.SpecializationConstant(u32, first + 1u, 0u), swizzle, parameters[0], nonzero(state, parameters[8]), parameters[1], parameters[2]};
         }
         const auto value = formatSwitch(context, instruction, shared, components, store, store ? parameters[9] : 0u);
         if (store) state.module.AddFunction(spv::OpReturn);

From 0870b4dc11cdabca7174e3db6e457b60a328dee4 Mon Sep 17 00:00:00 2001
From: mrfelek <17274927+mrfelek@users.noreply.github.com>
Date: Sat, 24 Oct 2026 13:00:52 +0000
Subject: [PATCH 076/218] fix(libSceGameUpdate): skip request ids still held
 when the counter wraps

AI-assisted. Tested by me on my own machine.
---
 core/libs/prx/libSceGameUpdate/Export.cpp | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceGameUpdate/Export.cpp b/core/libs/prx/libSceGameUpdate/Export.cpp
index bee980659d..f5f27d716f 100644
--- a/core/libs/prx/libSceGameUpdate/Export.cpp
+++ b/core/libs/prx/libSceGameUpdate/Export.cpp
@@ -38,6 +38,19 @@ static Request* findRequest(int requestId) {
     return nullptr;
 }
 
+static int followingRequestId(int requestId) {
+    return requestId == LAST_REQUEST_ID ? FIRST_REQUEST_ID : requestId + 1;
+}
+
+static int takeRequestId() {
+    int requestId = nextRequestId;
+    while (findRequest(requestId) != nullptr) {
+        requestId = followingRequestId(requestId);
+    }
+    nextRequestId = followingRequestId(requestId);
+    return requestId;
+}
+
 static int checkRequestId(int requestId, Request** request) {
     if (requestId <= 0) {
         return SCE_GAME_UPDATE_ERROR_REQUEST_NOT_FOUND;
@@ -108,8 +121,7 @@ int APS5_VABI sceGameUpdateCreateRequest(void) {
         if (request.id != 0) {
             continue;
         }
-        const int requestId = nextRequestId;
-        nextRequestId = requestId == LAST_REQUEST_ID ? FIRST_REQUEST_ID : requestId + 1;
+        const int requestId = takeRequestId();
         request = {requestId, false};
         return requestId;
     }

From 5d6bc58bd028773973e25d8676a02461f6cc9e3c Mon Sep 17 00:00:00 2001
From: xTRACKGOD <135815363+xTRACKGOD@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:33:15 +0530
Subject: [PATCH 077/218] fix(tools): accept PE libraries without export tables

---
 tools/import_audit.py            |  2 ++
 tools/tests/test_import_audit.py | 55 ++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)

diff --git a/tools/import_audit.py b/tools/import_audit.py
index 5d43653497..8c3a8bea68 100644
--- a/tools/import_audit.py
+++ b/tools/import_audit.py
@@ -267,6 +267,8 @@ def pe_headers(path, data):
 def pe_exports(path, data):
     to_offset, directory, _ = pe_headers(path, data)
     rva, size = unpack("<II", data, directory, path, "export data directory")
+    if not rva and not size:
+        return set()
     if not rva or size < 40:
         raise AuditError(f"{path}: PE file has no export table")
 
diff --git a/tools/tests/test_import_audit.py b/tools/tests/test_import_audit.py
index c1acc164c6..f8291a09bc 100644
--- a/tools/tests/test_import_audit.py
+++ b/tools/tests/test_import_audit.py
@@ -1539,6 +1539,61 @@ class ImportAuditTests(unittest.TestCase):
             with self.assertRaisesRegex(import_audit.AuditError, "lib.prx"):
                 import_audit.pe_exports(path, image[:cut])
 
+    def test_pe_without_an_export_directory_has_no_exports(self):
+        for magic, directory in ((0x10b, 96), (0x20b, 112)):
+            image = bytearray(build_pe([]))
+            struct.pack_into("<H", image, 0x58, magic)
+            struct.pack_into("<I", image, 0x58 + directory - 4, 16)
+            struct.pack_into("<II", image, 0x58 + directory, 0, 0)
+            with self.subTest(magic=magic):
+                self.assertEqual(import_audit.read_exports(Path("empty.prx"), image), set())
+
+    def test_pe_missing_export_directory_does_not_hide_malformed_tables(self):
+        for magic, directory in ((0x10b, 96), (0x20b, 112)):
+            for rva, size in ((0, 40), (0x1000, 0), (0x1000, 39), (0xffffff, 40)):
+                image = bytearray(build_pe([]))
+                struct.pack_into("<H", image, 0x58, magic)
+                struct.pack_into("<I", image, 0x58 + directory - 4, 16)
+                struct.pack_into("<II", image, 0x58 + directory, rva, size)
+                with self.subTest(magic=magic, rva=rva, size=size):
+                    with self.assertRaises(import_audit.AuditError):
+                        import_audit.read_exports(Path("malformed.prx"), image)
+
+    def test_audit_accepts_pe_libraries_and_modules_without_export_directories(self):
+        work = self.work
+        image = bytearray(build_pe_with_imports(["KERNEL32.dll"]))
+        struct.pack_into("<II", image, 0x58 + 112, 0, 0)
+        (work.libs / "empty.prx").write_bytes(image)
+        (work.modules / "module.prx.guest.prx").write_bytes(image)
+        registry, report = work.root / "game.json", work.root / "audit.json"
+        write_registry(registry, [])
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (0, ""), out)
+        data = json.loads(report.read_text(encoding="utf-8"))
+        self.assertEqual(data["references"], 0)
+        self.assertEqual(data["missing_libraries"], {})
+        self.assertEqual(data["missing_host_dependencies"], [])
+        write_registry(registry, [("AAAAAAAAAAA", "empty.prx")])
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (1, ""), out)
+        data = json.loads(report.read_text(encoding="utf-8"))
+        self.assertEqual(data["imports"][0]["class"], "absent")
+        self.assertEqual(data["imports"][0]["providers"], [])
+        self.assertEqual(data["stops"][0]["nid"], "AAAAAAAAAAA")
+
+    def test_exportless_pe_library_still_reports_missing_host_dependencies(self):
+        work = self.work
+        image = bytearray(build_pe_with_imports(["libSceMissing.prx"]))
+        struct.pack_into("<II", image, 0x58 + 112, 0, 0)
+        (work.libs / "empty.prx").write_bytes(image)
+        registry, report = work.root / "game.json", work.root / "audit.json"
+        write_registry(registry, [])
+        code, out, err = work.run(registry, "--json", str(report))
+        self.assertEqual((code, err), (1, ""), out)
+        self.assertEqual(json.loads(report.read_text(encoding="utf-8"))["missing_host_dependencies"], [
+            {"importer": "empty.prx", "chain": ["empty.prx", "libSceMissing.prx"]},
+        ])
+
     def test_pe_ignores_bytes_after_the_declared_directory_count(self):
         image = bytearray(build_pe(["alpha"]))
         struct.pack_into("<I", image, 0x58 + 108, 0)

From 9bf8860f8757ce0a0543190d15e4f895ac2a133f Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:44:53 +0200
Subject: [PATCH 078/218] fix(relinker): drop the COPY width from the Linux
 load bounds check

RelocationWidth took the width of a COPY relocation from the output
symbol table, where every import has st_size 0, so the width was
always one byte and the two copy-* boundary cases passed for that
reason alone. #10658 rejects R_X86_64_COPY in validation, so the type
no longer reaches this check; until it merges, COPY takes the 8-byte
default like every other type. The three copy-* cases go with it.
---
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp  | 20 ++++---------------
 .../relinker/tests/test_linux_load_bounds.py  | 13 ------------
 2 files changed, 4 insertions(+), 29 deletions(-)

diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 883abd7e46..3e9f0c0d27 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -113,21 +113,9 @@ void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std:
     throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
 }
 
-std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry, const std::vector<std::uint8_t>& symbols) {
-    const auto info = Io::ReadU64(relocations, entry + 8);
-    switch (static_cast<std::uint32_t>(info)) {
-    case R_X86_64_PC32:
-    case R_X86_64_32:
-        return 4;
-    case R_X86_64_COPY: {
-        const auto symbol = info >> 32;
-        if (symbol >= symbols.size() / kSymEntrySize)
-            throw Domain::RelinkerException("COPY relocation symbol index " + std::to_string(symbol) + " is outside the dynamic symbol table");
-        return std::max<std::uint64_t>(Io::ReadU64(symbols, static_cast<std::size_t>(symbol * kSymEntrySize + 16)), 1);
-    }
-    default:
-        return 8;
-    }
+std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry) {
+    const auto type = static_cast<std::uint32_t>(Io::ReadU64(relocations, entry + 8));
+    return type == R_X86_64_PC32 || type == R_X86_64_32 ? 4 : 8;
 }
 
 void SeparateSharedLoadPages(std::vector<std::uint8_t>& buf, std::vector<Domain::ProgramHeader>& headers) {
@@ -389,7 +377,7 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
         for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
             if (static_cast<std::uint32_t>(Io::ReadU64(*relocationTable, entry + 8)) != R_X86_64_NONE)
-                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry, dynSection.DynSymData), 0, name);
+                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
     if (!dynSection.RelaPltData.empty())
         RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
index d75d394cdf..49e9a994c4 100644
--- a/core/relinker/relinker/tests/test_linux_load_bounds.py
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -14,12 +14,10 @@ PT_SCE_RELRO = 0x61000010
 PF_W = 2
 PF_R = 4
 R_X86_64_PC32 = 2
-R_X86_64_COPY = 5
 R_X86_64_32 = 10
 E_ENTRY = 24
 SPARE_HEADER = 64 + 3 * 56
 PLTGOT_VALUE = 0x400 + 9 * 16 + 8
-SYMBOL_SIZE = 0x620 + 24 + 16
 OUTSIDE = 0x2000
 
 
@@ -43,11 +41,6 @@ def with_pltgot(image, value):
     return image
 
 
-def with_symbol_size(image, size):
-    struct.pack_into("<Q", image, SYMBOL_SIZE, size)
-    return image
-
-
 def relink(relinker, work, name, image, options, error):
     source = work / (name + ".elf")
     output = work / (name + ".out")
@@ -73,10 +66,6 @@ def main():
         ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
         ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
         ("abs32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFC), None),
-        ("copy-load-tail", with_symbol_size(
-            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFC), 4), None),
-        ("copy-load-last-byte", with_symbol_size(
-            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFF), 4), None),
         ("entry-outside", with_entry(fixture(linux=True), 0x7FFFF000),
          "e_entry 0x7ffff000 is not inside an executable PT_LOAD segment"),
         ("entry-not-executable", with_entry(with_bss(fixture(linux=True)), 0x1000),
@@ -87,8 +76,6 @@ def main():
          "RELA r_offset 0xffc (8 bytes) does not fit inside a PT_LOAD segment"),
         ("abs32-past-load-end", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFE),
          "RELA r_offset 0xffe (4 bytes) does not fit inside a PT_LOAD segment"),
-        ("copy-outside", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=OUTSIDE),
-         "RELA r_offset 0x2000 is not inside a PT_LOAD segment"),
         ("jmprel-outside", fixture(linux=True, target=OUTSIDE),
          "JMPREL r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
     ]

From b15f3eac86de835966a6e2023769684a444c7faf Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:09:58 +0200
Subject: [PATCH 079/218] test(relinker): expect the load bounds error for the
 wrapped GOT slot

The got-slot-address-size-underflow case puts its GOT slot at the
32-bit wrapped address 0xfffff008, outside every PT_LOAD. The unused
filter still keeps the import, which the case keeps checking through
the CFG/GOT filtering line, and the Linux patcher now rejects the
relocation, so the case expects exit 2 with that message instead of an
output file.
---
 .../relinker/relinker/tests/test_unused_filter_indirect.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/core/relinker/relinker/tests/test_unused_filter_indirect.py b/core/relinker/relinker/tests/test_unused_filter_indirect.py
index 7b0197ee6e..69e6e2f864 100644
--- a/core/relinker/relinker/tests/test_unused_filter_indirect.py
+++ b/core/relinker/relinker/tests/test_unused_filter_indirect.py
@@ -11,6 +11,8 @@ POINTER = 0x810
 TABLE = 0x820
 FUNCTION = CODE + 0x40
 SECOND_FUNCTION = CODE + 0x60
+REJECTED = {"got-slot-address-size-underflow":
+            "RELA r_offset 0xfffff008 (8 bytes) does not fit inside a PT_LOAD segment"}
 
 
 def rel(next_address, target):
@@ -62,6 +64,11 @@ def run(relinker, work, name, image, level=1):
     source.write_bytes(image)
     result = subprocess.run([str(relinker), "--skip-sce-module", "--registry", f"unused-filter={level}",
                              str(source), str(output)], capture_output=True, text=True, timeout=20)
+    if name in REJECTED:
+        assert result.returncode == 2 and REJECTED[name] in result.stderr and not output.exists(), (
+            name, result.returncode, result.stdout, result.stderr)
+        assert "CFG/GOT filtering: 1 -> 1;" in result.stdout, (name, result.stdout)
+        return True
     assert result.returncode == 0 and output.exists(), (name, result.returncode, result.stdout, result.stderr)
     registry = json.loads(output.with_suffix(".registry.json").read_text())
     kept = len(registry)

From d84a94e6d2833dcf0a1906be30fd377c79e703d4 Mon Sep 17 00:00:00 2001
From: PYTHONRETARDE <152398455+PYTHONRETARDE@users.noreply.github.com>
Date: Sat, 24 Oct 2026 12:57:14 +0000
Subject: [PATCH 080/218] fix(agc): discard a new depth surface's depth before
 taking storage writes

TakeStorage copies a pending or live storage image over the whole depth
plane of a new single-sample surface, after the creation clear. On AMD's
Windows driver 32.0.31041.1004 (RX 7800 XT), one or two 8x8 blocks of a
D16 surface then tested as the clear value in about 1 of 10 runs of
agc_driver_depth_surface_from_storage, although a copy back of the image
read the copied values (#6630).

Without a stencil plane the copy now goes through an UNDEFINED to
TRANSFER_DST_OPTIMAL barrier on the depth aspect and back to GENERAL, so
the clear's state is discarded before the copy writes every texel. A
surface with a stencil plane keeps the previous path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Graphics/src/DepthSurface.cpp             | 26 ++++++++++++++++---
 docs/dev/debt/libSceAgcDriver.md              |  1 +
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
index 7273cb82e3..256136c888 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp
@@ -719,10 +719,30 @@ public:
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT);
         context.Function<PFN_vkCmdCopyImageToBuffer>("vkCmdCopyImageToBuffer")(commands, storage->Image(), VK_IMAGE_LAYOUT_GENERAL, depthPlane.staging->Handle(), 1, &colorRegion);
         RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_TRANSFER_READ_BIT | VK_ACCESS_TRANSFER_WRITE_BIT);
-        context.Function<PFN_vkCmdCopyBufferToImage>("vkCmdCopyBufferToImage")(commands, depthPlane.staging->Handle(), image, VK_IMAGE_LAYOUT_GENERAL, 1, &depthRegion);
-        RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT);
+        if (target.stencilAddress == 0) {
+            VkImageMemoryBarrier discard{VK_STRUCTURE_TYPE_IMAGE_MEMORY_BARRIER};
+            discard.dstAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+            discard.oldLayout = VK_IMAGE_LAYOUT_UNDEFINED;
+            discard.newLayout = VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL;
+            discard.srcQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+            discard.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+            discard.image = image;
+            discard.subresourceRange = {VK_IMAGE_ASPECT_DEPTH_BIT, 0, 1, 0, 1};
+            const auto barrier = context.Resolved(&DeviceFunctions::cmdPipelineBarrier, "vkCmdPipelineBarrier");
+            barrier(commands, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, 0, 0, nullptr, 0, nullptr, 1, &discard);
+            context.Function<PFN_vkCmdCopyBufferToImage>("vkCmdCopyBufferToImage")(commands, depthPlane.staging->Handle(), image, VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL, 1, &depthRegion);
+            VkImageMemoryBarrier toGeneral = discard;
+            toGeneral.srcAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+            toGeneral.dstAccessMask = VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT;
+            toGeneral.oldLayout = VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL;
+            toGeneral.newLayout = VK_IMAGE_LAYOUT_GENERAL;
+            barrier(commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, 0, 0, nullptr, 0, nullptr, 1, &toGeneral);
+        } else {
+            context.Function<PFN_vkCmdCopyBufferToImage>("vkCmdCopyBufferToImage")(commands, depthPlane.staging->Handle(), image, VK_IMAGE_LAYOUT_GENERAL, 1, &depthRegion);
+            RecordMemoryBarrier(context, commands, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_ACCESS_TRANSFER_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT);
+        }
         if (batch) batch->SubmitAndWait();
-        else Recorder::CountBarriers(Recorder::CommandClass::Copy, 3);
+        else Recorder::CountBarriers(Recorder::CommandClass::Copy, target.stencilAddress == 0 ? 4 : 3);
     }
 
     std::shared_ptr<StorageTexture> Mirror(const GuestTextureResource& resource) {
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index 4428231cad..13768eee4a 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -93,6 +93,7 @@
 - [Depth planes in guest memory](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): only single-sample `D32_SFLOAT` and `D32_SFLOAT_S8_UINT` planes with the 64 KiB Z swizzle (`SW_MODE` 24) reach guest memory; D16, other swizzles, stencil and multisampled planes keep depth in the host image only. A plane drawn since its last store is stored, uncompressed, in 64 KiB units (128x128 tiles): a buffer upload, a `GuestBuffers` V#, an image lookup or a pending-store flush stores the units it overlaps, a color target or written storage image over the plane all of them. CPU reads and reads through address-based heaps are not caught. Guest writes are ordered when collected (bind, flush, collect epoch), not when made: a collected write reloads the units it touched unless an HTILE clear is pending. A store outside a recorder waits for the GPU. The console keeps HTILE-compressed tiles compressed in memory until a decompress (Mesa `ac_descriptors.h`).
 - [Unmapped depth planes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a drawn depth plane whose guest memory the title unmapped before it was stored is not stored; its pending depth is dropped with a one-time warning. What the console does with such a store is not known. Readable planes without write permission retain the unsupported-store failure and their pending results.
 - [Depth plane copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver): a depth plane sampled as a 2D array or a cube, or a D16 plane read as `R16_UINT`, is copied into an image of its own (`DepthPlaneCopy`), kept per base address, extent, format and slice count; a slice comes from the live depth surface when one is bound at the slice's address and from guest memory (detiled) otherwise. A draw or dispatch that binds the plane copies again only the slices that changed and records nothing when none did: a surface slice when its image or write serial differs from the one copied (the serial is bumped when the surface is created, when a draw binds it as its depth target, when a pending fast clear is applied and when a written storage view of the plane is copied back), a guest-memory slice when its bytes were written since they were last read (`GuestMemory::UnchangedSince`), a snapshot write overlaps them, or its address, size or tile mode changed. The surface of the latest depth draw is copied at every use until another depth target is bound, since that draw may still be recorded after the copy. A slice's address is the base plus a whole 64 KiB-block depth slice per layer (`DepthSliceBytes`), and the cube face order is the array order; both are inferred from the titles' use, not measured on hardware. A 2D-array T# whose `BASE_ARRAY` is past slice 0 reads slices `BASE_ARRAY` to `LAST_ARRAY` of the copy, which holds slices 0 to `LAST_ARRAY`, and a 2D binding of it reads slice `BASE_ARRAY`; that follows the colour 2D-array semantics and the titles that hit it (PPSA01556, PPSA03912), and was not measured on hardware for depth surfaces. Planes with mips, a cube or a 2D T# with a base slice other than 0, a `BASE_ARRAY` past `LAST_ARRAY`, a cube with other than 1 or 6 slices, and other views of the planes still throw, and so do these copies of a 16-bit plane with stencil that the device stores as D24 or D32 (16-bit depth with stencil, below).
+- [New depth surface from storage writes](../../../core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp) (libSceAgcDriver) - `TakeStorage` discards the depth aspect (`UNDEFINED` to `TRANSFER_DST_OPTIMAL`) before copying the storage image over the whole surface. On AMD's Windows driver 32.0.31041.1004 (RX 7800 XT) a copy into the depth image after its creation clear left one or two 8x8 blocks testing as the clear value in about 1 of 10 runs, although a copy back read the copied values (#6630); not seen on a Radeon 860M or RX 6700 XT. A surface with a stencil plane keeps the clear before the copy, since its depth aspect is not discarded alone.
 - [Repacked format-43 copies](../../../core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp) (libSceAgcDriver): a sampled texture of format 43 (10-bit R, 11-bit G and B unsigned floats from bit 0) is uploaded into a `B10G11R11_UFLOAT` image with its R and B fields swapped (`RepackTextureWord`) and viewed with R and B swapped back. A texture whose results a storage image still holds is copied from it again, whole, whenever the image changed (`RefreshDepthCopy`); a 3D one is flushed to guest memory and uploaded instead. Storage reads and writes of format 43 keep the packed `R32_UINT` path.
 - [SW_64KB_Z_X color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ColorTargetLayout.cpp) (libSceAgcDriver) use the texture equations and 64 KiB block geometry of `SW_64KB_Z_X`, whose addresses are checked against [AMD addrlib GFX10](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp) in the texture tiling tests. Any 256-byte pipe/bank XOR below the block size is accepted, as for `SW_64KB_R_X` targets and Z_X textures; which of those bits the console honours, and the render results, are not measured.
 - [SW_64KB_D_X color targets](../../../core/libs/prx/libSceAgcDriver/Graphics/src/ColorTargetLayout.cpp) (libSceAgcDriver) use the existing texture block/mip geometry and equations from [AMD addrlib GFX10 non-RB+](https://github.com/GPUOpen-Drivers/pal/blob/c5e800072a32f68b6ccc4422936d96167c6e0728/src/core/imported/addrlib/src/gfx10/gfx10addrlib.cpp) for 16 pipes and 256-byte interleave. The address-reference tests use legal pipe/bank XOR bits for that configuration. Raw column bits outside the source configuration's pipe/bank mask 0xcf00 throw; their console meaning is unresolved. Console address equations and render results have not been measured.

From 20f1039d8964ffaaf93406bafd17a9471418a987 Mon Sep 17 00:00:00 2001
From: WhiteAssassins <28965087+WhiteAssassins@users.noreply.github.com>
Date: Sat, 24 Oct 2026 14:52:36 -0400
Subject: [PATCH 081/218] feat(tools): list verified patch catalog entries

---
 .../relinker/tests/test_patch_advisor.py      | 23 +++++--
 docs/user/USAGE.md                            |  4 +-
 tools/suggest_patches.py                      | 42 ++++++++----
 tools/tests/test_suggest_patches.py           | 64 +++++++++++++++++++
 4 files changed, 113 insertions(+), 20 deletions(-)

diff --git a/core/relinker/relinker/tests/test_patch_advisor.py b/core/relinker/relinker/tests/test_patch_advisor.py
index bed41997bd..ae25bd0e96 100644
--- a/core/relinker/relinker/tests/test_patch_advisor.py
+++ b/core/relinker/relinker/tests/test_patch_advisor.py
@@ -25,27 +25,38 @@ def main():
         metadata = root / "param.json"
         metadata.write_text(json.dumps({"titleId": "TEST00001", "contentVersion": "01.000.000"}))
 
-        def advise(digest, patches=("patch.toml",)):
+        def advise(digest, patches=("patch.toml",), *options):
             (catalog / "index.json").write_text(json.dumps({"format": 1, "entries": [{
                 "titleId": "TEST00001", "contentVersion": "01.000.000", "patch": name,
                 "targets": {"eboot.bin": digest}
             } for name in patches]}))
             return subprocess.run([sys.executable, str(advisor), "--catalog", str(catalog),
                                    "--param-json", str(metadata), "--input", str(source),
-                                   "--relinker", f"./{relinker.name}", "--skip-sce-module"],
+                                   "--relinker", f"./{relinker.name}", "--skip-sce-module", *options],
                                   cwd=relinker.parent, capture_output=True, text=True, timeout=30)
 
-        result = advise(hashlib.sha256(image).hexdigest())
+        digest = hashlib.sha256(image).hexdigest()
+        result = advise(digest)
         assert result.returncode == 0 and f"Recommended: {patch}" in result.stdout, (result.stdout, result.stderr)
+        second = catalog / "second patch.toml"
+        second.write_text(patch_text(address, expected, "flip_bit"))
+        result = advise(digest, ("patch.toml", second.name))
+        assert result.returncode == 1 and "multiple verified catalog entries" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("patch.toml", second.name), "--list-verified")
+        assert result.returncode == 0 and "Verified catalog entries: 2" in result.stdout, (result.stdout, result.stderr)
+        assert f"Catalog entry 1: {patch}" in result.stdout and f"Catalog entry 2: {second}" in result.stdout, (result.stdout, result.stderr)
+        assert "Recommended:" not in result.stdout, (result.stdout, result.stderr)
         broken = catalog / "broken.toml"
         broken.write_text(patch_text(address, expected, "broken").replace('description = "flip one bit"',
                                                                      r'description = "flip \"one\" bit"'))
-        result = advise(hashlib.sha256(image).hexdigest(), ("broken.toml", "patch.toml"))
+        result = advise(digest, ("broken.toml", "patch.toml"))
         assert result.returncode == 0 and "relinker error (exit 2)" in result.stdout and f"Recommended: {patch}" in result.stdout, (result.stdout, result.stderr)
-        result = advise(hashlib.sha256(image).hexdigest(), ("broken.toml",))
+        result = advise(digest, ("broken.toml", "patch.toml"), "--list-verified")
+        assert result.returncode == 0 and "relinker error (exit 2)" in result.stdout and "Verified catalog entries: 1" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("broken.toml",), "--list-verified")
         assert result.returncode == 2 and "relinker error (exit 2)" in result.stdout, (result.stdout, result.stderr)
         patch.write_text(patch_text(address, expected ^ 1, "wrong_byte"))
-        result = advise(hashlib.sha256(image).hexdigest())
+        result = advise(digest)
         assert result.returncode == 1 and "rejected by relinker" in result.stdout, (result.stdout, result.stderr)
         patch.write_text(patch_text(address, expected, "flip_bit"))
         result = advise(hashlib.sha256(b"other build").hexdigest())
diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md
index 3a4dc187ee..4e31b9602e 100644
--- a/docs/user/USAGE.md
+++ b/docs/user/USAGE.md
@@ -103,7 +103,7 @@ A patch file changes bytes of the input executable or of a bundled module before
 The advisor requires Python 3.11 or newer. To check a local patch catalog, run:
 
 ```sh
-python3 tools/suggest_patches.py --catalog <directory> --param-json <sce_sys/param.json> --input <input.elf> --relinker <relinker> [--sce-module-path <directory>] [--module-dir <directory>]... [--executable <path>]... [--skip-sce-module] [--timeout-seconds <seconds>]
+python3 tools/suggest_patches.py --catalog <directory> --param-json <sce_sys/param.json> --input <input.elf> --relinker <relinker> [--sce-module-path <directory>] [--module-dir <directory>]... [--executable <path>]... [--skip-sce-module] [--timeout-seconds <seconds>] [--list-verified]
 ```
 
 The advisor reads `titleId` and `contentVersion` from the specified `param.json`, checks the SHA-256 of every file targeted by a candidate patch, then calls the relinker specified by `--relinker` to run `--verify-patches`. A relative path such as `--relinker ./relinker` resolves to that local file. The explicit metadata path also works when `param.json` and the unwrapped ELF files are stored separately. The catalog directory must contain an `index.json` with `format: 1` and an `entries` array. Each entry has `titleId`, `contentVersion`, a relative `patch` path, and `targets` mapping every patch target to its SHA-256. Hexadecimal digests are case-insensitive. For example:
@@ -122,6 +122,8 @@ The advisor reads `titleId` and `contentVersion` from the specified `param.json`
 
 The advisor validates patch files only for entries matching the requested title and version. It reports and skips a malformed matching entry or a relinker verification error, so another valid entry can still be recommended. Verification times out after 120 seconds per entry by default; use `--timeout-seconds <positive integer>` to change the limit. For synthetic inputs without system modules, use `--skip-sce-module` if conversion also uses it; this option conflicts with `--sce-module-path`. No matching entry or no verified patch exits `1`; invalid input or no verified patch after a relinker error exits `2`. If multiple entries verify, the advisor recommends none because it cannot choose or combine them. The tool does not fetch or apply patches. A recommendation prints `--patches` and the module and executable options to use when converting. Keep catalog patch files outside the input executable's directory to avoid automatic `relinker-patches.toml` discovery.
 
+With `--list-verified`, the advisor prints every entry that passes metadata, hash and relinker checks, in catalog order. Each result includes its catalog number, patch file, target hashes and conversion options. It exits `0` when at least one entry verifies, even if another entry was rejected; with no verified entries, the existing `1` or `2` exit status still applies. Without this option, a single verified entry is recommended and multiple verified entries remain ambiguous. Listing entries does not combine patch files or apply them during conversion; choose a patch explicitly after reviewing it.
+
 The target hashes identify the exact unwrapped files changed by a patch, which might not include the main executable. Different dump tools could produce different bytes for the same title version; the advisor then rejects a patch even if it would work. It has not been confirmed that all dump tools produce identical files. The hashes do not authenticate a catalog or establish that a patch is safe or that the title is fully playable. Use catalogs from sources you trust and review the patch before applying it.
 
 If the patch targets another title executable, pass `--executable <path>` to the advisor for each additional executable, using paths relative to the module parent directory, such as `picker/picker.bin`. The advisor hashes those target files and forwards the same options to `relinker --verify-patches`. Use the same `--executable` options when converting with `--patches`.
diff --git a/tools/suggest_patches.py b/tools/suggest_patches.py
index 51d91d85a1..46995b9379 100644
--- a/tools/suggest_patches.py
+++ b/tools/suggest_patches.py
@@ -38,6 +38,19 @@ def command_line(arguments):
     return subprocess.list2cmdline(arguments) if os.name == "nt" else shlex.join(arguments)
 
 
+def conversion_options(args, patch):
+    options = ["--patches", str(patch)]
+    if args.skip_sce_module:
+        options.append("--skip-sce-module")
+    if args.sce_module_path:
+        options.extend(("--sce-module-path", str(args.sce_module_path)))
+    for module_dir in args.module_dir:
+        options.extend(("--module-dir", module_dir))
+    for executable in args.executable:
+        options.extend(("--executable", executable))
+    return command_line(options)
+
+
 def load_catalog(directory, title, version):
     data = json.loads(confined(directory, "index.json").read_text(encoding="utf-8"))
     if not isinstance(data, dict) or set(data) != {"format", "entries"} or type(data["format"]) is not int or data["format"] != 1 or not isinstance(data["entries"], list):
@@ -79,6 +92,7 @@ def main(argv=None):
     parser.add_argument("--executable", action="append", default=[], help="additional title executable relative to the module parent; repeatable")
     parser.add_argument("--skip-sce-module", action="store_true", help="skip bundled modules during verification")
     parser.add_argument("--timeout-seconds", type=int, default=120, help="maximum seconds per relinker verification (default: 120)")
+    parser.add_argument("--list-verified", action="store_true", help="list every verified catalog entry without choosing one")
     args = parser.parse_args(argv)
     try:
         metadata = json.loads(args.param_json.read_text(encoding="utf-8"))
@@ -102,7 +116,8 @@ def main(argv=None):
         matches = []
         entries = load_catalog(args.catalog.resolve(), title, version)
         if not entries:
-            print(f"No recommendation: no catalog entry for {title} {version}.")
+            prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
+            print(f"{prefix}: no catalog entry for {title} {version}.")
             return 1
         relinker_errors = False
         for number, entry in entries:
@@ -157,29 +172,30 @@ def main(argv=None):
                 print(f"{label}: rejected: relinker did not confirm every patch")
                 continue
             matches.append((number, entry, patch, targets))
+        if args.list_verified and matches:
+            print(f"Verified catalog entries: {len(matches)}")
+            for number, entry, patch, targets in matches:
+                print(f"Catalog entry {number}: {patch}")
+                for name, digest in targets.items():
+                    print(f"  {name} SHA-256 {digest}")
+                print(f"Use these options when converting:\n  {conversion_options(args, patch)}")
+            return 0
         if len(matches) == 1:
             number, entry, patch, targets = matches[0]
             print(f"Recommended: {patch} (catalog entry {number})")
             for name, digest in targets.items():
                 print(f"  {name} SHA-256 {digest}")
-            conversion = ["--patches", str(patch)]
-            if args.skip_sce_module:
-                conversion.append("--skip-sce-module")
-            if args.sce_module_path:
-                conversion.extend(("--sce-module-path", str(args.sce_module_path)))
-            for module_dir in args.module_dir:
-                conversion.extend(("--module-dir", module_dir))
-            for executable in args.executable:
-                conversion.extend(("--executable", executable))
-            print(f"Use these options when converting:\n  {command_line(conversion)}")
+            print(f"Use these options when converting:\n  {conversion_options(args, patch)}")
             return 0
         if len(matches) > 1:
             print("No recommendation: multiple verified catalog entries match.")
             return 1
         if relinker_errors:
-            print("No recommendation: relinker errors occurred; see catalog entries above.", file=sys.stderr)
+            prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
+            print(f"{prefix}: relinker errors occurred; see catalog entries above.", file=sys.stderr)
             return 2
-        print("No recommendation: no catalog entry passed all checks.")
+        prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
+        print(f"{prefix}: no catalog entry passed all checks.")
         return 1
     except (OSError, ValueError, json.JSONDecodeError, tomllib.TOMLDecodeError) as error:
         print(f"Patch advisor: {error}", file=sys.stderr)
diff --git a/tools/tests/test_suggest_patches.py b/tools/tests/test_suggest_patches.py
index 0da25c6f5d..5adf80b6e4 100644
--- a/tools/tests/test_suggest_patches.py
+++ b/tools/tests/test_suggest_patches.py
@@ -192,6 +192,70 @@ class PatchAdvisorTests(unittest.TestCase):
         self.assertIn("multiple verified catalog entries", output.getvalue())
         self.assertEqual(run.call_count, 2)
 
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_shows_each_match_and_quoted_patch_path(self, run):
+        second = self.catalog / "second patch.toml"
+        second.write_bytes((self.catalog / "patch.toml").read_bytes())
+        self.write_index([self.entry, dict(self.entry, patch=second.name)])
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified"), 0)
+        self.assertIn("Verified catalog entries: 2", output.getvalue())
+        self.assertIn(f"Catalog entry 1: {self.catalog / 'patch.toml'}", output.getvalue())
+        self.assertIn(f"Catalog entry 2: {second}", output.getvalue())
+        self.assertIn(suggest_patches.command_line(["--patches", str(second), "--module-dir", "Media/Modules"]), output.getvalue())
+        self.assertEqual(output.getvalue().count("SHA-256"), 2)
+        self.assertNotIn("Recommended:", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_single_match_preserves_conversion_options(self, run):
+        self.additional_executable()
+        run.return_value.returncode = 0
+        run.return_value.stdout = VERIFIED
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified", "--executable", "picker/picker.bin",
+                                         "--sce-module-path", str(self.root)), 0)
+        expected = suggest_patches.command_line(["--patches", str(self.catalog / "patch.toml"),
+                                                  "--sce-module-path", str(self.root), "--module-dir",
+                                                  "Media/Modules", "--executable", "picker/picker.bin"])
+        self.assertIn(expected, output.getvalue())
+        self.assertIn("Verified catalog entries: 1", output.getvalue())
+        self.assertNotIn("Recommended:", output.getvalue())
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_skips_individual_errors(self, run):
+        bad = dict(self.entry, patch="missing.toml")
+        self.write_index([bad, self.entry, self.entry])
+        run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 0, VERIFIED, "")]
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified"), 0)
+        self.assertIn("Catalog entry 1 ('missing.toml'): rejected", output.getvalue())
+        self.assertIn("Catalog entry 2 ('patch.toml'): relinker error (exit 2)", output.getvalue())
+        self.assertIn("Verified catalog entries: 1", output.getvalue())
+        self.assertIn(f"Catalog entry 3: {self.catalog / 'patch.toml'}", output.getvalue())
+        self.assertEqual(run.call_count, 2)
+
+    @patch.object(suggest_patches.subprocess, "run")
+    def test_list_verified_no_match_keeps_exit_statuses(self, run):
+        self.write_index([])
+        output = io.StringIO()
+        with contextlib.redirect_stdout(output):
+            self.assertEqual(self.advise("--list-verified"), 1)
+        self.assertIn("No verified catalog entries: no catalog entry", output.getvalue())
+        run.assert_not_called()
+        self.write_index()
+        run.return_value = subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch")
+        errors = io.StringIO()
+        with contextlib.redirect_stderr(errors):
+            self.assertEqual(self.advise("--list-verified"), 2)
+        self.assertIn("No verified catalog entries: relinker errors occurred", errors.getvalue())
+
     @patch.object(suggest_patches.subprocess, "run")
     def test_not_checked_patch_is_not_recommended(self, run):
         run.return_value.returncode = 0

From 618d6d3df6f5028d3dfce9619db2105f67effae6 Mon Sep 17 00:00:00 2001
From: WhiteAssassins <28965087+WhiteAssassins@users.noreply.github.com>
Date: Sat, 24 Oct 2026 14:55:25 -0400
Subject: [PATCH 082/218] test(tools): exclude incompatible patches from
 listing

---
 core/relinker/relinker/tests/test_patch_advisor.py |  3 +++
 tools/tests/test_suggest_patches.py                | 12 ++++++++----
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/core/relinker/relinker/tests/test_patch_advisor.py b/core/relinker/relinker/tests/test_patch_advisor.py
index ae25bd0e96..f18d446b2e 100644
--- a/core/relinker/relinker/tests/test_patch_advisor.py
+++ b/core/relinker/relinker/tests/test_patch_advisor.py
@@ -46,6 +46,7 @@ def main():
         assert result.returncode == 0 and "Verified catalog entries: 2" in result.stdout, (result.stdout, result.stderr)
         assert f"Catalog entry 1: {patch}" in result.stdout and f"Catalog entry 2: {second}" in result.stdout, (result.stdout, result.stderr)
         assert "Recommended:" not in result.stdout, (result.stdout, result.stderr)
+        assert source.read_bytes() == image
         broken = catalog / "broken.toml"
         broken.write_text(patch_text(address, expected, "broken").replace('description = "flip one bit"',
                                                                      r'description = "flip \"one\" bit"'))
@@ -58,6 +59,8 @@ def main():
         patch.write_text(patch_text(address, expected ^ 1, "wrong_byte"))
         result = advise(digest)
         assert result.returncode == 1 and "rejected by relinker" in result.stdout, (result.stdout, result.stderr)
+        result = advise(digest, ("patch.toml",), "--list-verified")
+        assert result.returncode == 1 and "rejected by relinker" in result.stdout and "Catalog entry 1:" not in result.stdout, (result.stdout, result.stderr)
         patch.write_text(patch_text(address, expected, "flip_bit"))
         result = advise(hashlib.sha256(b"other build").hexdigest())
         assert result.returncode == 1 and "SHA-256 mismatch" in result.stdout, (result.stdout, result.stderr)
diff --git a/tools/tests/test_suggest_patches.py b/tools/tests/test_suggest_patches.py
index 5adf80b6e4..52c25bd82a 100644
--- a/tools/tests/test_suggest_patches.py
+++ b/tools/tests/test_suggest_patches.py
@@ -229,17 +229,21 @@ class PatchAdvisorTests(unittest.TestCase):
     @patch.object(suggest_patches.subprocess, "run")
     def test_list_verified_skips_individual_errors(self, run):
         bad = dict(self.entry, patch="missing.toml")
-        self.write_index([bad, self.entry, self.entry])
+        wrong_hash = dict(self.entry, targets={"Media/Modules/module.prx": "0" * 64})
+        self.write_index([bad, wrong_hash, self.entry, self.entry, self.entry])
         run.side_effect = [subprocess.CompletedProcess([], 2, "", "FAIL: invalid patch"),
+                           subprocess.CompletedProcess([], 1, "Verified 1 patches: 0 ok, 0 not-checked, 1 mismatch\n", ""),
                            subprocess.CompletedProcess([], 0, VERIFIED, "")]
         output = io.StringIO()
         with contextlib.redirect_stdout(output):
             self.assertEqual(self.advise("--list-verified"), 0)
         self.assertIn("Catalog entry 1 ('missing.toml'): rejected", output.getvalue())
-        self.assertIn("Catalog entry 2 ('patch.toml'): relinker error (exit 2)", output.getvalue())
+        self.assertIn("Catalog entry 2 ('patch.toml'): rejected: Media/Modules/module.prx: SHA-256 mismatch", output.getvalue())
+        self.assertIn("Catalog entry 3 ('patch.toml'): relinker error (exit 2)", output.getvalue())
+        self.assertIn("Catalog entry 4 ('patch.toml'): rejected by relinker", output.getvalue())
         self.assertIn("Verified catalog entries: 1", output.getvalue())
-        self.assertIn(f"Catalog entry 3: {self.catalog / 'patch.toml'}", output.getvalue())
-        self.assertEqual(run.call_count, 2)
+        self.assertIn(f"Catalog entry 5: {self.catalog / 'patch.toml'}", output.getvalue())
+        self.assertEqual(run.call_count, 3)
 
     @patch.object(suggest_patches.subprocess, "run")
     def test_list_verified_no_match_keeps_exit_statuses(self, run):

From decf5429c56b4a8f46cb7a011c86c6f4d60d755b Mon Sep 17 00:00:00 2001
From: WhiteAssassins <28965087+WhiteAssassins@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:12:00 -0400
Subject: [PATCH 083/218] test(tools): assert quoted listed patch path

---
 tools/tests/test_suggest_patches.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/tests/test_suggest_patches.py b/tools/tests/test_suggest_patches.py
index 52c25bd82a..afb4834377 100644
--- a/tools/tests/test_suggest_patches.py
+++ b/tools/tests/test_suggest_patches.py
@@ -2,6 +2,7 @@ import contextlib
 import hashlib
 import io
 import json
+import os
 import subprocess
 import sys
 import tempfile
@@ -205,7 +206,8 @@ class PatchAdvisorTests(unittest.TestCase):
         self.assertIn("Verified catalog entries: 2", output.getvalue())
         self.assertIn(f"Catalog entry 1: {self.catalog / 'patch.toml'}", output.getvalue())
         self.assertIn(f"Catalog entry 2: {second}", output.getvalue())
-        self.assertIn(suggest_patches.command_line(["--patches", str(second), "--module-dir", "Media/Modules"]), output.getvalue())
+        quoted = f'"{second}"' if os.name == "nt" else f"'{second}'"
+        self.assertIn(f"--patches {quoted} --module-dir Media/Modules", output.getvalue())
         self.assertEqual(output.getvalue().count("SHA-256"), 2)
         self.assertNotIn("Recommended:", output.getvalue())
         self.assertEqual(run.call_count, 2)

From dbe74bf422e953f24c4fe9af824e5e7b7b49adfc Mon Sep 17 00:00:00 2001
From: WhiteAssassins <28965087+WhiteAssassins@users.noreply.github.com>
Date: Sat, 24 Oct 2026 15:24:38 -0400
Subject: [PATCH 084/218] fix(tools): guide users through verified patch
 choices

---
 core/relinker/relinker/tests/test_patch_advisor.py | 3 ++-
 docs/user/USAGE.md                                 | 4 ++--
 tools/suggest_patches.py                           | 7 +++----
 tools/tests/test_suggest_patches.py                | 4 +++-
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/core/relinker/relinker/tests/test_patch_advisor.py b/core/relinker/relinker/tests/test_patch_advisor.py
index f18d446b2e..f31bbd882c 100644
--- a/core/relinker/relinker/tests/test_patch_advisor.py
+++ b/core/relinker/relinker/tests/test_patch_advisor.py
@@ -41,9 +41,10 @@ def main():
         second = catalog / "second patch.toml"
         second.write_text(patch_text(address, expected, "flip_bit"))
         result = advise(digest, ("patch.toml", second.name))
-        assert result.returncode == 1 and "multiple verified catalog entries" in result.stdout, (result.stdout, result.stderr)
+        assert result.returncode == 1 and "multiple verified catalog entries match; use --list-verified to see them" in result.stdout, (result.stdout, result.stderr)
         result = advise(digest, ("patch.toml", second.name), "--list-verified")
         assert result.returncode == 0 and "Verified catalog entries: 2" in result.stdout, (result.stdout, result.stderr)
+        assert "Choose one patch file; listed entries are not combined." in result.stdout, (result.stdout, result.stderr)
         assert f"Catalog entry 1: {patch}" in result.stdout and f"Catalog entry 2: {second}" in result.stdout, (result.stdout, result.stderr)
         assert "Recommended:" not in result.stdout, (result.stdout, result.stderr)
         assert source.read_bytes() == image
diff --git a/docs/user/USAGE.md b/docs/user/USAGE.md
index 4e31b9602e..006353b583 100644
--- a/docs/user/USAGE.md
+++ b/docs/user/USAGE.md
@@ -120,9 +120,9 @@ The advisor reads `titleId` and `contentVersion` from the specified `param.json`
 }
 ```
 
-The advisor validates patch files only for entries matching the requested title and version. It reports and skips a malformed matching entry or a relinker verification error, so another valid entry can still be recommended. Verification times out after 120 seconds per entry by default; use `--timeout-seconds <positive integer>` to change the limit. For synthetic inputs without system modules, use `--skip-sce-module` if conversion also uses it; this option conflicts with `--sce-module-path`. No matching entry or no verified patch exits `1`; invalid input or no verified patch after a relinker error exits `2`. If multiple entries verify, the advisor recommends none because it cannot choose or combine them. The tool does not fetch or apply patches. A recommendation prints `--patches` and the module and executable options to use when converting. Keep catalog patch files outside the input executable's directory to avoid automatic `relinker-patches.toml` discovery.
+The advisor validates patch files only for entries matching the requested title and version. It reports and skips a malformed matching entry or a relinker verification error, so another valid entry can still be recommended. Verification times out after 120 seconds per entry by default; use `--timeout-seconds <positive integer>` to change the limit. For synthetic inputs without system modules, use `--skip-sce-module` if conversion also uses it; this option conflicts with `--sce-module-path`. No matching entry or no verified patch exits `1`; invalid input or no verified patch after a relinker error exits `2`. If multiple entries verify, the advisor recommends none because it cannot choose or combine them, and points to `--list-verified` to inspect the matches. The tool does not fetch or apply patches. A recommendation prints `--patches` and the module and executable options to use when converting. Keep catalog patch files outside the input executable's directory to avoid automatic `relinker-patches.toml` discovery.
 
-With `--list-verified`, the advisor prints every entry that passes metadata, hash and relinker checks, in catalog order. Each result includes its catalog number, patch file, target hashes and conversion options. It exits `0` when at least one entry verifies, even if another entry was rejected; with no verified entries, the existing `1` or `2` exit status still applies. Without this option, a single verified entry is recommended and multiple verified entries remain ambiguous. Listing entries does not combine patch files or apply them during conversion; choose a patch explicitly after reviewing it.
+With `--list-verified`, the advisor prints every entry that passes metadata, hash and relinker checks, in catalog order. Each result includes its catalog number, patch file, target hashes and conversion options. It exits `0` when at least one entry verifies, even if another entry was rejected; with no verified entries, the existing `1` or `2` exit status still applies. Without this option, a single verified entry is recommended and multiple verified entries remain ambiguous. The listing tells users to choose one patch file. It does not combine patch files or apply them during conversion; review the chosen patch before applying it.
 
 The target hashes identify the exact unwrapped files changed by a patch, which might not include the main executable. Different dump tools could produce different bytes for the same title version; the advisor then rejects a patch even if it would work. It has not been confirmed that all dump tools produce identical files. The hashes do not authenticate a catalog or establish that a patch is safe or that the title is fully playable. Use catalogs from sources you trust and review the patch before applying it.
 
diff --git a/tools/suggest_patches.py b/tools/suggest_patches.py
index 46995b9379..9e59781af8 100644
--- a/tools/suggest_patches.py
+++ b/tools/suggest_patches.py
@@ -94,6 +94,7 @@ def main(argv=None):
     parser.add_argument("--timeout-seconds", type=int, default=120, help="maximum seconds per relinker verification (default: 120)")
     parser.add_argument("--list-verified", action="store_true", help="list every verified catalog entry without choosing one")
     args = parser.parse_args(argv)
+    prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
     try:
         metadata = json.loads(args.param_json.read_text(encoding="utf-8"))
         if not isinstance(metadata, dict):
@@ -116,7 +117,6 @@ def main(argv=None):
         matches = []
         entries = load_catalog(args.catalog.resolve(), title, version)
         if not entries:
-            prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
             print(f"{prefix}: no catalog entry for {title} {version}.")
             return 1
         relinker_errors = False
@@ -174,6 +174,7 @@ def main(argv=None):
             matches.append((number, entry, patch, targets))
         if args.list_verified and matches:
             print(f"Verified catalog entries: {len(matches)}")
+            print("Choose one patch file; listed entries are not combined.")
             for number, entry, patch, targets in matches:
                 print(f"Catalog entry {number}: {patch}")
                 for name, digest in targets.items():
@@ -188,13 +189,11 @@ def main(argv=None):
             print(f"Use these options when converting:\n  {conversion_options(args, patch)}")
             return 0
         if len(matches) > 1:
-            print("No recommendation: multiple verified catalog entries match.")
+            print("No recommendation: multiple verified catalog entries match; use --list-verified to see them.")
             return 1
         if relinker_errors:
-            prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
             print(f"{prefix}: relinker errors occurred; see catalog entries above.", file=sys.stderr)
             return 2
-        prefix = "No verified catalog entries" if args.list_verified else "No recommendation"
         print(f"{prefix}: no catalog entry passed all checks.")
         return 1
     except (OSError, ValueError, json.JSONDecodeError, tomllib.TOMLDecodeError) as error:
diff --git a/tools/tests/test_suggest_patches.py b/tools/tests/test_suggest_patches.py
index afb4834377..cc6709280d 100644
--- a/tools/tests/test_suggest_patches.py
+++ b/tools/tests/test_suggest_patches.py
@@ -190,7 +190,7 @@ class PatchAdvisorTests(unittest.TestCase):
         output = io.StringIO()
         with contextlib.redirect_stdout(output):
             self.assertEqual(self.advise(), 1)
-        self.assertIn("multiple verified catalog entries", output.getvalue())
+        self.assertIn("multiple verified catalog entries match; use --list-verified to see them.", output.getvalue())
         self.assertEqual(run.call_count, 2)
 
     @patch.object(suggest_patches.subprocess, "run")
@@ -204,6 +204,7 @@ class PatchAdvisorTests(unittest.TestCase):
         with contextlib.redirect_stdout(output):
             self.assertEqual(self.advise("--list-verified"), 0)
         self.assertIn("Verified catalog entries: 2", output.getvalue())
+        self.assertIn("Choose one patch file; listed entries are not combined.", output.getvalue())
         self.assertIn(f"Catalog entry 1: {self.catalog / 'patch.toml'}", output.getvalue())
         self.assertIn(f"Catalog entry 2: {second}", output.getvalue())
         quoted = f'"{second}"' if os.name == "nt" else f"'{second}'"
@@ -226,6 +227,7 @@ class PatchAdvisorTests(unittest.TestCase):
                                                   "Media/Modules", "--executable", "picker/picker.bin"])
         self.assertIn(expected, output.getvalue())
         self.assertIn("Verified catalog entries: 1", output.getvalue())
+        self.assertIn("Choose one patch file; listed entries are not combined.", output.getvalue())
         self.assertNotIn("Recommended:", output.getvalue())
 
     @patch.object(suggest_patches.subprocess, "run")

From 6e97cdd3e5cc6f244862d4c896b2fec0563398c0 Mon Sep 17 00:00:00 2001
From: Emanuele <118837721+imellag@users.noreply.github.com>
Date: Sat, 24 Oct 2026 21:55:02 +0200
Subject: [PATCH 085/218] refactor(libkernel): drop the unreachable dot checks
 after sceKernelRename's return

---
 core/libs/prx/libkernel/File/src/Stdio.cpp | 2 --
 1 file changed, 2 deletions(-)

diff --git a/core/libs/prx/libkernel/File/src/Stdio.cpp b/core/libs/prx/libkernel/File/src/Stdio.cpp
index 61d1e37967..dad77fcd57 100644
--- a/core/libs/prx/libkernel/File/src/Stdio.cpp
+++ b/core/libs/prx/libkernel/File/src/Stdio.cpp
@@ -1506,8 +1506,6 @@ int APS5_VABI sceKernelRename(const char* from, const char* to) {
     if (!from) return SceErrorFromErrno(GUEST_EFAULT);
     const int result = RenameGuestPath_nid_no_patch(from, to);
     return result == 0 ? 0 : SceKernelError(errno);
-    if (const int dot = RenameDotError_nid_no_patch(from)) return SceKernelError(dot);
-    if (const int dot = RenameDotError_nid_no_patch(to)) return SceKernelError(dot);
 }
 
 int APS5_VABI sceKernelRmdir(const char* path) {

From c5229e510a4b463fd4f6d39f017793d753f7c86b Mon Sep 17 00:00:00 2001
From: ArjenS-LA <arjensingh@outlook.com>
Date: Sat, 24 Oct 2026 15:11:21 -0700
Subject: [PATCH 086/218] test(libkernel): fix Windows directory link fixture
 paths and cleanup

---
 core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
index 4278bdaf41..865e59e92f 100644
--- a/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
+++ b/core/libs/tests/GuestWindowsDirectoryLinkTypes.cpp
@@ -114,7 +114,7 @@ static void OutsideApp0() {
         Require(lstat_nid_postfix(path.string().c_str(), &status) == 0);
         Require((status.st_mode & 0170000) == 0120000);
     }
-    for (const auto& name : links) Require(std::filesystem::remove(root / name));
+    for (const auto& name : links) Require(RemoveDirectoryW((root / name).c_str()) != 0 || DeleteFileW((root / name).c_str()) != 0);
     Require(std::filesystem::remove_all(root) == 3);
 }
 
@@ -166,11 +166,11 @@ int main() {
     junction("data/saved", "external");
     junction("app0-sibling/saved", "external");
     { std::ofstream file(root / "external/regular"); file << "data"; }
-    const bool symbolic = CreateSymbolicLinkW((root / "app0/file-link").c_str(), L"../external/regular",
+    const bool symbolic = CreateSymbolicLinkW((root / "app0/file-link").c_str(), L"..\\external\\regular",
         SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0;
     if (symbolic) {
         links.push_back("app0/file-link");
-        Require(CreateSymbolicLinkW((root / "app0/relative").c_str(), L"../external",
+        Require(CreateSymbolicLinkW((root / "app0/relative").c_str(), L"..\\external",
             SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE) != 0);
         links.push_back("app0/relative");
     } else {
@@ -188,7 +188,7 @@ int main() {
     Require(Types((root / "app0-sibling").string().c_str()).at("saved") == 10);
     FileStat status{};
     Require(lstat_nid_postfix("/app0/packed", &status) == 0 && (status.st_mode & 0170000) == 0120000);
-    for (auto it = links.rbegin(); it != links.rend(); ++it) Require(std::filesystem::remove(root / *it));
+    for (auto it = links.rbegin(); it != links.rend(); ++it) Require(RemoveDirectoryW((root / *it).c_str()) != 0 || DeleteFileW((root / *it).c_str()) != 0);
     std::filesystem::rename(root / "app0", root / "application");
     Junction(root / "app0", root / "application");
     Junction(root / "application/packed", root / "external");

From 878124772c13c76de4e180bc7e801a7c4abb0525 Mon Sep 17 00:00:00 2001
From: Disaster <Disvster.wav@gmail.com>
Date: Fri, 23 Oct 2026 00:58:52 +0300
Subject: [PATCH 087/218] feat(libc): implement _Exp and _FExp

---
 core/libs/prx/libc/include/Api.hpp            |   2 +
 .../libs/prx/libc/src/DinkumwareInternals.cpp | 186 ++++++++++++++++++
 core/libs/tests/GuestDinkumwareInternals.cpp  | 157 +++++++++++++++
 docs/dev/debt/libc.md                         |   1 +
 4 files changed, 346 insertions(+)

diff --git a/core/libs/prx/libc/include/Api.hpp b/core/libs/prx/libc/include/Api.hpp
index afdb17d63c..ed63181454 100644
--- a/core/libs/prx/libc/include/Api.hpp
+++ b/core/libs/prx/libc/include/Api.hpp
@@ -601,6 +601,8 @@ float APS5_VABI __powisf2_nid_postfix(float base, int exponent);
 double APS5_VABI __powidf2_nid_postfix(double base, int exponent);
 float APS5_VABI expf_nid_postfix(float x);
 float APS5_VABI exp2f_nid_postfix(float x);
+short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset);
+short APS5_VABI _FExp_nid_postfix(float* value, float y, short offset);
 float APS5_VABI logf_nid_postfix(float x);
 float APS5_VABI log2f_nid_postfix(float x);
 double APS5_VABI log10_nid_postfix(double x);
diff --git a/core/libs/prx/libc/src/DinkumwareInternals.cpp b/core/libs/prx/libc/src/DinkumwareInternals.cpp
index d1f8ac33f4..b98a5ed820 100644
--- a/core/libs/prx/libc/src/DinkumwareInternals.cpp
+++ b/core/libs/prx/libc/src/DinkumwareInternals.cpp
@@ -1,9 +1,13 @@
 #include "prx/libc/include/Api.hpp"
 #include <algorithm>
 #include <cctype>
+#include <cerrno>
+#include <cfenv>
 #include <cmath>
 #include <cstdint>
 #include <cstdlib>
+#include <limits>
+#include <stdexcept>
 #include <string>
 
 #include "prx/libc/include/General.hpp"
@@ -73,6 +77,76 @@ TInteger ParsedInteger(const char* text, char** end, int base, int* error, TInte
     return value;
 }
 
+constexpr short Denormal = -2, Finite = -1, Zero = 0, Infinite = 1, NotANumber = 2;
+
+short ClassifyDouble(double value) {
+    switch (std::fpclassify(value)) {
+    case FP_NAN:
+        return NotANumber;
+    case FP_INFINITE:
+        return Infinite;
+    case FP_ZERO:
+        return Zero;
+    case FP_SUBNORMAL:
+        return Denormal;
+    default:
+        return Finite;
+    }
+}
+
+short ClassifyFloat(float value) {
+    switch (std::fpclassify(value)) {
+    case FP_NAN:
+        return NotANumber;
+    case FP_INFINITE:
+        return Infinite;
+    case FP_ZERO:
+        return Zero;
+    case FP_SUBNORMAL:
+        return Denormal;
+    default:
+        return Finite;
+    }
+}
+
+void RaiseLibcError(int exceptions) {
+    if ((exceptions & (FE_OVERFLOW | FE_UNDERFLOW)) != 0) exceptions |= FE_INEXACT;
+    std::feraiseexcept(exceptions);
+    const bool range = (exceptions & FE_INVALID) == 0 &&
+        (exceptions & (FE_DIVBYZERO | FE_OVERFLOW | FE_UNDERFLOW)) != 0;
+    errno = range ? ERANGE : EDOM;
+}
+
+short ScaleDouble(double& value, long exponent) {
+    const short kind = ClassifyDouble(value);
+    if (kind == NotANumber) return kind;
+    if (kind == Infinite) {
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    if (kind == Zero) return Zero;
+    value = std::scalbn(value, static_cast<int>(exponent));
+    const short result = ClassifyDouble(value);
+    if (result == Infinite) RaiseLibcError(FE_OVERFLOW);
+    if (result == Zero || result == Denormal) RaiseLibcError(FE_UNDERFLOW);
+    return result;
+}
+
+short ScaleFloat(float& value, long exponent) {
+    const short kind = ClassifyFloat(value);
+    if (kind == NotANumber) return kind;
+    if (kind == Infinite) {
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    if (kind == Zero) return Zero;
+    value = std::scalbn(value, static_cast<int>(exponent));
+    const short result = ClassifyFloat(value);
+    if (result == Infinite) RaiseLibcError(FE_OVERFLOW);
+    if (result == Zero || result == Denormal) RaiseLibcError(FE_UNDERFLOW);
+    return result;
+}
+
 }
 
 extern "C" {
@@ -131,6 +205,118 @@ long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base) {
     return _Stollx_nid_postfix(text, end, base, nullptr);
 }
 
+short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset) {
+    if (value == nullptr) throw std::invalid_argument("_Exp: null value");
+    const double x = *value;
+    constexpr double HugeExp = 1842.0;
+    constexpr double Eps = std::numeric_limits<double>::epsilon();
+    constexpr double InverseLn2 = 1.4426950408889634073599246810018921;
+    constexpr double Ln2High = 22713.0 / 32768.0;
+    constexpr double Ln2Low = 1.4286068203094172321214581765680755e-6;
+    constexpr double P1 = 420.30235984910635;
+    constexpr double P2 = 15132.70094680474802;
+    constexpr double Q0 = 30.01511290683317;
+    constexpr double Q1 = 3362.72154416553028;
+    constexpr double Q2 = 30265.40189360949691;
+    if (std::isnan(x)) {
+        *value = x;
+        return NotANumber;
+    }
+    if (std::isnan(y)) {
+        *value = y;
+        return NotANumber;
+    }
+    if (y == 0.0) {
+        *value = 0.0;
+        return Zero;
+    }
+    if (x < -HugeExp) {
+        *value = std::copysign(0.0, y);
+        RaiseLibcError(FE_UNDERFLOW);
+        return Zero;
+    }
+    if (x > HugeExp) {
+        *value = std::copysign(std::numeric_limits<double>::infinity(), y);
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    if (std::isinf(y)) {
+        *value = y;
+        return Infinite;
+    }
+    double g = x * InverseLn2;
+    short exponent = static_cast<short>(g + (g < 0.0 ? -0.5 : 0.5));
+    g = static_cast<double>(exponent);
+    g = (x - g * Ln2High) - g * Ln2Low;
+    double result;
+    if (-Eps < g && g < Eps) {
+        result = y;
+    } else {
+        const double z = g * g;
+        const double w = (Q0 * z + Q1) * z + Q2;
+        g *= (z + P1) * z + P2;
+        result = (w + g) / (w - g) * 2.0 * y;
+        --exponent;
+    }
+    *value = result;
+    return ScaleDouble(*value, static_cast<long>(exponent) + offset);
+}
+
+short APS5_VABI _FExp_nid_postfix(float* value, float y, short offset) {
+    if (value == nullptr) throw std::invalid_argument("_FExp: null value");
+    const float x = *value;
+    constexpr float HugeExp = 229.0f;
+    constexpr float Eps = std::numeric_limits<float>::epsilon();
+    constexpr float InverseLn2 = 1.4426950408889634073599246810018921f;
+    constexpr float Ln2High = 22713.0f / 32768.0f;
+    constexpr float Ln2Low = 1.4286068203094172321214581765680755e-6f;
+    constexpr float P1 = 60.09114349f;
+    constexpr float Q0 = 12.01517514f;
+    constexpr float Q1 = 120.18228722f;
+    if (std::isnan(x)) {
+        *value = x;
+        return NotANumber;
+    }
+    if (std::isnan(y)) {
+        *value = y;
+        return NotANumber;
+    }
+    if (y == 0.0f) {
+        *value = 0.0f;
+        return Zero;
+    }
+    if (x < -HugeExp) {
+        *value = std::copysign(0.0f, y);
+        RaiseLibcError(FE_UNDERFLOW);
+        return Zero;
+    }
+    if (x > HugeExp) {
+        *value = std::copysign(std::numeric_limits<float>::infinity(), y);
+        RaiseLibcError(FE_OVERFLOW);
+        return Infinite;
+    }
+    if (std::isinf(y)) {
+        *value = y;
+        return Infinite;
+    }
+    float g = x * InverseLn2;
+    short exponent = static_cast<short>(g + (g < 0.0f ? -0.5f : 0.5f));
+    g = static_cast<float>(exponent);
+    g = (x - g * Ln2High) - g * Ln2Low;
+    float result;
+    if (-Eps < g && g < Eps) {
+        result = y;
+    } else {
+        const float z = g * g;
+        const float w = Q0 * z + Q1;
+        g *= z + P1;
+        result = (w + g) / (w - g) * 2.0f * y;
+        --exponent;
+    }
+    *value = result;
+    return ScaleFloat(*value, static_cast<long>(exponent) + offset);
+}
+
 double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant) {
     return quadrant != 0 ? cos_nid_postfix(x) : sin_nid_postfix(x);
 }
diff --git a/core/libs/tests/GuestDinkumwareInternals.cpp b/core/libs/tests/GuestDinkumwareInternals.cpp
index 6e1ffdf7e4..0aa1bdd59c 100644
--- a/core/libs/tests/GuestDinkumwareInternals.cpp
+++ b/core/libs/tests/GuestDinkumwareInternals.cpp
@@ -1,5 +1,7 @@
 #include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
+#include <cfenv>
 #include <cmath>
 #include <cstdint>
 #include <cstdio>
@@ -158,6 +160,160 @@ void TestIntegerErrors() {
     Require(_Stoullx_nid_postfix("18446744073709551616", &end, 10, &error) == 18446744073709551615ull && error == RangeError && *__error_nid_postfix() == RangeError, "_Stoullx overflow");
 }
 
+void TestDoubleHelpers() {
+    const double e = std::exp(1.0);
+    double result = 1.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == -1 && std::fabs(result - e) <= e * 1e-14, "_Exp e");
+    result = 0.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == -1 && result == 1.0, "_Exp zero exponent");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, 3.0, 0) == -1 && std::fabs(result - 3.0 * e) <= 3.0 * e * 1e-14, "_Exp multiplier");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, -2.0, 0) == -1 && std::fabs(result + 2.0 * e) <= 2.0 * e * 1e-14, "_Exp negative multiplier");
+    result = 0.0;
+    Require(_Exp_nid_postfix(&result, 5.0, 0) == -1 && result == 5.0, "_Exp multiplier at zero exponent");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 10) == -1 && std::fabs(result - e * 1024.0) <= e * 1024.0 * 1e-14, "_Exp scale");
+    for (int i = -200; i <= 200; ++i) {
+        const double x = static_cast<double>(i) / 16.0;
+        result = x;
+        Require(_Exp_nid_postfix(&result, 1.0, 0) == -1 && std::fabs(result - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-14, "_Exp finite sweep");
+    }
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, 0.0, 0) == 0 && result == 0.0, "_Exp zero multiplier");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = NAN;
+    Require(_Exp_nid_postfix(&result, 0.0, 0) == 2 && std::isnan(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp NaN zero multiplier");
+    result = NAN;
+    Require(_Exp_nid_postfix(&result, 0.0, 17) == 2 && std::isnan(result), "_Exp scaled NaN zero multiplier");
+    result = 1843.0;
+    Require(_Exp_nid_postfix(&result, 0.0, 0) == 0 && result == 0.0, "_Exp overflow exponent with zero multiplier");
+    result = INFINITY;
+    Require(_Exp_nid_postfix(&result, 0.0, -17) == 0 && result == 0.0 && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp infinite exponent with zero multiplier");
+    result = -INFINITY;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == 0 && result == 0.0, "_Exp negative infinity");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1843.0;
+    Require(_Exp_nid_postfix(&result, -1.0, 0) == 1 && std::isinf(result) && std::signbit(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_Exp overflow preserves multiplier sign");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -1843.0;
+    Require(_Exp_nid_postfix(&result, -1.0, 0) == 0 && result == 0.0 && std::signbit(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_Exp underflow preserves multiplier sign");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -1843.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == 0 && result == 0.0 && !std::signbit(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_Exp negative cutoff reports underflow");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::max(), 0) == 1 && std::isinf(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_Exp finite multiplier overflow");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::denorm_min(), 0) == -2 && std::fpclassify(result) == FP_SUBNORMAL && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_Exp subnormal result classification");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = INFINITY;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == 1 && std::isinf(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_Exp positive infinity");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = NAN;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == 2 && std::isnan(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp NaN exponent");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, NAN, 0) == 2 && std::isnan(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp NaN multiplier");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, INFINITY, 0) == 1 && std::isinf(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp infinite multiplier");
+    result = 1000.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == 1 && std::isinf(result), "_Exp overflow");
+    result = -1000.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == 0 && result == 0.0, "_Exp underflow");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, 1.0, -2000) == 0 && result == 0.0, "_Exp scaled underflow");
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 2000) == 1 && std::isinf(result), "_Exp scaled overflow");
+
+    const float ef = std::exp(1.0f);
+    float resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == -1 && std::fabs(resultf - ef) <= ef * 1e-6f, "_FExp e");
+    resultf = 0.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == -1 && resultf == 1.0f, "_FExp zero exponent");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 3.0f, 0) == -1 && std::fabs(resultf - 3.0f * ef) <= 3.0f * ef * 1e-6f, "_FExp multiplier");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, -2.0f, 0) == -1 && std::fabs(resultf + 2.0f * ef) <= 2.0f * ef * 1e-6f, "_FExp negative multiplier");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 10) == -1 && std::fabs(resultf - ef * 1024.0f) <= ef * 1024.0f * 1e-6f, "_FExp scale");
+    for (int i = -120; i <= 120; ++i) {
+        const float x = static_cast<float>(i) / 16.0f;
+        resultf = x;
+        Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == -1 && std::fabs(resultf - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-6f, "_FExp finite sweep");
+    }
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 0.0f, 0) == 0 && resultf == 0.0f, "_FExp zero multiplier");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = NAN;
+    Require(_FExp_nid_postfix(&resultf, 0.0f, 0) == 2 && std::isnan(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp NaN zero multiplier");
+    resultf = NAN;
+    Require(_FExp_nid_postfix(&resultf, 0.0f, 17) == 2 && std::isnan(resultf), "_FExp scaled NaN zero multiplier");
+    resultf = 230.0f;
+    Require(_FExp_nid_postfix(&resultf, 0.0f, 0) == 0 && resultf == 0.0f, "_FExp overflow exponent with zero multiplier");
+    resultf = INFINITY;
+    Require(_FExp_nid_postfix(&resultf, 0.0f, -17) == 0 && resultf == 0.0f && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp infinite exponent with zero multiplier");
+    resultf = -INFINITY;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 0 && resultf == 0.0f, "_FExp negative infinity");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 230.0f;
+    Require(_FExp_nid_postfix(&resultf, -1.0f, 0) == 1 && std::isinf(resultf) && std::signbit(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_FExp overflow preserves multiplier sign");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -230.0f;
+    Require(_FExp_nid_postfix(&resultf, -1.0f, 0) == 0 && resultf == 0.0f && std::signbit(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_FExp underflow preserves multiplier sign");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -230.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 0 && resultf == 0.0f && !std::signbit(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_FExp negative cutoff reports underflow");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::max(), 0) == 1 && std::isinf(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_FExp finite multiplier overflow");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::denorm_min(), 0) == -2 && std::fpclassify(resultf) == FP_SUBNORMAL && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_FExp subnormal result classification");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = INFINITY;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 1 && std::isinf(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_FExp positive infinity");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = NAN;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 2 && std::isnan(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp NaN exponent");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, NAN, 0) == 2 && std::isnan(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp NaN multiplier");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, INFINITY, 0) == 1 && std::isinf(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp infinite multiplier");
+    resultf = 100.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 1 && std::isinf(resultf), "_FExp overflow");
+    resultf = -120.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 0 && resultf == 0.0f, "_FExp underflow");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, -200) == 0 && resultf == 0.0f, "_FExp scaled underflow");
+    resultf = 1.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 200) == 1 && std::isinf(resultf), "_FExp scaled overflow");
+}
+
 void TestDispatch() {
     Require(_Sin_nid_postfix(0.5, 0) == std::sin(0.5) && _Sin_nid_postfix(0.5, 1) == std::cos(0.5) && _Sin_nid_postfix(0.5, 7) == std::cos(0.5), "_Sin");
     Require(_FSin_nid_postfix(0.5f, 0) == std::sin(0.5f) && _FSin_nid_postfix(0.5f, 2) == std::cos(0.5f), "_FSin");
@@ -171,6 +327,7 @@ void TestDispatch() {
 int main() {
     TestStod();
     TestStoll();
+    TestDoubleHelpers();
     TestFloatErrors();
     TestIntegerErrors();
     TestDispatch();
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index 2d4e0fc01d..757d256856 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -157,6 +157,7 @@
 - [std::_Throw_Cpp_error](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) follows Dinkumware `thread0.cpp` ([VC12](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/thread0.cpp), [STL](https://github.com/microsoft/STL/blob/da52dc0f/stl/src/thread0.cpp)), without console verification. Codes outside 0..6 throw `std::out_of_range`, the deleting destructor throws, and STREAMS errnos absent from FreeBSD 11.4 [`errno.h`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/sys/errno.h) (`ENODATA`, `ENOSR`, `ENOSTR`, `ETIME`) are omitted. Codes 0..6 throw a 32-byte [VC12 `system_error`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/system_error) with FreeBSD errnos (16, 22, 3, 12, 1, 11, 35), a static `generic_category` (not `_Generic_object`), and unverified 40-byte [GuestLocale::String](../../../core/libs/prx/libc/include/GuestLocale.hpp) messages from [`syserror.cpp`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/syserror.cpp)
 - [Call tracing](../../../core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp) (`--trace-imports`, `APS5_TRACE_CALLS`) is missing on macOS and records only the entry of a call, not its arguments or result. One process-wide ring keeps the last 65536 calls, so a busy thread pushes the others out; the reporting thread's own calls are listed only while they are still in that ring. Calls are counted per traced target; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and `xmm0` to `xmm7`; wider vector arguments survive only while the recording code avoids AVX, which is untested. Linux has no crash report, so it prints the trace only on `SIGABRT` (guest or host `abort()`), not on `SIGSEGV`; a caller in a module loaded after the last traced import prints without a module name, and a thread aborting while another writes the report waits for it at most 2 seconds
 - [_Dtest](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows Dinkumware double classification matching _FDtest: finite values return -1, subnormals -2, zeros 0, infinities 1, and NaNs 2.
+- [_Exp and _FExp](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libc) compute `y * exp(x) * 2^offset` following the public Dinkumware CRT contracts. The implementation classifies NaN operands first so they propagate, then applies the zero-multiplier shortcut before the exponent range checks: `y == 0` returns zero even for an infinite exponent. The multiplier sign is preserved on both range cutoffs; the negative cutoff raises underflow and returns a signed zero, and the overflow cutoff raises overflow. Scaling preserves range errors for an intermediate overflow and returns the denormal classification for a subnormal final result. The exact console results, the precedence for NaN and infinite special values, range-error thresholds, directed-rounding behavior and floating-point exception behavior are not verified.
 - [app0.zar](../../../core/libs/prx/libc/src/AppArchive.cpp) (libc) - a [ZArchive](https://github.com/Exzap/ZArchive) beside `app0/` is a read-only layer under it: a path missing from `app0/` is looked up in the archive, case-insensitively. It is not a console format; titles ship their files in a PFS image instead. Resolving an archive-only path through any call other than the archive-aware libkernel ones throws, so `fopen`, `stat`, `access`, `opendir` and the rest do not read the archive yet, and `opendir` of a directory that exists in both places, `app0/` itself included, and `fdopen` of an archived descriptor throw instead of missing its entries or reading the null device. A damaged compressed block throws instead of returning `EIO`
 - [fopen_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - returns the errno of the failed open, as C11 K.3.5.2.1 leaves the nonzero value open and Microsoft's CRT returns errno; the console's Dinkumware `fopen_s` is not verified
 - [codecvt<wchar_t,char,_Mbstatet> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc, NID `H-TDszhsYuY`) is thirteen zeroed `uintptr_t` slots matching `st_size` 104 on title `libc.prx` from PPSA26344 and on `libSceLibcInternal.sprx` (offset-to-top, typeinfo, two destructors, `_Incref`/`_Decref`, and seven conversion virtuals). Facet calls through the object fault until those methods are wired.

From 3fba241f432ae0adb222e24168989190c3cdcbdf Mon Sep 17 00:00:00 2001
From: milescoviello <kitslayer29@gmail.com>
Date: Sun, 25 Oct 2026 01:17:48 +0000
Subject: [PATCH 088/218] fix(agc): place the presentation source in host
 memory when device memory runs out

The presentation scaler allocated its source image from device-local
memory with vkAllocateMemory and threw on any failure. With the
device-local heap full (Forspoken fills it on a 12 GB card next to
the host's other GPU users), the next resize of the source failed
with VK_ERROR_OUT_OF_DEVICE_MEMORY, the presentation failed and the
title terminated. The source now picks its memory type through
DeviceMemoryType, like textures, and takes its memory from the buffer
pool's image path, which reclaims cached memory and then falls back
to host memory when device-local memory is refused; it gives the
memory back through ReleaseImageMemory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../Execution/include/PresentationScaler.hpp  |  2 +
 .../Execution/src/PresentationScaler.cpp      |  8 ++-
 .../tests/PresentationPass.cpp                | 59 +++++++++++++++++++
 3 files changed, 66 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp
index b0e88120aa..6507c50a22 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp
@@ -46,6 +46,8 @@ private:
     std::uint32_t sourceHeight = 0;
     VkImage sourceImage = VK_NULL_HANDLE;
     VkDeviceMemory sourceMemory = VK_NULL_HANDLE;
+    VkDeviceSize sourceBytes = 0;
+    std::uint32_t sourceMemoryType = 0;
     VkImage blackImage = VK_NULL_HANDLE;
     VkDeviceMemory blackMemory = VK_NULL_HANDLE;
 };
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp
index d7c88d7b7d..bc07a8d8db 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/PresentationScaler.cpp
@@ -1,5 +1,6 @@
 #include "prx/libSceAgcDriver/Execution/include/PresentationScaler.hpp"
 #include "prx/libSceAgcDriver/Execution/include/AspectFit.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/BufferPool.hpp"
 #include "prx/libSceAgcDriver/Graphics/include/Resources.hpp"
 
 namespace AgcDriver {
@@ -23,7 +24,7 @@ PresentationScaler::~PresentationScaler() {
 
 void PresentationScaler::release() noexcept {
     if (sourceImage != VK_NULL_HANDLE) context.Function<PFN_vkDestroyImage>("vkDestroyImage")(context.device, sourceImage, nullptr);
-    if (sourceMemory != VK_NULL_HANDLE) context.Function<PFN_vkFreeMemory>("vkFreeMemory")(context.device, sourceMemory, nullptr);
+    if (sourceMemory != VK_NULL_HANDLE) Graphics::ReleaseImageMemory(context, sourceMemory, sourceBytes, sourceMemoryType);
     sourceImage = VK_NULL_HANDLE;
     sourceMemory = VK_NULL_HANDLE;
     sourceWidth = 0;
@@ -50,8 +51,9 @@ void PresentationScaler::EnsureSourceImage(std::uint32_t width, std::uint32_t he
     context.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(context.device, sourceImage, &requirements);
     VkMemoryAllocateInfo allocation{VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO};
     allocation.allocationSize = requirements.size;
-    allocation.memoryTypeIndex = context.MemoryType(requirements.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
-    Graphics::Check(context.Function<PFN_vkAllocateMemory>("vkAllocateMemory")(context.device, &allocation, nullptr, &sourceMemory), "vkAllocateMemory presentation source");
+    allocation.memoryTypeIndex = context.DeviceMemoryType(requirements.memoryTypeBits, requirements.size, "presentation source");
+    sourceMemory = Graphics::AllocateImageMemory(context, allocation, requirements.memoryTypeBits, "vkAllocateMemory presentation source", &sourceMemoryType, true);
+    sourceBytes = requirements.size;
     Graphics::Check(context.Function<PFN_vkBindImageMemory>("vkBindImageMemory")(context.device, sourceImage, sourceMemory, 0), "vkBindImageMemory presentation source");
     sourceWidth = width;
     sourceHeight = height;
diff --git a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
index 11915c8575..c8aae68a7a 100644
--- a/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/PresentationPass.cpp
@@ -568,6 +568,64 @@ void residentPresentTests(const Context& context) {
     blitLetterboxMatchesClear(context);
 }
 
+PFN_vkGetDeviceProcAddr realDeviceProc = nullptr;
+PFN_vkAllocateMemory realAllocateMemory = nullptr;
+const VkPhysicalDeviceMemoryProperties* refusingMemory = nullptr;
+std::uint32_t refusedAllocations = 0;
+std::uint32_t lastAllocatedType = UINT32_MAX;
+
+VKAPI_ATTR VkResult VKAPI_CALL refuseDeviceLocalAllocation(VkDevice device, const VkMemoryAllocateInfo* info, const VkAllocationCallbacks* callbacks, VkDeviceMemory* memory) {
+    const auto heap = refusingMemory->memoryTypes[info->memoryTypeIndex].heapIndex;
+    if ((refusingMemory->memoryHeaps[heap].flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) != 0) {
+        ++refusedAllocations;
+        return VK_ERROR_OUT_OF_DEVICE_MEMORY;
+    }
+    lastAllocatedType = info->memoryTypeIndex;
+    return realAllocateMemory(device, info, callbacks, memory);
+}
+
+VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL refusingDeviceProc(VkDevice device, const char* name) {
+    if (std::strcmp(name, "vkAllocateMemory") == 0) return reinterpret_cast<PFN_vkVoidFunction>(&refuseDeviceLocalAllocation);
+    return realDeviceProc(device, name);
+}
+
+void sourceImageOutsideDeviceMemoryTests(const Context& base) {
+    VkImageCreateInfo probeInfo{VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO};
+    probeInfo.imageType = VK_IMAGE_TYPE_2D;
+    probeInfo.format = VK_FORMAT_B8G8R8A8_UNORM;
+    probeInfo.extent = {64u, 64u, 1u};
+    probeInfo.mipLevels = 1;
+    probeInfo.arrayLayers = 1;
+    probeInfo.samples = VK_SAMPLE_COUNT_1_BIT;
+    probeInfo.tiling = VK_IMAGE_TILING_OPTIMAL;
+    probeInfo.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT;
+    VkImage probe = VK_NULL_HANDLE;
+    Check(base.Function<PFN_vkCreateImage>("vkCreateImage")(base.device, &probeInfo, nullptr, &probe), "vkCreateImage probe");
+    VkMemoryRequirements requirements{};
+    base.Function<PFN_vkGetImageMemoryRequirements>("vkGetImageMemoryRequirements")(base.device, probe, &requirements);
+    base.Function<PFN_vkDestroyImage>("vkDestroyImage")(base.device, probe, nullptr);
+    if (!base.HostMemoryType(requirements.memoryTypeBits)) {
+        std::printf("presentation source in host memory: skipped, the device offers no host memory type for the image\n");
+        return;
+    }
+    auto context = base;
+    context.bufferPool.reset();
+    realDeviceProc = base.deviceProc;
+    realAllocateMemory = base.Function<PFN_vkAllocateMemory>("vkAllocateMemory");
+    refusingMemory = &context.memory;
+    refusedAllocations = 0;
+    lastAllocatedType = UINT32_MAX;
+    context.deviceProc = refusingDeviceProc;
+    {
+        PresentationScaler scaler(context, VK_FORMAT_B8G8R8A8_UNORM, VK_FORMAT_B8G8R8A8_UNORM);
+        scaler.EnsureSourceImage(64u, 64u);
+        Require(refusedAllocations != 0, "the presentation source never asked for device-local memory");
+        Require(lastAllocatedType != UINT32_MAX && (context.memory.memoryHeaps[context.memory.memoryTypes[lastAllocatedType].heapIndex].flags & VK_MEMORY_HEAP_DEVICE_LOCAL_BIT) == 0, "the presentation source was not placed in host memory when device-local memory was refused");
+        Require(scaler.SourceWidth() == 64u && scaler.SourceHeight() == 64u, "the presentation source in host memory lost its extent");
+    }
+    context.bufferPool.reset();
+}
+
 }
 
 int main() {
@@ -582,6 +640,7 @@ int main() {
             return VulkanTestSkipped;
         }
         residentPresentTests(device->GetContext());
+        sourceImageOutsideDeviceMemoryTests(device->GetContext());
         std::cout << "resident present format, presentation pass and letterbox tests passed\n";
         return 0;
     } catch (const std::exception& error) {

From eb16c4d4e0d047c241e98a6df333f42642282cdb Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Sat, 24 Oct 2026 11:20:17 +0200
Subject: [PATCH 089/218] test(tools): stop test_progress from measuring the
 checkout in its write-failure test

test_output_directory_that_cannot_be_written_is_named called progress.main
without a root, so main measured the whole checkout before reaching the
output directory the test checks: 12.8 s of the file's 14.1 s here, and
31 s on windows-latest. It now goes through run_main with
library_snapshot(), like the other progress.main tests in its class;
write_site still runs and fails on the file in place of the directory.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tools/tests/test_progress.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/tests/test_progress.py b/tools/tests/test_progress.py
index 397f8494dd..716d56ff1f 100644
--- a/tools/tests/test_progress.py
+++ b/tools/tests/test_progress.py
@@ -597,12 +597,13 @@ class ProgressTests(unittest.TestCase):
                     self.assertIn(str(path), stderr.getvalue())
 
     def test_output_directory_that_cannot_be_written_is_named(self):
+        libraries, shaders = self.library_snapshot()
         with tempfile.TemporaryDirectory() as directory:
             blocked = Path(directory) / "blocked output"
             blocked.write_text("a file, not a directory", encoding="utf-8")
             stderr = io.StringIO()
             with patch("sys.stderr", stderr), self.assertRaises(SystemExit) as raised:
-                progress.main([str(blocked)])
+                self.run_main([str(blocked)], libraries, shaders)
             self.assertEqual(raised.exception.code, 2)
             self.assertIn(str(blocked), stderr.getvalue())
             self.assertNotIn("Traceback", stderr.getvalue())

From 9b4a3b3d81efb995c5dc4ffb3968d6bd7a9c081b Mon Sep 17 00:00:00 2001
From: slopgobblercobbler <slopgobblercobbler@users.noreply.github.com>
Date: Sun, 25 Oct 2026 02:28:39 +0100
Subject: [PATCH 090/218] feat(libkernel_sys): implement scePthreadMain through
 pthread_main_np

---
 core/libs/prx/libkernel_sys/Export.Discovery.cpp |  4 ----
 core/libs/prx/libkernel_sys/ThreadQueries.cpp    |  4 ++++
 core/libs/tests/GuestKernelSysThreads.cpp        | 15 ++++++++++++---
 docs/dev/debt/libkernel.md                       |  2 +-
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index 3addcda651..71684cd2c4 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -2191,10 +2191,6 @@ int APS5_VABI scePthreadGetcpuclockid(Pthread thread, int* clockId) {
     return SceResult(pthread_getcpuclockid_nid_postfix(thread, clockId));
 }
 
-int APS5_VABI scePthreadMain(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 int APS5_VABI scePthreadMulti(void) {
     NotImplemented_nid_no_patch(__func__);
diff --git a/core/libs/prx/libkernel_sys/ThreadQueries.cpp b/core/libs/prx/libkernel_sys/ThreadQueries.cpp
index 6bdc835871..397716777c 100644
--- a/core/libs/prx/libkernel_sys/ThreadQueries.cpp
+++ b/core/libs/prx/libkernel_sys/ThreadQueries.cpp
@@ -7,4 +7,8 @@ int APS5_VABI pthread_main_np_nid_postfix() {
     return IsInitialPthread_nid_no_patch() ? 1 : 0;
 }
 
+int APS5_VABI scePthreadMain(void) {
+    return pthread_main_np_nid_postfix();
+}
+
 }
diff --git a/core/libs/tests/GuestKernelSysThreads.cpp b/core/libs/tests/GuestKernelSysThreads.cpp
index b15c2a7bb6..4134cfd6f2 100644
--- a/core/libs/tests/GuestKernelSysThreads.cpp
+++ b/core/libs/tests/GuestKernelSysThreads.cpp
@@ -69,14 +69,18 @@ int main(int argc, char** argv) {
 #ifdef __linux__
     if (test == "main_late_load") {
         int (APS5_VABI* isMain)() = nullptr;
+        int (APS5_VABI* sceIsMain)() = nullptr;
         int other = -1;
+        int sceOther = -1;
         std::thread loader([&] {
             auto* module = LoadLibraryFile(directory / "libkernel_sys.prx");
             isMain = LoadFunction<int (APS5_VABI*)()>(module, "pthread_main_np", patched);
+            sceIsMain = LoadFunction<int (APS5_VABI*)()>(module, "scePthreadMain", patched, "scePthreadMain");
             other = isMain();
+            sceOther = sceIsMain();
         });
         loader.join();
-        Require(other == 0 && isMain() == 1);
+        Require(other == 0 && isMain() == 1 && sceOther == 0 && sceIsMain() == 1);
         return 0;
     }
 #endif
@@ -86,10 +90,15 @@ int main(int argc, char** argv) {
     auto* libc = LoadLibraryFile(directory / "libc.prx");
     const auto error = LoadFunction<int* (APS5_VABI*)()>(libc, "__error", patched);
     const auto isMain = LoadFunction<int (APS5_VABI*)()>(sys, "pthread_main_np", patched);
+    const auto sceIsMain = LoadFunction<int (APS5_VABI*)()>(sys, "scePthreadMain", patched, "scePthreadMain");
     *error() = 71;
     int other = -1;
-    std::thread worker([&] { other = isMain(); });
+    int sceOther = -1;
+    std::thread worker([&] {
+        other = isMain();
+        sceOther = sceIsMain();
+    });
     worker.join();
-    Require(other == 0 && isMain() == 1 && *error() == 71);
+    Require(other == 0 && isMain() == 1 && sceOther == 0 && sceIsMain() == 1 && *error() == 71);
     return 0;
 }
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index cc17825081..dcb3e350a9 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -78,7 +78,7 @@
 - [sceKernelGetAvailableCpumask](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel) - returns the default thread affinity, 0x1FFF (CPUs 0 to 12), as KytyPS5 does. Titles pin threads within it (PPSA02664 passes 0x1FFB, Hades II PPSA36082 0x3 and 0x3F); whether CPU 13 is available to a title is not confirmed
 - [sceKernelGetCurrentCpu](../../../core/libs/prx/libkernel/System/src/Process.cpp) (libkernel) - guest affinities are not applied to host threads, so the host CPU index is mapped into the calling thread's affinity clipped to `sceKernelGetAvailableCpumask` (the available mask when they do not overlap): host CPU n reports the (n modulo the CPU count)-th CPU of that mask, so a thread pinned to one CPU reports that CPU, as a FreeBSD `cpuset` guarantees on the console. Which CPU the console reports for a thread allowed on several is not known; shadPS4 returns 0
 - [pthread_attr_setsolosched_np](../../../core/libs/prx/libkernel/Pthread/Posix/Attr.cpp) (libkernel) takes `(attr, int)` and stores the value through `scePthreadAttrSetsolosched`, returning `EINVAL` (22) for a null or uninitialized attribute like the other POSIX attribute setters. Only the name is public (aerolib `2+pVfgiEd7A`); the signature and behaviour follow the SCE twin, which [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/947627d10d4ef4b68ba3c0189aab6c368e70a8d2/src/kernel/pthread.cpp#L2188-L2199) and [sharpemu](https://github.com/sharpemu/sharpemu/blob/a2983692930564815a77f81e74c151268f5b935f/src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs#L891-L913) store as an `int` without a range check, and [PS5PCEM](https://github.com/iStark/PS5PCEM/blob/71de7681f06c5db59a1120a3bb554c86780c3f5f/src/hle/libs/kernel_threading.zig#L1396-L1398) implements this alias over it. On a PS5 (firmware 13.60) only 0 and 16 are accepted; every other value returns `ENOTSUP` (45, `0x8002002D` from the SCE call) and keeps the stored one, and the SCE calls return `EINVAL` for a null or uninitialized attribute. PPSA15878 passes 16. Threads created from the attribute are not scheduled differently; what solo scheduling does on the console is unknown. Returnal (PPSA01285 v03.000.005) stopped on it with `what(): pthread_attr_setsolosched_np_nid_postfix not implemented` (#2872, #1155); LEGO Horizon Adventures (PPSA14632, #734) and Palworld (PPSA23126, #2598) import it
-- [pthread_main_np](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel_sys) - console behaviour is unmeasured. Linux identifies the process initial thread by kernel TID/PID equality, including worker-first loading. Other hosts identify the thread that initialized libkernel; loading it first from a worker can misidentify the initial thread. The pre-initialization -1 state is not exposed.
+- [pthread_main_np and scePthreadMain](../../../core/libs/prx/libkernel/Pthread/src/Thread.cpp) (libkernel_sys) - console behaviour is unmeasured. Linux identifies the process initial thread by kernel TID/PID equality, including worker-first loading. Other hosts identify the thread that initialized libkernel; loading it first from a worker can misidentify the initial thread. The pre-initialization -1 state is not exposed.
 - [sceKernelMapFlexibleMemory / sceKernelMapNamedFlexibleMemoryInternal](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - flag 0x8000 is accepted and ignored; its meaning is not established. KytyPS5 (`GUEST_MAP_UNKNOWN_8000`) and sharpemu accept it without reading it. Every known caller is an SDK 9 `libc.prx` heap, which passes it with read/write protection and uses the mapping as an older `libc.prx` uses `sceKernelMapNamedFlexibleMemory` with flags 0: through the Internal variant in PPSA21564, through `sceKernelMapFlexibleMemory` in PPSA22520 01.000.011
 - [sceKernelMtypeprotect](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - sets the memory type of the direct mappings in the page-rounded range and of the direct memory behind them, as shadPS4 and prosper do (KytyPS5 ignores the type); the type is not validated, flexible pages in the range only get the protection, and a later map of the retyped direct memory reports the type it was allocated with. `sceKernelBatchMap2` operation 4 takes the same path with the entry type
 - [Map hints inside a reservation](../../../core/libs/prx/libkernel/DirectMemory/DirectMemory.cpp) (libkernel) - `sceKernelMapDirectMemory` and the flexible and anonymous maps place a mapping without `MAP_FIXED` at its hint address when the whole range lies in a range still reserved by `sceKernelReserveVirtualRange`, as if `MAP_FIXED` were set. Taken from PPSA01474, which reserves 64 GiB and then maps its heaps inside it with hints and no `MAP_FIXED`, and uses the hint addresses afterwards; not measured on the console. Hints outside a reservation, or over a range that is partly mapped, stay hints

From 0434746d0a77e07d2acd31d29c151841228bed28 Mon Sep 17 00:00:00 2001
From: Baytowne <30433191+Baytowne@users.noreply.github.com>
Date: Tue, 20 Oct 2026 13:24:38 -0500
Subject: [PATCH 091/218] fix(tools): fail env_reference on a source file it
 cannot read

---
 tools/env_reference.py            | 10 +++++++---
 tools/tests/test_env_reference.py | 13 +++++++++++++
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/tools/env_reference.py b/tools/env_reference.py
index 2cfe032b71..d7f80595ff 100644
--- a/tools/env_reference.py
+++ b/tools/env_reference.py
@@ -91,8 +91,8 @@ def reads(roots, prefixes=PREFIXES):
         for path in source_files(root):
             try:
                 text = path.read_text(encoding="utf-8")
-            except (OSError, UnicodeDecodeError):
-                continue
+            except (OSError, UnicodeDecodeError) as error:
+                raise ValueError(f"cannot read {path.as_posix()}: {error}") from error
             lines = text.splitlines()
             for number, line in enumerate(lines, 1):
                 window = "\n".join(lines[number - 1:number + 2])
@@ -184,7 +184,11 @@ def main(argv=None):
         if not Path(root).is_dir():
             print(f"error: scan root {root} is not a directory", file=sys.stderr)
             return 1
-    found = reads(roots, prefixes)
+    try:
+        found = reads(roots, prefixes)
+    except ValueError as error:
+        print(f"error: {error}", file=sys.stderr)
+        return 1
     if args.check:
         return check(found, args.doc, prefixes, sys.stdout)
     if args.table:
diff --git a/tools/tests/test_env_reference.py b/tools/tests/test_env_reference.py
index c19bb714c9..3b43421864 100644
--- a/tools/tests/test_env_reference.py
+++ b/tools/tests/test_env_reference.py
@@ -169,6 +169,19 @@ class EnvReferenceTests(unittest.TestCase):
         self.assertTrue([name for name in found if name.startswith("APS5_")])
         self.assertTrue([name for name in found if name.startswith("ANYPS5_")])
 
+    def test_reads_fails_on_a_source_file_it_cannot_decode(self):
+        root = self.fixture()
+        (root / "core" / "Latin.cpp").write_bytes(b'static const char* s = "caf\xe9";\n')
+        with self.assertRaises(ValueError) as raised:
+            env_reference.reads([root / "core"], BOTH)
+        self.assertIn("Latin.cpp", str(raised.exception))
+        stderr = io.StringIO()
+        with contextlib.redirect_stderr(stderr):
+            code = env_reference.main(["--check", "--doc", str(root / "missing.md"), "--root", str(root / "core")])
+        self.assertEqual(code, 1)
+        self.assertIn("cannot read", stderr.getvalue())
+        self.assertIn("Latin.cpp", stderr.getvalue())
+
     def test_check_passes_when_every_read_name_has_a_row(self):
         root = self.fixture()
         found = env_reference.reads([root / "core"])

From d58e050c8f7f1b02fb982831cce0b39d56820db5 Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 17:06:45 -0400
Subject: [PATCH 092/218] fix(libc): return the byte difference from strcoll as
 titles' libc.prx does

strcoll called the host's strcmp, which returns -1, 0 or 1 on Windows.
The libc.prx bundled with eleven titles returns, in the C locale, the
difference of the unsigned bytes at the first mismatch, as its strcmp
does; strcoll now computes that.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/Strings.cpp | 6 +++++-
 core/libs/tests/GuestStrings.cpp   | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libc/src/Strings.cpp b/core/libs/prx/libc/src/Strings.cpp
index 18d1df74bc..508da2aa04 100644
--- a/core/libs/prx/libc/src/Strings.cpp
+++ b/core/libs/prx/libc/src/Strings.cpp
@@ -487,7 +487,11 @@ size_t APS5_VABI strspn_nid_postfix(const char* s, const char* accept) {
 }
 
 int APS5_VABI strcoll_nid_postfix(const char* s1, const char* s2) {
-    return std::strcmp(s1, s2);
+    for (;; ++s1, ++s2) {
+        const int a = static_cast<unsigned char>(*s1);
+        const int b = static_cast<unsigned char>(*s2);
+        if (a != b || a == 0) return a - b;
+    }
 }
 
 int APS5_VABI strncpy_s_nid_postfix(char* dest, size_t destsz, const char* src, size_t count) {
diff --git a/core/libs/tests/GuestStrings.cpp b/core/libs/tests/GuestStrings.cpp
index 8debeb251f..257ccc7689 100644
--- a/core/libs/tests/GuestStrings.cpp
+++ b/core/libs/tests/GuestStrings.cpp
@@ -142,6 +142,8 @@ static void CheckSecureStringSizeLimits() {
 }
 
 static void CheckCaseInsensitiveComparison() {
+    Require(strcoll_nid_postfix("a", "z") == -25 && strcoll_nid_postfix("z", "a") == 25 && strcoll_nid_postfix("ab", "abc") == -99);
+    Require(strcoll_nid_postfix("A", "a") == -32 && strcoll_nid_postfix("same", "same") == 0 && strcoll_nid_postfix("\xff", "\x01") == 254);
     Require(strcasecmp_nid_postfix("", "") == 0 && strcasecmp_nid_postfix("AbC", "aBc") == 0);
     Require(strcasecmp_nid_postfix("A", "b") == -1 && strcasecmp_nid_postfix("b", "A") == 1);
     Require(strcasecmp_nid_postfix("ab", "A") == 1 && strcasecmp_nid_postfix("AB", "a") == 1);

From e87d6b222731d8eb62b66c393a2e9f096bbd6cfd Mon Sep 17 00:00:00 2001
From: wail-arch <116732676+wail-arch@users.noreply.github.com>
Date: Sun, 25 Oct 2026 04:17:49 +0000
Subject: [PATCH 093/218] refactor(libSceNotification): declare
 sceNotificationSend with the SDK's parameters

Homebrew built with the ps5-payload-dev SDK declares
sceNotificationSend(int userId, bool isLogged, const char* payload) and
its notify sample passes the system user, true and a JSON toast. Use
those parameters, which take the same registers as before, keep the
export throwing and record the call in the technical debt.
---
 core/libs/prx/libSceNotification/Export.cpp      | 8 ++++----
 core/libs/prx/libSceNotification/include/Api.hpp | 2 +-
 docs/dev/debt/libSceNotification.md              | 1 +
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libSceNotification/Export.cpp b/core/libs/prx/libSceNotification/Export.cpp
index 3431c8dbc3..8d6772d02d 100644
--- a/core/libs/prx/libSceNotification/Export.cpp
+++ b/core/libs/prx/libSceNotification/Export.cpp
@@ -5,10 +5,10 @@
 
 extern "C" {
 
-int APS5_VABI sceNotificationSend(int type, std::uint8_t flag, std::uint8_t* message) {
-    (void)type;
-    (void)flag;
-    (void)message;
+int APS5_VABI sceNotificationSend(int userId, bool logged, const char* payload) {
+    (void)userId;
+    (void)logged;
+    (void)payload;
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
diff --git a/core/libs/prx/libSceNotification/include/Api.hpp b/core/libs/prx/libSceNotification/include/Api.hpp
index 24cb956b82..7174c3528a 100644
--- a/core/libs/prx/libSceNotification/include/Api.hpp
+++ b/core/libs/prx/libSceNotification/include/Api.hpp
@@ -4,7 +4,7 @@
 
 extern "C" {
 
-int APS5_VABI sceNotificationSend(int type, std::uint8_t flag, std::uint8_t* message);
+int APS5_VABI sceNotificationSend(int userId, bool logged, const char* payload);
 int APS5_VABI sceNotificationSendById(int type, std::uint8_t flag, std::uint8_t* id, std::uint8_t* jsonData);
 int APS5_VABI sceNotificationShowPsButtonPersistentBanner(std::uint8_t* jsonParam);
 void APS5_VABI sceNotificationHidePsButtonPersistentBanner();
diff --git a/docs/dev/debt/libSceNotification.md b/docs/dev/debt/libSceNotification.md
index 981ec693f0..6245484e54 100644
--- a/docs/dev/debt/libSceNotification.md
+++ b/docs/dev/debt/libSceNotification.md
@@ -3,3 +3,4 @@
 ### Unknown function info
 
 - [sceNotificationSend, sceNotificationSendById, sceNotificationShowPsButtonPersistentBanner, sceNotificationHidePsButtonPersistentBanner](../../../core/libs/prx/libSceNotification/Export.cpp) (libSceNotification) - notification sending and banner presentation interfaces throw through `NotImplemented_nid_no_patch`. Native notification service IPC and parameter structures remain unimplemented.
+- [sceNotificationSend](../../../core/libs/prx/libSceNotification/Export.cpp) (libSceNotification) - what the console shows, checks and returns is not measured. The parameters are the ones homebrew built with the [ps5-payload-dev SDK](https://github.com/ps5-payload-dev/sdk) declares, `int sceNotificationSend(int userId, bool isLogged, const char* payload)`: its `notify` sample passes the system user (`0xFE`), `true` and a JSON document whose `rawData` names a `viewTemplateType` such as `InteractiveToastTemplateB` and holds the `viewData` to show, and exits with the result. Closes when: measured on a PS5.

From 03f382934ee948d9e3261a8b51b3330738c58883 Mon Sep 17 00:00:00 2001
From: Matheus Herberts <163153928+Mherberts@users.noreply.github.com>
Date: Sun, 25 Oct 2026 01:57:10 -0300
Subject: [PATCH 094/218] fix(relinker): align ELF64 section header tables

---
 .../src/general/SectionHeaderTableBuilder.cpp |  1 +
 .../elfpatcher/tests/SectionRangeTests.cpp    | 27 ++++++++++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp b/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
index e07068514f..ec6ea6cb35 100644
--- a/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
+++ b/core/relinker/elfpatcher/src/general/SectionHeaderTableBuilder.cpp
@@ -103,6 +103,7 @@ void SectionHeaderTableBuilder::WriteTable(
     for (const char i : kShStrTabBlob)
         buf.push_back(static_cast<std::uint8_t>(i));
 
+    Io::AlignBuffer(buf, std::size_t{8});
     const auto shOff = static_cast<std::uint64_t>(buf.size());
     buf.resize(buf.size() + kShdrEntrySize * kSectionHeaderCount, 0);
 
diff --git a/core/relinker/elfpatcher/tests/SectionRangeTests.cpp b/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
index c75c4e9773..0337f3327d 100644
--- a/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
+++ b/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
@@ -1,6 +1,7 @@
 #include <elfpatcher/general/SectionHeaderTableBuilder.hpp>
 #include <io/ByteWriter.hpp>
 #include <io/BufferUtils.hpp>
+#include <algorithm>
 #include <iostream>
 #include <limits>
 #include <stdexcept>
@@ -29,6 +30,30 @@ int main() {
         auto empty = valid; empty.StubOffset = 384; empty.StubSize = 0;
         bytes = Fixture(); builder.WriteTable(bytes, empty);
         Require(Io::ReadU64(bytes, Io::ReadU64(bytes, 40) + 5 * 64 + 16) == 0x1100);
+        for (std::size_t tail = 0; tail < 8; ++tail) {
+            bytes = Fixture();
+            bytes.resize(512 + tail, 0xa5);
+            const auto original = bytes;
+            const auto originalSize = bytes.size();
+            builder.WriteTable(bytes, valid);
+            const auto alignedTable = Io::ReadU64(bytes, 40);
+            if (alignedTable % 8 != 0)
+                throw std::runtime_error("ELF64 section header table is not 8-byte aligned");
+            const auto stringOffset = Io::ReadU64(bytes, alignedTable + 64 + 24);
+            const auto stringSize = Io::ReadU64(bytes, alignedTable + 64 + 32);
+            const auto stringEnd = stringOffset + stringSize;
+            Require(stringOffset == originalSize && stringSize != 0);
+            Require(stringEnd <= alignedTable && alignedTable - stringEnd < 8);
+            Require(bytes[stringOffset] == 0 && bytes[stringEnd - 1] == 0);
+            Require(std::equal(original.begin() + 64, original.end(), bytes.begin() + 64));
+            Require(std::all_of(bytes.begin() + stringEnd, bytes.begin() + alignedTable,
+                                [](const auto byte) { return byte == 0; }));
+            Require(bytes.size() == alignedTable + Io::ReadU16(bytes, 60) * 64);
+            Require(Io::ReadU64(bytes, alignedTable + 2 * 64 + 24) == valid.DynStrOffset);
+            Require(Io::ReadU64(bytes, alignedTable + 3 * 64 + 24) == valid.DynSymOffset);
+            Require(Io::ReadU64(bytes, alignedTable + 4 * 64 + 24) == valid.DynamicSegmentOffset);
+            Require(Io::ReadU64(bytes, alignedTable + 5 * 64 + 24) == valid.StubOffset);
+        }
         for (int kind = 0; kind < 11; ++kind) {
             bytes = Fixture(); auto request = valid;
             switch (kind) {
@@ -49,6 +74,6 @@ int main() {
             try { builder.WriteTable(bytes, request); } catch (const std::runtime_error&) { rejected = true; }
             Require(rejected && bytes == before);
         }
-        std::cout << "13 section range cases passed\n";
+        std::cout << "21 section range and alignment cases passed\n";
     } catch (const std::exception& error) { std::cerr << error.what() << '\n'; return 1; }
 }

From 51ac6f679bcdf8711995d5e31f935cf48b1e2891 Mon Sep 17 00:00:00 2001
From: hakarrr <zorot6161@gmail.com>
Date: Sun, 25 Oct 2026 11:37:16 +0530
Subject: [PATCH 095/218] test(relinker): compile the executable-exports probe
 on glibc before 2.36

---
 core/relinker/relinker/tests/test_linux_executable_exports.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/relinker/relinker/tests/test_linux_executable_exports.py b/core/relinker/relinker/tests/test_linux_executable_exports.py
index bc27b67838..d8cf1b8852 100644
--- a/core/relinker/relinker/tests/test_linux_executable_exports.py
+++ b/core/relinker/relinker/tests/test_linux_executable_exports.py
@@ -16,7 +16,7 @@ def main():
         work = Path(directory)
         probe = work / "probe.c"
         probe.write_text(
-            "#include <dlfcn.h>\n"
+            "#define _GNU_SOURCE\n#include <dlfcn.h>\n"
             "#include <unistd.h>\n"
             "void check(void) {\n"
             "    int (*function)(void) = dlsym(RTLD_DEFAULT, \"FixtureExport\");\n"

From e5a5b9382e0941448080b6fb7a954118b83c4ed2 Mon Sep 17 00:00:00 2001
From: atharvjairath <54663702+atharvjairath@users.noreply.github.com>
Date: Sat, 24 Oct 2026 01:32:42 +0530
Subject: [PATCH 096/218] feat(vdecsw): implement generic single-picture
 metadata queries

---
 core/libs/prx/libSceVdecsw/Export.cpp |  34 +++++--
 core/libs/tests/GuestVdecsw.cpp       | 122 +++++++++++++++++++++++---
 docs/dev/debt/libSceVdecsw.md         |   2 +
 3 files changed, 142 insertions(+), 16 deletions(-)

diff --git a/core/libs/prx/libSceVdecsw/Export.cpp b/core/libs/prx/libSceVdecsw/Export.cpp
index b39ea9bc46..d15ec5c2fa 100644
--- a/core/libs/prx/libSceVdecsw/Export.cpp
+++ b/core/libs/prx/libSceVdecsw/Export.cpp
@@ -345,11 +345,35 @@ int APS5_VABI sceVdecswSyncDecodeOutput(std::uint64_t handle, OutputInfo* output
 }
 
 int APS5_VABI sceVdecswGetPictureInfo(const OutputInfo* output, void* first, void* second) {
-    (void)output;
-    (void)first;
-    (void)second;
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+    static_cast<void>(second);
+    if (output == nullptr || (output->thisSize | 8u) != sizeof(OutputInfo)) throw std::runtime_error("Vdecsw: invalid output info");
+    if (output->pictureCount == 0) return 0;
+    if (output->pictureCount > 1) NotImplemented_nid_no_patch(__func__);
+    if (first == nullptr) return 0;
+    std::uint64_t size;
+    std::memcpy(&size, first, sizeof(size));
+    if (size < sizeof(size)) throw std::runtime_error("Vdecsw: picture info is smaller than its size field");
+    const auto copy = [first, size](const auto& source) {
+        const auto bytes = std::min<std::uint64_t>(size, sizeof(source)) - sizeof(size);
+        std::memcpy(static_cast<std::uint8_t*>(first) + sizeof(size), reinterpret_cast<const std::uint8_t*>(&source) + sizeof(size), bytes);
+    };
+    std::vector<std::shared_ptr<Decoder>> all;
+    {
+        std::lock_guard lock(decodersMutex);
+        for (const auto& [handle, decoder] : decoders) all.push_back(decoder);
+    }
+    for (const auto& decoder : all) {
+        std::lock_guard lock(decoder->mutex);
+        if (const auto found = decoder->delivered.find(output->frameBuffer); found != decoder->delivered.end()) {
+            std::visit(copy, found->second);
+            return 0;
+        }
+        if (const auto found = decoder->deliveredVp9.find(output->frameBuffer); found != decoder->deliveredVp9.end()) {
+            copy(found->second);
+            return 0;
+        }
+    }
+    throw std::runtime_error("Vdecsw: picture info requested for a frame buffer no decoder returned");
 }
 
 int APS5_VABI sceVdecswGetAvcPictureInfo(const OutputInfo* output, AvcPictureInfo* first, AvcPictureInfo* second) {
diff --git a/core/libs/tests/GuestVdecsw.cpp b/core/libs/tests/GuestVdecsw.cpp
index d30d2421aa..031c1985dc 100644
--- a/core/libs/tests/GuestVdecsw.cpp
+++ b/core/libs/tests/GuestVdecsw.cpp
@@ -1,9 +1,11 @@
-#include "prx/libSceVdecsw/include/Api.hpp"
+#include "prx/libSceVdecsw/libSceVdecsw.hpp"
+#include <algorithm>
 #include <array>
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
+#include <limits>
 #include <stdexcept>
 #include <string>
 #include <vector>
@@ -60,6 +62,105 @@ struct Session {
     }
 };
 
+template <typename TAction>
+bool throws(TAction action) {
+    try {
+        action();
+    } catch (const std::exception&) {
+        return true;
+    }
+    return false;
+}
+
+template <typename TInfo>
+void checkGenericPictureInfo(const OutputInfo& output, const TInfo& typed) {
+    const std::array<std::uint64_t, 7> sizes{8, 9, 0x28, sizeof(TInfo) - 1, sizeof(TInfo), sizeof(TInfo) + 16, std::numeric_limits<std::uint64_t>::max()};
+    for (const auto size : sizes) {
+        std::array<std::uint8_t, sizeof(TInfo) + 32> storage;
+        storage.fill(0xcc);
+        std::memcpy(storage.data() + 1, &size, sizeof(size));
+        auto expected = storage;
+        const auto copied = std::min<std::uint64_t>(size, sizeof(TInfo)) - sizeof(size);
+        std::memcpy(expected.data() + 1 + sizeof(size), reinterpret_cast<const std::uint8_t*>(&typed) + sizeof(size), copied);
+        auto second = storage;
+        const auto secondBefore = second;
+        check(sceVdecswGetPictureInfo(&output, storage.data() + 1, second.data()) == 0, "generic picture info query failed");
+        check(storage == expected && second == secondBefore, "generic picture info bytes, size or guards differ");
+    }
+    for (std::uint64_t size = 0; size < sizeof(size); ++size) {
+        auto tooSmall = typed;
+        tooSmall.thisSize = size;
+        const auto before = tooSmall;
+        check(throws([&] { sceVdecswGetPictureInfo(&output, &tooSmall, nullptr); }), "generic picture info accepted an undersized size field");
+        check(std::memcmp(&tooSmall, &before, sizeof(tooSmall)) == 0, "an invalid generic query changed its output");
+    }
+    auto second = typed;
+    const auto secondBefore = second;
+    check(sceVdecswGetPictureInfo(&output, nullptr, &second) == 0, "generic picture info rejected a null first output");
+    check(std::memcmp(&second, &secondBefore, sizeof(second)) == 0, "generic picture info wrote a nonexistent second picture");
+    auto shorter = output;
+    shorter.thisSize = sizeof(OutputInfo) - 8;
+    auto actual = typed;
+    check(sceVdecswGetPictureInfo(&shorter, &actual, nullptr) == 0 && std::memcmp(&actual, &typed, sizeof(actual)) == 0, "generic picture info rejected the shorter output descriptor");
+}
+
+void testGenericPictureInfoValidation() {
+    OutputInfo output{sizeof(OutputInfo)};
+    std::array<std::uint64_t, 8> first;
+    first.fill(0xccccccccccccccccull);
+    const auto before = first;
+    auto second = first;
+    check(throws([&] { sceVdecswGetPictureInfo(nullptr, first.data(), second.data()); }), "generic picture info accepted a null output descriptor");
+    check(first == before && second == before, "a null descriptor changed picture info");
+    check(sceVdecswGetPictureInfo(&output, first.data(), second.data()) == 0 && first == before && second == before, "an empty output changed picture info");
+    check(sceVdecswGetPictureInfo(&output, nullptr, nullptr) == 0, "an empty output required picture-info pointers");
+    for (const auto size : {0ull, 0x28ull, 0x31ull, 0x40ull, 0x100000038ull}) {
+        output.thisSize = size;
+        check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), second.data()); }) && first == before && second == before, "generic picture info accepted an invalid descriptor size");
+    }
+    output.thisSize = sizeof(OutputInfo);
+    output.pictureCount = 2;
+    first[0] = sizeof(first);
+    const auto firstBefore = first;
+    check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), second.data()); }) && first == firstBefore && second == before, "two-picture output did not throw before writing");
+    check(throws([&] { sceVdecswGetPictureInfo(&output, nullptr, nullptr); }), "two-picture output was silently accepted");
+    output.pictureCount = 1;
+    output.frameBuffer = first.data();
+    check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), nullptr); }) && first == firstBefore, "generic picture info accepted a foreign frame buffer");
+    output.frameBuffer = nullptr;
+    check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), nullptr); }) && first == firstBefore, "generic picture info accepted a null frame buffer");
+}
+
+void testGenericPictureInfoLifetime() {
+    OutputInfo output{sizeof(OutputInfo)};
+    std::vector<std::uint8_t> buffer;
+    {
+        Session session;
+        buffer.resize(session.memory.maxFrameBufferSize);
+        const auto units = accessUnits(false);
+        for (std::uint64_t iteration = 0; iteration < 2; ++iteration) {
+            const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000 + iteration, iteration, 0xa0 + iteration};
+            check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "generic lifetime input failed");
+            InputResult consumed{sizeof(InputResult)};
+            check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "generic lifetime input was not consumed");
+            const FrameBuffer frame{sizeof(FrameBuffer), buffer.data(), buffer.size()};
+            check(sceVdecswSetDecodeOutput(session.decoder, &frame) == 0, "generic lifetime buffer failed");
+            check(sceVdecswFinalizeDecodeSequence(session.decoder) == 0, "generic lifetime finalize failed");
+            check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid, "generic lifetime picture missing");
+            AvcPictureInfo info{sizeof(AvcPictureInfo)};
+            check(sceVdecswGetPictureInfo(&output, &info, nullptr) == 0 && info.ptsData == input.ptsData && info.dtsData == iteration && info.attachedData == input.attachedData, "generic picture info retained stale timestamps");
+            if (iteration == 0) {
+                check(sceVdecswResetDecoder(session.decoder) == 0, "generic lifetime reset failed");
+                const auto before = info;
+                check(throws([&] { sceVdecswGetPictureInfo(&output, &info, nullptr); }) && std::memcmp(&info, &before, sizeof(info)) == 0, "generic AVC picture info survived a decoder reset");
+            }
+        }
+    }
+    AvcPictureInfo info{sizeof(AvcPictureInfo)};
+    const auto before = info;
+    check(throws([&] { sceVdecswGetPictureInfo(&output, &info, nullptr); }) && std::memcmp(&info, &before, sizeof(info)) == 0, "generic picture info survived decoder destruction");
+}
+
 void testDecode() {
     Session session;
     const auto units = accessUnits(false);
@@ -92,6 +193,7 @@ void testDecode() {
             check(!output.isErrorFrame && !output.isDiscardedFrame && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == CodedHeight && output.frameBuffer == buffers[pictures % 2].data(), "unexpected picture geometry");
             AvcPictureInfo info{sizeof(AvcPictureInfo)};
             check(sceVdecswGetAvcPictureInfo(&output, &info, nullptr) == 0 && info.isValid, "picture info missing");
+            checkGenericPictureInfo(output, info);
             const auto unit = DisplayOrderUnits[pictures];
             check(info.ptsData == 1000 + unit && info.dtsData == unit && info.attachedData == 0xa0 + unit && info.idrPictureFlag == (pictures == 0 ? 1 : 0) && info.profileIdc == 100, "pictures out of display order");
             check(info.picWidthInMbsMinus1 == Width / 16 - 1 && info.picHeightInMapUnitsMinus1 == CodedHeight / 16 - 1 && info.frameMbsOnlyFlag == 1 && info.frameCroppingFlag == 1 && info.frameCropLeftOffset == 0 && info.frameCropRightOffset == 0 && info.frameCropTopOffset == 0 && info.frameCropBottomOffset == (CodedHeight - Height) / 2, "picture geometry in the picture info is wrong");
@@ -138,6 +240,7 @@ void testHevc() {
             check(pictures < HevcHashes.size() && output.codecType == CodecHevc && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == Height, "unexpected HEVC picture geometry");
             HevcPictureInfo info{sizeof(HevcPictureInfo)};
             check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "HEVC picture info missing");
+            checkGenericPictureInfo(output, info);
             const auto unit = HevcDisplayOrderUnits[pictures];
             check(info.ptsData == 1000 + unit && info.dtsData == unit && info.attachedData == 0xa0 + unit, "HEVC pictures out of display order");
             check(info.idrPictureFlag == (pictures == 0 ? 1 : 0) && info.irapPictureFlag == (pictures == 0 ? 1 : 0), "HEVC random access flags differ");
@@ -182,6 +285,7 @@ void testHevcCrop() {
     check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid && output.frameWidth == 64 && output.frameHeight == 40, "unexpected cropped HEVC picture geometry");
     HevcPictureInfo info{sizeof(HevcPictureInfo)};
     check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "cropped HEVC picture info missing");
+    checkGenericPictureInfo(output, info);
     check(info.picWidthInLumaSamples == 64 && info.picHeightInLumaSamples == 40, "cropped HEVC coded size differs");
     check(info.conformanceWindowFlag == 1 && info.confWinLeftOffset == 0 && info.confWinRightOffset == 0 && info.confWinTopOffset == 0 && info.confWinBottomOffset == 2, "HEVC conformance window differs");
     check(info.frameCroppingFlag == 1 && info.frameCropLeftOffset == 0 && info.frameCropRightOffset == 0 && info.frameCropTopOffset == 0 && info.frameCropBottomOffset == 2, "HEVC frame cropping differs");
@@ -253,16 +357,6 @@ struct Vp9Session {
     }
 };
 
-template <typename TAction>
-bool throws(TAction action) {
-    try {
-        action();
-    } catch (const std::exception&) {
-        return true;
-    }
-    return false;
-}
-
 SceVideodec2::Vp9PictureInfo sentinelVp9Info(std::uint64_t size = sizeof(SceVideodec2::Vp9PictureInfo)) {
     SceVideodec2::Vp9PictureInfo info;
     std::memset(&info, 0xcc, sizeof(info));
@@ -314,6 +408,7 @@ void testVp9PictureInfo() {
             check(output.codecType == CodecVp9 && output.pictureCount == 1 && output.frameWidth == Width && output.frameHeight == Height && output.frameBuffer == target.data(), "unexpected VP9 picture geometry");
             auto info = sentinelVp9Info();
             check(sceVdecswGetVp9PictureInfo(&output, &info) == 0, "VP9 picture info query failed");
+            checkGenericPictureInfo(output, info);
             checkVp9Info(info, pictures);
             check(hashNv12(target.data(), output.framePitch, output.frameHeight) == Vp9Hashes[pictures], "VP9 picture " + std::to_string(pictures) + " differs from the reference");
             outputs[pictures] = output;
@@ -335,6 +430,7 @@ void testVp9PictureInfo() {
         auto info = sentinelVp9Info();
         check(sceVdecswGetVp9PictureInfo(&outputs[picture], &info) == 0, "VP9 picture info of an earlier picture was lost");
         checkVp9Info(info, picture);
+        checkGenericPictureInfo(outputs[picture], info);
     }
 
     const auto unchanged = sentinelVp9Info();
@@ -380,6 +476,7 @@ void testVp9PictureInfo() {
 
     check(sceVdecswResetDecoder(session.decoder) == 0, "VP9 reset failed");
     check(throws([&] { sceVdecswGetVp9PictureInfo(&outputs[0], &info); }) && sameBytes(info, unchanged), "VP9 picture info survived a decoder reset");
+    check(throws([&] { sceVdecswGetPictureInfo(&outputs[0], &info, nullptr); }) && sameBytes(info, unchanged), "generic picture info survived a decoder reset");
 }
 
 void testVp9PictureInfoOfAvcPicture() {
@@ -416,11 +513,14 @@ void testHevcMain10() {
     check(sceVdecswSyncDecodeOutput(session.decoder, &output) == 0 && output.isValid, "the Main 10 HEVC picture was not output");
     HevcPictureInfo info{sizeof(HevcPictureInfo)};
     check(sceVdecswGetHevcPictureInfo(&output, &info) == 0 && info.isValid, "Main 10 HEVC picture info missing");
+    checkGenericPictureInfo(output, info);
     check(info.generalProfileIdc == 2 && info.bitDepthLumaMinus8 == 2 && info.bitDepthChromaMinus8 == 2, "Main 10 HEVC profile or bit depth differs");
 }
 
 int main() {
     try {
+        testGenericPictureInfoValidation();
+        testGenericPictureInfoLifetime();
         testDecode();
         testHevc();
         testHevcCrop();
diff --git a/docs/dev/debt/libSceVdecsw.md b/docs/dev/debt/libSceVdecsw.md
index 4818e0bfea..ca1399ba19 100644
--- a/docs/dev/debt/libSceVdecsw.md
+++ b/docs/dev/debt/libSceVdecsw.md
@@ -5,3 +5,5 @@
 - [libSceVdecsw](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - structure layouts follow shadPS4's `vdecsw.h` and were checked against PPSA05684's movie decoder (`movie-decoder-vdecsw.cpp`), which asserts `pictureCount == 1` at offset 0xb of `OutputInfo` and reads `InputResult` offset 0x10 as the number of frames an access unit produced. The compute, decoder memory and decode input structures and the first 0x28 bytes of the 0x50-byte decoder config are those of libSceVideodec2, and decoding goes through it. The 0x78-byte AVC picture info is filled with Videodec2's leading fields and the cropping fields only. OUTPUT_PENDING (0x81510115), INPUT_QUEUE_EMPTY (0x81510116) and DECODE_PENDING (0x81510117) follow from the codes each call's assert accepts. At most four decoded pictures are queued and the last one is held until `sceVdecswFinalizeDecodeSequence`; the console's queue depth is unknown. `sceVdecswSyncDecodeInput` / `sceVdecswSyncDecodeOutput` retry the TrySync variants until they stop returning DECODE_PENDING / OUTPUT_PENDING; they do not sleep beyond a yield, so another thread must drain outputs when the picture queue is full. The 0xb8-byte HEVC picture info (shadPS4's `vdecsw.h`) carries only the timestamps, coded size, bit depth, IDR and IRAP flags, profile, level and conformance window (in chroma samples, repeated in the frame cropping fields, whose console unit is unknown)
 
 - [sceVdecswGetVp9PictureInfo](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - no console behaviour is recorded; the signature and 0x58-byte layout come from [SharpProspero's Vdecsw.cs](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Video/Vdecsw.cs#L892-L952), and shadPS4 has no VP9 getter. It copies the leading `thisSize - 8` bytes of the picture's info, as [shadPS4's `sceVdecswGetPictureInfo`](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/videodec/vdecsw.cpp#L303-L334) does for AVC and HEVC, from Videodec2's VP9 info (`level` is 0 there). An output with no picture returns 0 and writes nothing. Null pointers, `thisSize` below 8, two pictures and a frame buffer no VP9 decoder returned (an H.264 picture too) throw; console error codes are unknown. VP9 decoding goes through Videodec2 and rejects pictures deeper than 10 bits
+
+- [sceVdecswGetPictureInfo](../../../core/libs/prx/libSceVdecsw/Export.cpp) (libSceVdecsw) - console behaviour and errors are unmeasured. The signature, 0x30/0x38 output descriptor sizes, optional first output, unchanged size field and empty-picture handling follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/15abf68c9b52c4b04d094f2837719fdb871021f3/src/core/libraries/videodec/vdecsw.cpp#L303-L334). Metadata comes from the existing AVC, HEVC or VP9 delivered-frame records, not the guest frame-buffer tail; copying is capped at the known record size, as in the typed getters. Invalid descriptor pointers/sizes, result sizes below 8 and unknown frame buffers throw instead of returning unverified console error codes. Two-picture field output remains unimplemented and throws before writing; the second output is untouched for zero or one picture. Metadata completeness and decoder limitations above still apply.

From df9977e15e467caee957a7c4ffbddfc71e63f8e7 Mon Sep 17 00:00:00 2001
From: atharvjairath <54663702+atharvjairath@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:48:12 +0530
Subject: [PATCH 097/218] test(vdecsw): avoid pinning unsupported field output
 behavior

---
 core/libs/tests/GuestVdecsw.cpp | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/core/libs/tests/GuestVdecsw.cpp b/core/libs/tests/GuestVdecsw.cpp
index 031c1985dc..0990141df2 100644
--- a/core/libs/tests/GuestVdecsw.cpp
+++ b/core/libs/tests/GuestVdecsw.cpp
@@ -119,11 +119,8 @@ void testGenericPictureInfoValidation() {
         check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), second.data()); }) && first == before && second == before, "generic picture info accepted an invalid descriptor size");
     }
     output.thisSize = sizeof(OutputInfo);
-    output.pictureCount = 2;
     first[0] = sizeof(first);
     const auto firstBefore = first;
-    check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), second.data()); }) && first == firstBefore && second == before, "two-picture output did not throw before writing");
-    check(throws([&] { sceVdecswGetPictureInfo(&output, nullptr, nullptr); }), "two-picture output was silently accepted");
     output.pictureCount = 1;
     output.frameBuffer = first.data();
     check(throws([&] { sceVdecswGetPictureInfo(&output, first.data(), nullptr); }) && first == firstBefore, "generic picture info accepted a foreign frame buffer");
@@ -139,7 +136,7 @@ void testGenericPictureInfoLifetime() {
         buffer.resize(session.memory.maxFrameBufferSize);
         const auto units = accessUnits(false);
         for (std::uint64_t iteration = 0; iteration < 2; ++iteration) {
-            const InputData input{sizeof(InputData), units[0].data(), units[0].size(), 1000 + iteration, iteration, 0xa0 + iteration};
+            const SceVideodec2::InputData input{sizeof(SceVideodec2::InputData), units[0].data(), units[0].size(), 1000 + iteration, iteration, 0xa0 + iteration};
             check(sceVdecswSetDecodeInput(session.decoder, &input) == 0, "generic lifetime input failed");
             InputResult consumed{sizeof(InputResult)};
             check(sceVdecswSyncDecodeInput(session.decoder, &consumed) == 0, "generic lifetime input was not consumed");

From 38a570af49123ae68a79759bc781af3accecbf09 Mon Sep 17 00:00:00 2001
From: krishalivaibhav <krishalivaibhav@gmail.com>
Date: Sun, 25 Oct 2026 12:58:20 +0530
Subject: [PATCH 098/218] test(macos): keep the pseudo-denormal out of
 compile-time folding

Clang folds the constant built by Extended into a normal long double, so
guest_math_exact never fed a pseudo-denormal to __fpclassifyl on macOS.
Keeping the helper out of line makes the value cross the call at run time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/tests/GuestMathExact.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestMathExact.cpp b/core/libs/tests/GuestMathExact.cpp
index db7361070f..5db64f610d 100644
--- a/core/libs/tests/GuestMathExact.cpp
+++ b/core/libs/tests/GuestMathExact.cpp
@@ -10,7 +10,7 @@
 
 static void Require(bool value) { if (!value) std::abort(); }
 
-static long double Extended(std::uint16_t signExponent, std::uint64_t mantissa) {
+[[gnu::noinline]] static long double Extended(std::uint16_t signExponent, std::uint64_t mantissa) {
     long double value = 0;
     unsigned char bytes[sizeof(long double)] = {};
     std::memcpy(bytes, &mantissa, sizeof(mantissa));

From 1cb7e2e3e08a2a19617baf7dddfe3361f3c13068 Mon Sep 17 00:00:00 2001
From: louise-patra <rocklouis055@gmail.com>
Date: Sat, 24 Oct 2026 19:42:23 +0530
Subject: [PATCH 099/218] feat(libSceNpUtility): implement lookup async
 requests, waits and timeouts

Adds sceNpLookupAbortRequest, sceNpLookupCreateAsyncRequest,
sceNpLookupPollAsync, sceNpLookupWaitAsync, sceNpLookupSetTimeout,
sceNpWordFilterSetTimeout and sceNpWordFilterWaitAsync on the offline
request model. Waits block on a condition variable that request
completion, abort and deletion signal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceNpUtility/Export.cpp      | 137 ++++++++++++------
 core/libs/prx/libSceNpUtility/include/Api.hpp |  14 +-
 core/libs/tests/GuestNpUtilityOffline.cpp     |  87 +++++++++++
 docs/dev/debt/libSceNpUtility.md              |  10 +-
 4 files changed, 190 insertions(+), 58 deletions(-)

diff --git a/core/libs/prx/libSceNpUtility/Export.cpp b/core/libs/prx/libSceNpUtility/Export.cpp
index 7f5e3bbf94..bd009d549a 100644
--- a/core/libs/prx/libSceNpUtility/Export.cpp
+++ b/core/libs/prx/libSceNpUtility/Export.cpp
@@ -1,6 +1,7 @@
 #include "prx/libSceNpUtility/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <condition_variable>
 #include <cstring>
 #include <mutex>
 #include <unordered_map>
@@ -23,7 +24,9 @@ static constexpr std::size_t MAX_REQUESTS = 32;
 static constexpr int WORD_FILTER_TITLE_CTX_ID_OFFSET = 0x01000000;
 static constexpr int WORD_FILTER_REQUEST_ID_OFFSET = 0x02000000;
 static constexpr std::size_t WORD_FILTER_COMMENT_MAX_LENGTH = 0x400;
-static constexpr std::uint64_t WORD_FILTER_ASYNC_PARAMETER_SIZE = 0x18;
+static constexpr std::uint64_t ASYNC_REQUEST_PARAMETER_SIZE = 0x18;
+static constexpr std::uint32_t RESOLVE_TIMEOUT_MIN = 1000000;
+static constexpr std::uint32_t TRANSFER_TIMEOUT_MIN = 10000000;
 
 namespace {
 struct Request {
@@ -38,6 +41,7 @@ struct Request {
 struct Service {
     Service(int firstTitleContext, int firstRequest) : nextTitleContext(firstTitleContext), nextRequest(firstRequest) {}
     std::mutex mutex;
+    std::condition_variable finished;
     std::unordered_set<int> titleContexts;
     std::unordered_map<int, Request> requests;
     int nextTitleContext;
@@ -60,6 +64,7 @@ int DeleteTitleContext(Service& service, int titleCtxId) {
     std::lock_guard lock(service.mutex);
     if (!service.titleContexts.erase(titleCtxId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
     std::erase_if(service.requests, [titleCtxId](const auto& entry) { return entry.second.titleCtxId == titleCtxId; });
+    service.finished.notify_all();
     return 0;
 }
 
@@ -74,7 +79,9 @@ int CreateRequest(Service& service, int titleCtxId, bool async) {
 
 int DeleteRequest(Service& service, int reqId) {
     std::lock_guard lock(service.mutex);
-    return service.requests.erase(reqId) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!service.requests.erase(reqId)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    service.finished.notify_all();
+    return 0;
 }
 
 int StartOffline(Service& service, int reqId) {
@@ -86,9 +93,58 @@ int StartOffline(Service& service, int reqId) {
     request->second.used = true;
     request->second.finished = true;
     request->second.result = SCE_NP_ERROR_SIGNED_OUT;
+    service.finished.notify_all();
     return request->second.async ? 0 : SCE_NP_ERROR_SIGNED_OUT;
 }
 
+int AbortRequest(Service& service, int reqId) {
+    std::lock_guard lock(service.mutex);
+    const auto request = service.requests.find(reqId);
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    request->second.aborted = true;
+    if (!request->second.finished) {
+        request->second.finished = true;
+        request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
+        service.finished.notify_all();
+    }
+    return 0;
+}
+
+int PollAsync(Service& service, int reqId, int* result, bool asyncOnly) {
+    std::lock_guard lock(service.mutex);
+    const auto request = service.requests.find(reqId);
+    if (request == service.requests.end() || (asyncOnly && !request->second.async)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.finished) return POLL_RUNNING;
+    if (result) *result = request->second.result;
+    return POLL_FINISHED;
+}
+
+int WaitAsync(Service& service, int reqId, int* result, bool asyncOnly) {
+    std::unique_lock lock(service.mutex);
+    auto request = service.requests.find(reqId);
+    if (request == service.requests.end() || (asyncOnly && !request->second.async)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    service.finished.wait(lock, [&] {
+        request = service.requests.find(reqId);
+        return request == service.requests.end() || request->second.finished;
+    });
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (result) *result = request->second.result;
+    return 0;
+}
+
+bool ValidTimeout(std::uint32_t timeout, std::uint32_t minimum) {
+    return timeout == 0 || timeout >= minimum;
+}
+
+int SetTimeout(Service& service, int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
+    if (resolveRetry < 0 || !ValidTimeout(resolveTimeout, RESOLVE_TIMEOUT_MIN) || !ValidTimeout(connTimeout, TRANSFER_TIMEOUT_MIN) ||
+        !ValidTimeout(sendTimeout, TRANSFER_TIMEOUT_MIN) || !ValidTimeout(recvTimeout, TRANSFER_TIMEOUT_MIN))
+        return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (resolveRetry == 0 && resolveTimeout == 0 && connTimeout == 0 && sendTimeout == 0 && recvTimeout == 0) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(service.mutex);
+    return service.titleContexts.contains(id) || service.requests.contains(id) ? 0 : SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+}
+
 int CheckComment(const char* comment) {
     return strnlen(comment, WORD_FILTER_COMMENT_MAX_LENGTH + 1) > WORD_FILTER_COMMENT_MAX_LENGTH ? SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT : 0;
 }
@@ -237,14 +293,6 @@ int APS5_VABI sceNpBandwidthTestShutdownWithDetailedInfo() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceNpLookupAbortRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpLookupCreateAsyncRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 int APS5_VABI sceNpLookupCreateTitleCtxA() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -313,18 +361,6 @@ int APS5_VABI sceNpLookupNetTerm() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceNpLookupPollAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpLookupSetTimeout() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpLookupWaitAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 int APS5_VABI sceNpServiceChecker2IntAbortRequest() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -421,14 +457,6 @@ int APS5_VABI sceNpWordFilterCreateTitleCtxA() {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
-int APS5_VABI sceNpWordFilterSetTimeout() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-int APS5_VABI sceNpWordFilterWaitAsync() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 }
 
 extern "C" {
@@ -438,6 +466,15 @@ int APS5_VABI sceNpBandwidthTestInitStart() {
     return 0;
 }
 
+int APS5_VABI sceNpLookupAbortRequest(int reqId) {
+    return AbortRequest(lookup, reqId);
+}
+
+int APS5_VABI sceNpLookupCreateAsyncRequest(int titleCtxId, const std::uint64_t* param) {
+    if (!param || *param != ASYNC_REQUEST_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return CreateRequest(lookup, titleCtxId, true);
+}
+
 int APS5_VABI sceNpLookupCreateRequest(int titleCtxId) {
     return CreateRequest(lookup, titleCtxId, false);
 }
@@ -460,16 +497,20 @@ int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId,
     return StartOffline(lookup, reqId);
 }
 
+int APS5_VABI sceNpLookupPollAsync(int reqId, int* result) {
+    return PollAsync(lookup, reqId, result, false);
+}
+
+int APS5_VABI sceNpLookupSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
+    return SetTimeout(lookup, id, resolveRetry, resolveTimeout, connTimeout, sendTimeout, recvTimeout);
+}
+
+int APS5_VABI sceNpLookupWaitAsync(int reqId, int* result) {
+    return WaitAsync(lookup, reqId, result, false);
+}
+
 int APS5_VABI sceNpWordFilterAbortRequest(int reqId) {
-    std::lock_guard lock(wordFilter.mutex);
-    const auto request = wordFilter.requests.find(reqId);
-    if (request == wordFilter.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
-    request->second.aborted = true;
-    if (!request->second.finished) {
-        request->second.finished = true;
-        request->second.result = SCE_NP_COMMUNITY_ERROR_ABORTED;
-    }
-    return 0;
+    return AbortRequest(wordFilter, reqId);
 }
 
 int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void* option) {
@@ -480,7 +521,7 @@ int APS5_VABI sceNpWordFilterCensorComment(int reqId, const char* comment, void*
 }
 
 int APS5_VABI sceNpWordFilterCreateAsyncRequest(int titleCtxId, const std::uint64_t* param) {
-    if (!param || *param != WORD_FILTER_ASYNC_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    if (!param || *param != ASYNC_REQUEST_PARAMETER_SIZE) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
     return CreateRequest(wordFilter, titleCtxId, true);
 }
 
@@ -502,12 +543,7 @@ int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId) {
 
 int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result) {
     if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
-    std::lock_guard lock(wordFilter.mutex);
-    const auto request = wordFilter.requests.find(reqId);
-    if (request == wordFilter.requests.end() || !request->second.async) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
-    if (!request->second.finished) return POLL_RUNNING;
-    *result = request->second.result;
-    return POLL_FINISHED;
+    return PollAsync(wordFilter, reqId, result, true);
 }
 
 int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option) {
@@ -517,4 +553,13 @@ int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, cha
     return StartOffline(wordFilter, reqId);
 }
 
+int APS5_VABI sceNpWordFilterSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
+    return SetTimeout(wordFilter, id, resolveRetry, resolveTimeout, connTimeout, sendTimeout, recvTimeout);
+}
+
+int APS5_VABI sceNpWordFilterWaitAsync(int reqId, int* result) {
+    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
+    return WaitAsync(wordFilter, reqId, result, true);
+}
+
 }
diff --git a/core/libs/prx/libSceNpUtility/include/Api.hpp b/core/libs/prx/libSceNpUtility/include/Api.hpp
index 73d099655b..0fe054556f 100644
--- a/core/libs/prx/libSceNpUtility/include/Api.hpp
+++ b/core/libs/prx/libSceNpUtility/include/Api.hpp
@@ -23,6 +23,13 @@ int APS5_VABI sceNpWordFilterCreateTitleCtx(const void* selfNpId);
 int APS5_VABI sceNpWordFilterDeleteRequest(int reqId);
 int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId);
 int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result);
+int APS5_VABI sceNpLookupAbortRequest(int reqId);
+int APS5_VABI sceNpLookupCreateAsyncRequest(int titleCtxId, const std::uint64_t* param);
+int APS5_VABI sceNpLookupPollAsync(int reqId, int* result);
+int APS5_VABI sceNpLookupSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout);
+int APS5_VABI sceNpLookupWaitAsync(int reqId, int* result);
+int APS5_VABI sceNpWordFilterSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout);
+int APS5_VABI sceNpWordFilterWaitAsync(int reqId, int* result);
 int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option);
 
 int APS5_VABI sceNpAppInfoIntAbortRequest();
@@ -53,8 +60,6 @@ int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdList();
 int APS5_VABI sceNpAppLaunchLinkIntGetCompatibleTitleIdNum();
 int APS5_VABI sceNpAppLaunchLinkIntInitialize();
 int APS5_VABI sceNpBandwidthTestShutdownWithDetailedInfo();
-int APS5_VABI sceNpLookupAbortRequest();
-int APS5_VABI sceNpLookupCreateAsyncRequest();
 int APS5_VABI sceNpLookupCreateTitleCtxA();
 int APS5_VABI sceNpLookupNetAbortRequest();
 int APS5_VABI sceNpLookupNetCensorComment();
@@ -72,9 +77,6 @@ int APS5_VABI sceNpLookupNetNpId();
 int APS5_VABI sceNpLookupNetSanitizeComment();
 int APS5_VABI sceNpLookupNetSetTimeout();
 int APS5_VABI sceNpLookupNetTerm();
-int APS5_VABI sceNpLookupPollAsync();
-int APS5_VABI sceNpLookupSetTimeout();
-int APS5_VABI sceNpLookupWaitAsync();
 int APS5_VABI sceNpServiceChecker2IntAbortRequest();
 int APS5_VABI sceNpServiceChecker2IntCreateRequest();
 int APS5_VABI sceNpServiceChecker2IntDestroyRequest();
@@ -99,7 +101,5 @@ int APS5_VABI sceNpTitleMetadataIntGetNpTitleId();
 int APS5_VABI sceNpUtilityInit();
 int APS5_VABI sceNpUtilityTerm();
 int APS5_VABI sceNpWordFilterCreateTitleCtxA();
-int APS5_VABI sceNpWordFilterSetTimeout();
-int APS5_VABI sceNpWordFilterWaitAsync();
 
 }
diff --git a/core/libs/tests/GuestNpUtilityOffline.cpp b/core/libs/tests/GuestNpUtilityOffline.cpp
index 42c76ec96c..290bbe7b94 100644
--- a/core/libs/tests/GuestNpUtilityOffline.cpp
+++ b/core/libs/tests/GuestNpUtilityOffline.cpp
@@ -3,6 +3,8 @@
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
+#include <chrono>
+#include <thread>
 
 namespace {
 
@@ -118,11 +120,96 @@ void CheckWordFilter() {
 
 }
 
+int WaitInThread(int (*wait)(int, int*), int reqId, int* result, void (*finish)(int)) {
+    int status = 7;
+    std::thread waiter([&] { status = wait(reqId, result); });
+    std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    finish(reqId);
+    waiter.join();
+    return status;
+}
+
+void StartLookup(int reqId) {
+    NpOnlineId onlineId{};
+    std::strcpy(onlineId.data, "player_2");
+    sceNpLookupNpId(reqId, &onlineId, npId, nullptr);
+}
+
+void AbortLookup(int reqId) {
+    sceNpLookupAbortRequest(reqId);
+}
+
+void DeleteLookup(int reqId) {
+    sceNpLookupDeleteRequest(reqId);
+}
+
+void CheckLookupAsync() {
+    const int context = sceNpLookupCreateTitleCtx(selfNpId);
+    Require(sceNpLookupCreateAsyncRequest(context, nullptr) == InvalidArgument, "sceNpLookupCreateAsyncRequest", "a null parameter was taken");
+    Require(sceNpLookupCreateAsyncRequest(context, wrongAsyncParam) == InvalidArgument, "sceNpLookupCreateAsyncRequest", "a parameter size other than 0x18 was taken");
+    Require(sceNpLookupCreateAsyncRequest(context + 100, asyncParam) == InvalidId, "sceNpLookupCreateAsyncRequest", "an unknown context was taken");
+
+    Require(sceNpLookupSetTimeout(context, -1, 0, 0, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a negative retry count was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 0, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "settings without any effect were taken");
+    Require(sceNpLookupSetTimeout(context, 0, 999999, 0, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a resolve timeout under 1 s was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 9999999, 0, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a connect timeout under 10 s was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 0, 9999999, 0) == InvalidArgument, "sceNpLookupSetTimeout", "a send timeout under 10 s was taken");
+    Require(sceNpLookupSetTimeout(context, 0, 0, 0, 0, 9999999) == InvalidArgument, "sceNpLookupSetTimeout", "a receive timeout under 10 s was taken");
+    Require(sceNpLookupSetTimeout(context + 100, 1, 0, 0, 0, 0) == InvalidId, "sceNpLookupSetTimeout", "an unknown id was taken");
+    Require(sceNpLookupSetTimeout(context, 1, 0, 0, 0, 0) == 0, "sceNpLookupSetTimeout", "a context timeout was refused");
+
+    const int async = sceNpLookupCreateAsyncRequest(context, asyncParam);
+    Require(async > 0, "sceNpLookupCreateAsyncRequest", "creating an asynchronous request failed");
+    Require(sceNpLookupSetTimeout(async, 0, 1000000, 10000000, 10000000, 10000000) == 0, "sceNpLookupSetTimeout", "a request timeout was refused");
+    int result = 7;
+    Require(sceNpLookupPollAsync(async + 100, &result) == InvalidId, "sceNpLookupPollAsync", "an unknown request was taken");
+    Require(sceNpLookupPollAsync(async, nullptr) == PollRunning, "sceNpLookupPollAsync", "an unstarted request was not running");
+    Require(WaitInThread(sceNpLookupWaitAsync, async, &result, StartLookup) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "waiting did not end with SIGNED_OUT when the lookup started");
+    Require(sceNpLookupPollAsync(async, nullptr) == PollFinished, "sceNpLookupPollAsync", "a null result was refused on a finished request");
+    result = 7;
+    Require(sceNpLookupPollAsync(async, &result) == PollFinished && result == SignedOut, "sceNpLookupPollAsync", "the request did not finish with SIGNED_OUT");
+
+    const int sync = sceNpLookupCreateRequest(context);
+    StartLookup(sync);
+    result = 7;
+    Require(sceNpLookupWaitAsync(sync, &result) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "a finished synchronous request was not returned");
+
+    const int aborted = sceNpLookupCreateAsyncRequest(context, asyncParam);
+    Require(sceNpLookupAbortRequest(aborted + 100) == InvalidId, "sceNpLookupAbortRequest", "an unknown request was taken");
+    Require(WaitInThread(sceNpLookupWaitAsync, aborted, &result, AbortLookup) == 0 && result == Aborted, "sceNpLookupAbortRequest", "waiting did not end with ABORTED");
+    Require(sceNpLookupNpId(aborted, nullptr, npId, nullptr) == InsufficientArgument, "sceNpLookupNpId", "arguments were not checked before the abort");
+
+    const int deleted = sceNpLookupCreateAsyncRequest(context, asyncParam);
+    Require(WaitInThread(sceNpLookupWaitAsync, deleted, &result, DeleteLookup) == InvalidId, "sceNpLookupWaitAsync", "waiting on a deleted request did not return INVALID_ID");
+    Require(sceNpLookupWaitAsync(deleted, &result) == InvalidId, "sceNpLookupWaitAsync", "an unknown request was taken");
+    sceNpLookupDeleteTitleCtx(context);
+}
+
+void CheckWordFilterAsync() {
+    const int context = sceNpWordFilterCreateTitleCtx(selfNpId);
+    Require(sceNpWordFilterSetTimeout(context, 0, 0, 0, 0, 0) == InvalidArgument, "sceNpWordFilterSetTimeout", "settings without any effect were taken");
+    Require(sceNpWordFilterSetTimeout(context, 0, 0, 0, 0, 9999999) == InvalidArgument, "sceNpWordFilterSetTimeout", "a receive timeout under 10 s was taken");
+    Require(sceNpWordFilterSetTimeout(context, 1, 0, 0, 0, 0) == 0, "sceNpWordFilterSetTimeout", "a context timeout was refused");
+    Require(sceNpWordFilterSetTimeout(1, 1, 0, 0, 0, 0) == InvalidId, "sceNpWordFilterSetTimeout", "a lookup id was taken");
+    const int sync = sceNpWordFilterCreateRequest(context);
+    const int async = sceNpWordFilterCreateAsyncRequest(context, asyncParam);
+    Require(sceNpWordFilterSetTimeout(async, 2, 1000000, 0, 0, 0) == 0, "sceNpWordFilterSetTimeout", "a request timeout was refused");
+    int result = 7;
+    Require(sceNpWordFilterWaitAsync(async, nullptr) == InvalidArgument, "sceNpWordFilterWaitAsync", "a null result was taken");
+    Require(sceNpWordFilterWaitAsync(sync, &result) == InvalidId, "sceNpWordFilterWaitAsync", "a synchronous request was taken");
+    Require(sceNpWordFilterWaitAsync(async + 100, &result) == InvalidId, "sceNpWordFilterWaitAsync", "an unknown request was taken");
+    Require(sceNpWordFilterCensorComment(async, "word", nullptr) == 0, "sceNpWordFilterCensorComment", "the asynchronous request did not start");
+    Require(sceNpWordFilterWaitAsync(async, &result) == 0 && result == SignedOut, "sceNpWordFilterWaitAsync", "the request did not finish with SIGNED_OUT");
+    sceNpWordFilterDeleteTitleCtx(context);
+}
+
 int main() {
     std::memset(selfNpId, 0, sizeof(selfNpId));
     std::strcpy(reinterpret_cast<char*>(selfNpId), "player_1");
     CheckLookup();
     CheckWordFilter();
+    CheckLookupAsync();
+    CheckWordFilterAsync();
     if (failures != 0) return 1;
     std::puts("NpUtility offline tests passed");
     return 0;
diff --git a/docs/dev/debt/libSceNpUtility.md b/docs/dev/debt/libSceNpUtility.md
index 642d6ab2bd..d83539b646 100644
--- a/docs/dev/debt/libSceNpUtility.md
+++ b/docs/dev/debt/libSceNpUtility.md
@@ -6,17 +6,17 @@
 - [sceNpAppInfoIntCheckServiceAvailabilityA, sceNpAppInfoIntCheckServiceAvailabilityAll, sceNpAppInfoIntCheckServiceAvailabilityAllA, sceNpAppInfoIntCreateRequest, sceNpAppInfoIntDestroyRequest and sceNpAppInfoIntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpAppInfoIntInitialize, sceNpAppLaunchLink2IntAbortRequest, sceNpAppLaunchLink2IntCreateRequest, sceNpAppLaunchLink2IntDestroyRequest, sceNpAppLaunchLink2IntFinalize and sceNpAppLaunchLink2IntGetCompatibleTitleIdList](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpAppLaunchLink2IntGetCompatibleTitleIdNum, sceNpAppLaunchLink2IntInitialize, sceNpAppLaunchLinkIntAbortRequest, sceNpAppLaunchLinkIntCreateRequest, sceNpAppLaunchLinkIntDestroyRequest and sceNpAppLaunchLinkIntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
-- [sceNpAppLaunchLinkIntGetCompatibleTitleIdList, sceNpAppLaunchLinkIntGetCompatibleTitleIdNum, sceNpAppLaunchLinkIntInitialize, sceNpBandwidthTestShutdownWithDetailedInfo and sceNpLookupAbortRequest](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
-- [sceNpLookupCreateAsyncRequest, sceNpLookupCreateTitleCtxA, sceNpLookupNetAbortRequest and sceNpLookupNetCensorComment](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpAppLaunchLinkIntGetCompatibleTitleIdList, sceNpAppLaunchLinkIntGetCompatibleTitleIdNum, sceNpAppLaunchLinkIntInitialize and sceNpBandwidthTestShutdownWithDetailedInfo](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupCreateTitleCtxA, sceNpLookupNetAbortRequest and sceNpLookupNetCensorComment](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpLookupNetConvertJidToNpId, sceNpLookupNetConvertNpIdToJid, sceNpLookupNetCreateRequest, sceNpLookupNetCreateTitleCtx, sceNpLookupNetDeleteRequest, sceNpLookupNetDeleteTitleCtx and sceNpLookupNetInit](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
-- [sceNpLookupNetInitWithFunctionPointer, sceNpLookupNetInitWithMemoryPool, sceNpLookupNetIsInit, sceNpLookupNetNpId, sceNpLookupNetSanitizeComment, sceNpLookupNetSetTimeout, sceNpLookupNetTerm and sceNpLookupPollAsync](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
-- [sceNpLookupSetTimeout, sceNpLookupWaitAsync, sceNpServiceChecker2IntAbortRequest, sceNpServiceChecker2IntCreateRequest, sceNpServiceChecker2IntDestroyRequest and sceNpServiceChecker2IntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpLookupNetInitWithFunctionPointer, sceNpLookupNetInitWithMemoryPool, sceNpLookupNetIsInit, sceNpLookupNetNpId, sceNpLookupNetSanitizeComment, sceNpLookupNetSetTimeout and sceNpLookupNetTerm](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
+- [sceNpServiceChecker2IntAbortRequest, sceNpServiceChecker2IntCreateRequest, sceNpServiceChecker2IntDestroyRequest and sceNpServiceChecker2IntFinalize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpServiceChecker2IntGetServiceAvailability, sceNpServiceChecker2IntGetServiceAvailabilityA, sceNpServiceChecker2IntInitialize, sceNpServiceChecker2IntIsSetServiceType and sceNpServiceCheckerIntAbortRequest](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpServiceCheckerIntCreateRequest, sceNpServiceCheckerIntDestroyRequest, sceNpServiceCheckerIntFinalize, sceNpServiceCheckerIntGetAvailability, sceNpServiceCheckerIntGetAvailabilityList and sceNpServiceCheckerIntInitialize](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpServiceCheckerIntIsCached, sceNpTitleMetadataIntAbortRequest, sceNpTitleMetadataIntCreateRequest, sceNpTitleMetadataIntDeleteRequest, sceNpTitleMetadataIntGetInfo, sceNpTitleMetadataIntGetNpTitleId and sceNpUtilityInit](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 - [sceNpUtilityTerm and sceNpWordFilterCreateTitleCtxA](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
-- [sceNpWordFilterSetTimeout and sceNpWordFilterWaitAsync](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - The list is the intersection of the export table of the console's libSceNpUtility (function symbols only), the pinned aerolib names and the functions not yet defined anywhere in the repo; names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpUtility.c) and the [verified NID name database](https://github.com/zecoxao/sce_symbols/blob/2883963a0a514ba6e77407a08ef4730a65e88254/aerolib.csv), but no credible prototypes were found. They are declared without parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified.
 
 ### Functional
 
 - [NpLookup and NpWordFilter](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline only, not measured on a PS5: the argument checks and their order, the limit of 32 title contexts and 32 requests, the word filter id bases `0x01000001` and `0x02000001`, the 0x400-byte comment limit and single-use requests (`INVALID_TYPE`) follow shadPS4's [lookup](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L41-L222) and [word filter](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L705-L909) calls. `sceNpLookupNpId`, `sceNpWordFilterCensorComment` and `sceNpWordFilterSanitizeComment` then finish with `SCE_NP_ERROR_SIGNED_OUT` and write no NpId or comment; shadPS4's word filter accepts every comment as a stand-in for the server, so its result is not used
+- [NpLookup and NpWordFilter waits and timeouts](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline, not measured on a PS5: the timeouts of `sceNpLookupSetTimeout` and `sceNpWordFilterSetTimeout` are checked and then have no effect, since no request reaches a server. A wait on a request deleted meanwhile returns `INVALID_ID`. The checks and results follow shadPS4's [lookup](https://github.com/shadps4-emu/shadPS4/blob/cc4dbd45bc10049ea8a445eb0e697de268ef4723/src/core/libraries/np/np_utility/np_utility.cpp#L120-L321) and [word filter](https://github.com/shadps4-emu/shadPS4/blob/cc4dbd45bc10049ea8a445eb0e697de268ef4723/src/core/libraries/np/np_utility/np_utility.cpp#L911-L951) calls: the lookup poll and wait take a null result and a synchronous request, the word filter ones refuse both

From ed2d79d962a931e6ab0e2a74244196cd5699543b Mon Sep 17 00:00:00 2001
From: louise-patra <rocklouis055@gmail.com>
Date: Sat, 24 Oct 2026 19:56:53 +0530
Subject: [PATCH 100/218] test(libSceNpUtility): fail a wait that returns
 before its request finishes

The waiter sets a flag right before the wait; the test waits for it,
then requires the wait not to have returned before it finishes, aborts
or deletes the request.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/tests/GuestNpUtilityOffline.cpp | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/core/libs/tests/GuestNpUtilityOffline.cpp b/core/libs/tests/GuestNpUtilityOffline.cpp
index 290bbe7b94..21c4fa0481 100644
--- a/core/libs/tests/GuestNpUtilityOffline.cpp
+++ b/core/libs/tests/GuestNpUtilityOffline.cpp
@@ -3,6 +3,7 @@
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
+#include <atomic>
 #include <chrono>
 #include <thread>
 
@@ -120,10 +121,18 @@ void CheckWordFilter() {
 
 }
 
-int WaitInThread(int (*wait)(int, int*), int reqId, int* result, void (*finish)(int)) {
+int WaitInThread(const char* name, int (*wait)(int, int*), int reqId, int* result, void (*finish)(int)) {
     int status = 7;
-    std::thread waiter([&] { status = wait(reqId, result); });
+    std::atomic<bool> entered{false};
+    std::atomic<bool> returned{false};
+    std::thread waiter([&] {
+        entered = true;
+        status = wait(reqId, result);
+        returned = true;
+    });
+    while (!entered) std::this_thread::yield();
     std::this_thread::sleep_for(std::chrono::milliseconds(20));
+    Require(!returned, name, "the wait returned before the request finished");
     finish(reqId);
     waiter.join();
     return status;
@@ -164,7 +173,7 @@ void CheckLookupAsync() {
     int result = 7;
     Require(sceNpLookupPollAsync(async + 100, &result) == InvalidId, "sceNpLookupPollAsync", "an unknown request was taken");
     Require(sceNpLookupPollAsync(async, nullptr) == PollRunning, "sceNpLookupPollAsync", "an unstarted request was not running");
-    Require(WaitInThread(sceNpLookupWaitAsync, async, &result, StartLookup) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "waiting did not end with SIGNED_OUT when the lookup started");
+    Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, async, &result, StartLookup) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "waiting did not end with SIGNED_OUT when the lookup started");
     Require(sceNpLookupPollAsync(async, nullptr) == PollFinished, "sceNpLookupPollAsync", "a null result was refused on a finished request");
     result = 7;
     Require(sceNpLookupPollAsync(async, &result) == PollFinished && result == SignedOut, "sceNpLookupPollAsync", "the request did not finish with SIGNED_OUT");
@@ -176,11 +185,11 @@ void CheckLookupAsync() {
 
     const int aborted = sceNpLookupCreateAsyncRequest(context, asyncParam);
     Require(sceNpLookupAbortRequest(aborted + 100) == InvalidId, "sceNpLookupAbortRequest", "an unknown request was taken");
-    Require(WaitInThread(sceNpLookupWaitAsync, aborted, &result, AbortLookup) == 0 && result == Aborted, "sceNpLookupAbortRequest", "waiting did not end with ABORTED");
+    Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, aborted, &result, AbortLookup) == 0 && result == Aborted, "sceNpLookupAbortRequest", "waiting did not end with ABORTED");
     Require(sceNpLookupNpId(aborted, nullptr, npId, nullptr) == InsufficientArgument, "sceNpLookupNpId", "arguments were not checked before the abort");
 
     const int deleted = sceNpLookupCreateAsyncRequest(context, asyncParam);
-    Require(WaitInThread(sceNpLookupWaitAsync, deleted, &result, DeleteLookup) == InvalidId, "sceNpLookupWaitAsync", "waiting on a deleted request did not return INVALID_ID");
+    Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, deleted, &result, DeleteLookup) == InvalidId, "sceNpLookupWaitAsync", "waiting on a deleted request did not return INVALID_ID");
     Require(sceNpLookupWaitAsync(deleted, &result) == InvalidId, "sceNpLookupWaitAsync", "an unknown request was taken");
     sceNpLookupDeleteTitleCtx(context);
 }

From 8d1059abdeb9b424d755269572e9c06404db2a87 Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Sun, 25 Oct 2026 21:06:20 +1300
Subject: [PATCH 101/218] test(savedata): assert the runtime_error thrown for
 null convert inputs

---
 core/libs/tests/GuestSaveDataConvert.cpp | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/core/libs/tests/GuestSaveDataConvert.cpp b/core/libs/tests/GuestSaveDataConvert.cpp
index 3680a14dde..86af2c7a45 100644
--- a/core/libs/tests/GuestSaveDataConvert.cpp
+++ b/core/libs/tests/GuestSaveDataConvert.cpp
@@ -6,6 +6,7 @@
 #include <fstream>
 #include <iterator>
 #include <random>
+#include <stdexcept>
 #include <string>
 #include <system_error>
 #include <vector>
@@ -32,6 +33,15 @@ void Check(bool condition, const std::string& what) {
     ++failures;
 }
 
+bool Throws(const SaveDataConvert* convert) {
+    try {
+        sceSaveDataConvert(convert);
+    } catch (const std::runtime_error&) {
+        return true;
+    }
+    return false;
+}
+
 int Convert(const char* data, std::size_t size) {
     SceSaveDataDirName name{};
     std::memcpy(name.data, data, size);
@@ -59,9 +69,9 @@ int main() {
 
     float progress = 0.0f;
     Check(sceSaveDataGetConvertProgress(&progress) == SaveDataErrorNotInitialized, "query before initialize fails with not initialized");
-    Check(sceSaveDataConvert(nullptr) == SaveDataErrorParameter, "null convert pointer is rejected");
+    Check(Throws(nullptr), "null convert pointer throws");
     SaveDataConvert nullDir{};
-    Check(sceSaveDataConvert(&nullDir) == SaveDataErrorParameter, "null dir_name is rejected");
+    Check(Throws(&nullDir), "null dir_name throws");
     Check(sceSaveDataInitialize3(nullptr) == 0, "SaveData initializes");
     Check(sceSaveDataGetConvertProgress(&progress) == 0, "get convert progress succeeds");
     Check(progress == 0.0f, "convert progress reports 0.0f initially");

From 200c0aef2b4b5408b4ae7b7aa66b6d1a09c1e7a3 Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Sun, 25 Oct 2026 21:06:21 +1300
Subject: [PATCH 102/218] test(videoout): check the null resolution status
 buffer through the throwing helper

---
 core/libs/tests/GuestVideoOutResolutionStatus.cpp | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/core/libs/tests/GuestVideoOutResolutionStatus.cpp b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
index fb4d14f108..58fcd7cbb5 100644
--- a/core/libs/tests/GuestVideoOutResolutionStatus.cpp
+++ b/core/libs/tests/GuestVideoOutResolutionStatus.cpp
@@ -68,8 +68,7 @@ int main() {
     for (const auto byte : vrr) Require(byte == std::byte{0xff});
 
     Require(Rejects(handle, nullptr));
-    Require(sceVideoOutGetResolutionStatus(handle, nullptr) == static_cast<int>(0x80290002u));
-    Require(sceVideoOutGetResolutionStatus(-1, nullptr) == static_cast<int>(0x80290002u));
+    Require(Rejects(-1, nullptr));
     Require(Rejects(0, &status));
     Require(Rejects(-1, &status));
     Require(Rejects(NEVER_OPENED_HANDLE, &status));

From 855e4ea6a0a3b9dd67b374a6d5614f328b7958a3 Mon Sep 17 00:00:00 2001
From: louise-patra <rocklouis055@gmail.com>
Date: Sun, 25 Oct 2026 13:57:19 +0530
Subject: [PATCH 103/218] test(libSceNpUtility): keep the export ABI in the
 wait callback

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/tests/GuestNpUtilityOffline.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestNpUtilityOffline.cpp b/core/libs/tests/GuestNpUtilityOffline.cpp
index 21c4fa0481..f4c627f347 100644
--- a/core/libs/tests/GuestNpUtilityOffline.cpp
+++ b/core/libs/tests/GuestNpUtilityOffline.cpp
@@ -121,7 +121,7 @@ void CheckWordFilter() {
 
 }
 
-int WaitInThread(const char* name, int (*wait)(int, int*), int reqId, int* result, void (*finish)(int)) {
+int WaitInThread(const char* name, int (APS5_VABI *wait)(int, int*), int reqId, int* result, void (*finish)(int)) {
     int status = 7;
     std::atomic<bool> entered{false};
     std::atomic<bool> returned{false};

From d426ab75476ffd812c0aa704b3df94b4f4ab05a9 Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Sat, 24 Oct 2026 15:33:54 +0200
Subject: [PATCH 104/218] test(libkernel): keep the raise-in-system-call writer
 in guest code until each raise lands

On a busy Windows runner the writer could stay inside NtWriteFile for
over a second, because each 64 KiB block waited on 16 reader wake-ups.
The raise then hit its 1 s retry limit and redirected the writer inside
the call with the stream lock held, so the test deadlocked until ctest
killed it at 30 s.

Each raise now targets one 8 KiB write that blocks for about 100 ms on a
single reader wake-up, and the writer spins in its own code until the
raise is delivered. The watchdog uses a steady_clock deadline, so a hang
aborts at 25 s instead of outliving the ctest timeout.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/tests/GuestRaiseInSystemCall.cpp | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/core/libs/tests/GuestRaiseInSystemCall.cpp b/core/libs/tests/GuestRaiseInSystemCall.cpp
index f1b75ad913..262d7714f7 100644
--- a/core/libs/tests/GuestRaiseInSystemCall.cpp
+++ b/core/libs/tests/GuestRaiseInSystemCall.cpp
@@ -2,7 +2,6 @@
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
-#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <fcntl.h>
@@ -19,8 +18,7 @@ static void Require(bool value) { if (!value) std::abort(); }
 static std::FILE* shared = nullptr;
 static std::atomic<int> deliveries{0};
 static std::atomic<int> released{0};
-static std::atomic<bool> stop{false};
-static std::atomic<int> blocks{0};
+static std::atomic<int> writing{0};
 
 static void APS5_VABI Handler(int, void*) {
     const auto delivery = deliveries.fetch_add(1) + 1;
@@ -28,12 +26,12 @@ static void APS5_VABI Handler(int, void*) {
 }
 
 static void* APS5_VABI Writer(void*) {
-    const std::string block(16u * PipeBytes, 'x');
-    while (!stop.load()) {
+    const std::string block(2u * PipeBytes, 'x');
+    for (int raise = 1; raise <= Raises; ++raise) {
+        writing.store(raise);
         Require(std::fwrite(block.data(), 1, block.size(), shared) == block.size());
-        blocks.fetch_add(1);
-        volatile std::uint64_t spin = 0;
-        for (std::uint64_t i = 0; i < 200000; ++i) spin = spin + i;
+        while (deliveries.load() < raise) {
+        }
     }
     return nullptr;
 }
@@ -41,7 +39,8 @@ static void* APS5_VABI Writer(void*) {
 int main() {
     std::atomic<bool> done{false};
     std::thread watchdog([&done] {
-        for (int i = 0; i < 25000 && !done.load(); ++i) std::this_thread::sleep_for(std::chrono::milliseconds(1));
+        const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(25);
+        while (!done.load() && std::chrono::steady_clock::now() < deadline) std::this_thread::sleep_for(std::chrono::milliseconds(10));
         if (!done.load()) std::abort();
     });
     HANDLE read = nullptr;
@@ -54,20 +53,19 @@ int main() {
         char chunk[PipeBytes];
         DWORD got = 0;
         while (ReadFile(read, chunk, sizeof(chunk), &got, nullptr) != 0 && got != 0) {
-            if (draining.load()) std::this_thread::sleep_for(std::chrono::milliseconds(10));
+            if (draining.load()) std::this_thread::sleep_for(std::chrono::milliseconds(100));
         }
     });
     Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
     Pthread writer = nullptr;
     Require(scePthreadCreate(&writer, nullptr, Writer, nullptr, "pipe writer") == 0);
-    while (blocks.load() == 0) std::this_thread::yield();
     for (int raise = 1; raise <= Raises; ++raise) {
+        while (writing.load() < raise) std::this_thread::yield();
         Require(sceKernelRaiseException(writer, SigUsr1) == 0);
         while (deliveries.load() < raise) std::this_thread::yield();
         Require(std::fputc('y', shared) == 'y');
         released.store(raise);
     }
-    stop.store(true);
     draining.store(false);
     Require(scePthreadJoin(writer, nullptr) == 0);
     Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);

From 493aac4e6cb56473586d22d00ef72c5a3132c8fc Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Sat, 24 Oct 2026 16:29:53 +0200
Subject: [PATCH 105/218] test(libkernel): raise only once the writer is
 blocked inside its write

The writer used to publish its block number just before fwrite, so a
delayed raise could land before the call and pass without exercising the
system-call path. The stream is now unbuffered, so each block is one 16 KiB
WriteFile into the 4 KiB pipe. The reader counts the bytes, signals when the
first byte of a block arrives (the writer is then inside WriteFile with more
than a pipe's worth left), and stops reading until the main thread has
started the raise, then 100 ms more. It checks the write has not returned,
and the handler checks the delivery came after it did.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/tests/GuestRaiseInSystemCall.cpp | 27 +++++++++++++++-------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/core/libs/tests/GuestRaiseInSystemCall.cpp b/core/libs/tests/GuestRaiseInSystemCall.cpp
index 262d7714f7..999f4b5755 100644
--- a/core/libs/tests/GuestRaiseInSystemCall.cpp
+++ b/core/libs/tests/GuestRaiseInSystemCall.cpp
@@ -2,6 +2,7 @@
 #include "SceTypes.hpp"
 #include <atomic>
 #include <chrono>
+#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <fcntl.h>
@@ -13,23 +14,27 @@
 static constexpr int SigUsr1 = 30;
 static constexpr int Raises = 10;
 static constexpr DWORD PipeBytes = 4096;
+static constexpr std::uint64_t BlockBytes = 4u * PipeBytes;
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::FILE* shared = nullptr;
 static std::atomic<int> deliveries{0};
 static std::atomic<int> released{0};
-static std::atomic<int> writing{0};
+static std::atomic<int> written{0};
+static std::atomic<int> blocked{0};
+static std::atomic<int> raising{0};
 
 static void APS5_VABI Handler(int, void*) {
     const auto delivery = deliveries.fetch_add(1) + 1;
+    Require(written.load() == delivery);
     while (released.load() < delivery) std::this_thread::yield();
 }
 
 static void* APS5_VABI Writer(void*) {
-    const std::string block(2u * PipeBytes, 'x');
+    const std::string block(BlockBytes, 'x');
     for (int raise = 1; raise <= Raises; ++raise) {
-        writing.store(raise);
         Require(std::fwrite(block.data(), 1, block.size(), shared) == block.size());
+        written.store(raise);
         while (deliveries.load() < raise) {
         }
     }
@@ -47,26 +52,32 @@ int main() {
     HANDLE write = nullptr;
     Require(CreatePipe(&read, &write, nullptr, PipeBytes) != 0);
     shared = _fdopen(_open_osfhandle(reinterpret_cast<intptr_t>(write), _O_WRONLY | _O_BINARY), "wb");
-    Require(shared != nullptr);
-    std::atomic<bool> draining{true};
+    Require(shared != nullptr && std::setvbuf(shared, nullptr, _IONBF, 0) == 0);
     std::thread reader([&] {
         char chunk[PipeBytes];
         DWORD got = 0;
+        std::uint64_t total = 0;
+        int block = 0;
         while (ReadFile(read, chunk, sizeof(chunk), &got, nullptr) != 0 && got != 0) {
-            if (draining.load()) std::this_thread::sleep_for(std::chrono::milliseconds(100));
+            total += got;
+            if (block == Raises || total <= static_cast<std::uint64_t>(block) * (BlockBytes + 1)) continue;
+            blocked.store(++block);
+            while (raising.load() < block) std::this_thread::yield();
+            std::this_thread::sleep_for(std::chrono::milliseconds(100));
+            Require(written.load() < block);
         }
     });
     Require(sceKernelInstallExceptionHandler(SigUsr1, reinterpret_cast<void*>(&Handler)) == 0);
     Pthread writer = nullptr;
     Require(scePthreadCreate(&writer, nullptr, Writer, nullptr, "pipe writer") == 0);
     for (int raise = 1; raise <= Raises; ++raise) {
-        while (writing.load() < raise) std::this_thread::yield();
+        while (blocked.load() < raise) std::this_thread::yield();
+        raising.store(raise);
         Require(sceKernelRaiseException(writer, SigUsr1) == 0);
         while (deliveries.load() < raise) std::this_thread::yield();
         Require(std::fputc('y', shared) == 'y');
         released.store(raise);
     }
-    draining.store(false);
     Require(scePthreadJoin(writer, nullptr) == 0);
     Require(sceKernelRemoveExceptionHandler(SigUsr1) == 0);
     std::fclose(shared);

From 86709434faae43bb020effbdcd509ce5aec33ee5 Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Sun, 25 Oct 2026 10:10:01 +0100
Subject: [PATCH 106/218] test(libkernel): gate the raise-in-system-call hold
 on the raise sampling the writer

The reader held the pipe for a fixed 100 ms after the main thread flagged
the raise, so a main thread descheduled before sceKernelRaiseException let
the write finish first and the test passed without the system-call path.
The reader now waits until the writer is suspended (NtQueryInformationThread
ThreadSuspendCount), which only the raise does while the write is blocked,
then holds 100 ms.

The handler checked that the write had returned through a flag the writer
sets after fwrite, so a correct delivery between the two failed. It now
checks that the interrupted rip lies in the test's own image.

Two more registrations run the same test with a 200 ms pause before the
raise and with a guest-code spin between fwrite and the flag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libkernel/CMakeLists.txt     |  5 +++
 core/libs/tests/GuestRaiseInSystemCall.cpp | 46 +++++++++++++++++++---
 2 files changed, 45 insertions(+), 6 deletions(-)

diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt
index 9da2728d50..9bc366006b 100644
--- a/core/libs/prx/libkernel/CMakeLists.txt
+++ b/core/libs/prx/libkernel/CMakeLists.txt
@@ -1973,6 +1973,11 @@ if(BUILD_TESTING)
         add_test(NAME guest_raise_in_system_call COMMAND guest_raise_in_system_call_tests)
         set_tests_properties(guest_raise_in_system_call PROPERTIES TIMEOUT 30 ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        foreach(delay IN ITEMS raise return)
+            add_test(NAME guest_raise_in_system_call_delay_${delay} COMMAND guest_raise_in_system_call_tests --delay-${delay})
+            set_tests_properties(guest_raise_in_system_call_delay_${delay} PROPERTIES TIMEOUT 30 ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+        endforeach()
         add_test_executable(guest_raise_in_host_code_tests ${LIBS_INCLUDE_DIR}/tests/GuestRaiseInHostCode.cpp)
         target_include_directories(guest_raise_in_host_code_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(guest_raise_in_host_code_tests PRIVATE libkernel libc)
diff --git a/core/libs/tests/GuestRaiseInSystemCall.cpp b/core/libs/tests/GuestRaiseInSystemCall.cpp
index 999f4b5755..6f0d08c8be 100644
--- a/core/libs/tests/GuestRaiseInSystemCall.cpp
+++ b/core/libs/tests/GuestRaiseInSystemCall.cpp
@@ -5,9 +5,11 @@
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <fcntl.h>
 #include <io.h>
 #include <string>
+#include <string_view>
 #include <thread>
 #include <windows.h>
 
@@ -15,6 +17,8 @@ static constexpr int SigUsr1 = 30;
 static constexpr int Raises = 10;
 static constexpr DWORD PipeBytes = 4096;
 static constexpr std::uint64_t BlockBytes = 4u * PipeBytes;
+static constexpr std::size_t RipOffset = 0xe0;
+static constexpr ULONG ThreadSuspendCount = 35;
 static void Require(bool value) { if (!value) std::abort(); }
 
 static std::FILE* shared = nullptr;
@@ -22,18 +26,43 @@ static std::atomic<int> deliveries{0};
 static std::atomic<int> released{0};
 static std::atomic<int> written{0};
 static std::atomic<int> blocked{0};
-static std::atomic<int> raising{0};
+static std::atomic<HANDLE> writerThread{nullptr};
+static bool delayReturn = false;
 
-static void APS5_VABI Handler(int, void*) {
+static bool InTestImage(std::uint64_t rip) {
+    const auto base = reinterpret_cast<std::uint64_t>(GetModuleHandleW(nullptr));
+    const auto* dos = reinterpret_cast<const IMAGE_DOS_HEADER*>(base);
+    const auto* nt = reinterpret_cast<const IMAGE_NT_HEADERS*>(base + dos->e_lfanew);
+    return rip >= base && rip - base < nt->OptionalHeader.SizeOfImage;
+}
+
+static bool Suspended(HANDLE thread) {
+    using Query = LONG(NTAPI*)(HANDLE, ULONG, void*, ULONG, ULONG*);
+    static const auto query = reinterpret_cast<Query>(GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtQueryInformationThread"));
+    ULONG count = 0;
+    Require(query != nullptr && query(thread, ThreadSuspendCount, &count, sizeof(count), nullptr) >= 0);
+    return count > 0;
+}
+
+static void APS5_VABI Handler(int, void* context) {
     const auto delivery = deliveries.fetch_add(1) + 1;
-    Require(written.load() == delivery);
+    std::uint64_t rip = 0;
+    std::memcpy(&rip, static_cast<const std::byte*>(context) + RipOffset, sizeof(rip));
+    Require(InTestImage(rip));
     while (released.load() < delivery) std::this_thread::yield();
 }
 
 static void* APS5_VABI Writer(void*) {
+    HANDLE self = nullptr;
+    Require(DuplicateHandle(GetCurrentProcess(), GetCurrentThread(), GetCurrentProcess(), &self, THREAD_QUERY_INFORMATION, FALSE, 0) != 0);
+    writerThread.store(self);
     const std::string block(BlockBytes, 'x');
     for (int raise = 1; raise <= Raises; ++raise) {
         Require(std::fwrite(block.data(), 1, block.size(), shared) == block.size());
+        if (delayReturn) {
+            volatile std::uint64_t spin = 0;
+            for (std::uint64_t i = 0; i < 100000000; ++i) spin = spin + i;
+        }
         written.store(raise);
         while (deliveries.load() < raise) {
         }
@@ -41,7 +70,10 @@ static void* APS5_VABI Writer(void*) {
     return nullptr;
 }
 
-int main() {
+int main(int argc, char** argv) {
+    const std::string_view mode = argc > 1 ? argv[1] : "";
+    Require(mode.empty() || mode == "--delay-raise" || mode == "--delay-return");
+    delayReturn = mode == "--delay-return";
     std::atomic<bool> done{false};
     std::thread watchdog([&done] {
         const auto deadline = std::chrono::steady_clock::now() + std::chrono::seconds(25);
@@ -62,7 +94,8 @@ int main() {
             total += got;
             if (block == Raises || total <= static_cast<std::uint64_t>(block) * (BlockBytes + 1)) continue;
             blocked.store(++block);
-            while (raising.load() < block) std::this_thread::yield();
+            while (!Suspended(writerThread.load())) {
+            }
             std::this_thread::sleep_for(std::chrono::milliseconds(100));
             Require(written.load() < block);
         }
@@ -72,7 +105,7 @@ int main() {
     Require(scePthreadCreate(&writer, nullptr, Writer, nullptr, "pipe writer") == 0);
     for (int raise = 1; raise <= Raises; ++raise) {
         while (blocked.load() < raise) std::this_thread::yield();
-        raising.store(raise);
+        if (mode == "--delay-raise") std::this_thread::sleep_for(std::chrono::milliseconds(200));
         Require(sceKernelRaiseException(writer, SigUsr1) == 0);
         while (deliveries.load() < raise) std::this_thread::yield();
         Require(std::fputc('y', shared) == 'y');
@@ -83,6 +116,7 @@ int main() {
     std::fclose(shared);
     reader.join();
     CloseHandle(read);
+    CloseHandle(writerThread.load());
     done.store(true);
     watchdog.join();
 }

From 3e0367de2a50f153d59b0d8f9e8443764a12cd80 Mon Sep 17 00:00:00 2001
From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com>
Date: Sun, 25 Oct 2026 03:18:37 +0000
Subject: [PATCH 107/218] test(libc): stop the sce v2 thrower cases reading
 past an 8-byte exception object

The plain throwers allocate only a vtable pointer, but the inspection hook copied sizeof(ExceptionObject) bytes of every caught object. Copy the pointer size for the thrower cases and restore the full size afterwards.
---
 core/libs/tests/GuestSceV2Exceptions.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/libs/tests/GuestSceV2Exceptions.cpp b/core/libs/tests/GuestSceV2Exceptions.cpp
index 60765c0a45..6683c8d67b 100644
--- a/core/libs/tests/GuestSceV2Exceptions.cpp
+++ b/core/libs/tests/GuestSceV2Exceptions.cpp
@@ -111,7 +111,9 @@ static void CheckThrowers() {
         {"_Throw_Cpp_error", AsThrower(_ZNSt8__sce_v216_Throw_Cpp_errorEi_nid_postfix), reinterpret_cast<const void*>(1), &systemError, &_ZTISt12system_error_nid_postfix, 2,
             "NSt8__sce_v212system_errorE|invalid argument: invalid argument"},
     };
+    inspectBytes = sizeof(void*);
     for (const auto& test : cases) Run(test);
+    inspectBytes = sizeof(LibcException::ExceptionObject);
 }
 
 static void CheckCopies() {

From 0afde4ec7c8aa998d118a6f9fc8166020ef7893e Mon Sep 17 00:00:00 2001
From: AZLisme <8706522+AZLisme@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:06:44 +0800
Subject: [PATCH 108/218] fix(libSceFont): exhaust characters within a writing
 step

---
 core/libs/prx/libSceFont/src/Text.cpp |  5 ++++-
 core/libs/tests/GuestFont.cpp         | 22 +++++++++++++++++++++-
 docs/dev/debt/libSceFont.md           |  2 +-
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libSceFont/src/Text.cpp b/core/libs/prx/libSceFont/src/Text.cpp
index a729f8c503..9b074211f0 100644
--- a/core/libs/prx/libSceFont/src/Text.cpp
+++ b/core/libs/prx/libSceFont/src/Text.cpp
@@ -64,6 +64,7 @@ struct FontWritingData {
     float penY = 0.0f;
     bool hasAggregateMetrics = false;
     bool hasCurrentStep = false;
+    bool hasCurrentCharacter = false;
     bool maskFormatCharacters = true;
     bool ownsStorage = false;
     bool hasRawGlyphMetrics = false;
@@ -684,6 +685,7 @@ const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting* fon
     if (!PopulateWritingStep(*writing, writing->nextIndex)) return nullptr;
     writing->currentIndex = writing->nextIndex;
     writing->hasCurrentStep = true;
+    writing->hasCurrentCharacter = true;
     AccumulateWritingMetrics(*writing);
     ++writing->nextIndex;
     return &writing->step;
@@ -692,7 +694,8 @@ const FontWritingStep* APS5_VABI sceFontWritingRefersRenderStep(FontWriting* fon
 FontTextCharacter* APS5_VABI sceFontWritingRefersRenderStepCharacter(FontWriting* fontWriting, const FontWritingLetterStep** pLetterStep) {
     if (pLetterStep) *pLetterStep = nullptr;
     auto* writing = GetWritingData(fontWriting);
-    if (!writing || !writing->hasCurrentStep || !writing->storage || writing->currentIndex >= writing->storage->characters.size()) return nullptr;
+    if (!writing || !writing->hasCurrentStep || !writing->hasCurrentCharacter || !writing->storage || writing->currentIndex >= writing->storage->characters.size()) return nullptr;
+    writing->hasCurrentCharacter = false;
     auto& letterStep = writing->letterStep;
     letterStep = {};
     letterStep.x = writing->step.x;
diff --git a/core/libs/tests/GuestFont.cpp b/core/libs/tests/GuestFont.cpp
index ef5ea31984..093c88fe45 100644
--- a/core/libs/tests/GuestFont.cpp
+++ b/core/libs/tests/GuestFont.cpp
@@ -671,11 +671,31 @@ int main() {
     Require(step != nullptr);
     Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == characters && out.letter != nullptr && out.guard == guard);
     Require(out.letter->x == step->x && out.letter->advanceX == step->advanceX && out.letter->Components.textsIndex == 0 && out.letter->Components.characterTextCount == 1);
+    const FontWritingLetterStep* retainedLetter = out.letter;
+    const FontWritingLetterStep retainedValue = *retainedLetter;
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr && out.guard == guard);
+    Require(std::memcmp(retainedLetter, &retainedValue, sizeof(retainedValue)) == 0);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == nullptr);
     step = sceFontWritingRefersRenderStep(&writing);
     Require(step != nullptr);
     Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == characters + 1 && out.guard == guard);
     Require(out.letter->x == step->x && out.letter->Components.textsIndex == 1 && out.letter->Components.glyphsIndex == 1);
-    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == characters + 1);
+    Require(out.letter == retainedLetter);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == nullptr);
+    out.letter = retainedLetter;
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr && out.guard == guard);
+    Require(sceFontWritingRefersRenderStep(&writing) == nullptr);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
+    Require(sceFontWritingInit(&writing, string, characters) == SCE_FONT_OK);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
+    Require(sceFontWritingRefersRenderStep(&writing) != nullptr);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, nullptr) == characters);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
+    Require(sceFontWritingInit(&writing, string, characters) == SCE_FONT_OK);
+    Require(sceFontWritingRefersRenderStep(&writing) != nullptr);
+    Require(sceFontWritingRefersRenderStep(&writing) != nullptr);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == characters + 1 && out.letter == retainedLetter && out.guard == guard);
+    Require(sceFontWritingRefersRenderStepCharacter(&writing, &out.letter) == nullptr && out.letter == nullptr);
     Require(sceFontDestroyString(&string) == SCE_FONT_OK);
     CheckTextCodes(&memory, font);
     Require(sceFontCloseFont(font) == SCE_FONT_OK);
diff --git a/docs/dev/debt/libSceFont.md b/docs/dev/debt/libSceFont.md
index 7837f059cc..8e03c2ab2f 100644
--- a/docs/dev/debt/libSceFont.md
+++ b/docs/dev/debt/libSceFont.md
@@ -12,7 +12,7 @@
 - [sceFontGetFontGlyphsCount, sceFontGetCharGlyphCode](../../../core/libs/prx/libSceFont/src/Open.cpp): signatures, error precedence, failed-output clearing and external-font glyph-code encoding are confirmed by the PS5 library. Multi-face system-font glyph counts, face-selection bits and typographic glyph substitutions are not modeled.
 - [sceFontGetFontResolution](../../../core/libs/prx/libSceFont/src/Open.cpp): the 32-bit resolution output, float scale and nullable outputs are confirmed by the PS5 library and FontFt driver. Native system font sets return resolution 1000; the host still uses its selected face resolution because multi-face system font sets are not modeled.
 - [Writing-line ABI and allocation](../../../core/libs/prx/libSceFont/src/WritingLine.cpp): PS5 layouts, creation forms, memory validation, allocator callbacks and error handling are recovered. The 2208-byte line and 64-byte orders use caller memory. Host registry bookkeeping still allocates separately; memory lifetime and concurrent destruction require caller synchronization.
-- [sceFontWritingRefersRenderStepCharacter](../../../core/libs/prx/libSceFont/src/Text.cpp) (libSceFont) - the second argument is an out pointer to the writing's letter step, as in [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1882-L1896) and the [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Font/SceFont.Engine.cs) bindings. Measured on PS4 firmware 11.00 `libSceFont.sprx` (not on a PS5): exactly 8 bytes are written, the address of a step stored inside the writing, and a null writing writes null; shadPS4 and prosper treat the argument as a struct, which the measurement contradicts. The letter step lives in the writing, so the pointer stays valid as long as the writing does, and its contents are rebuilt by each call of this function. On the PS4 library repeated calls on one step walk the characters it covers and then return null; here every call returns the step's one character, so the second call differs. Assumed: each step covers one character and one glyph. PPSA06699 (Hot Shots Golf 2) dereferences the returned pointer for its character counts.
+- [sceFontWritingRefersRenderStepCharacter](../../../core/libs/prx/libSceFont/src/Text.cpp): PS5 traversal and multi-character shaping remain unverified; the host has one character and glyph per step. PS4 11.00 measurements establish an 8-byte pointer output into the writing, null for a null writing, and traversal to null after the current step is exhausted. The pointer ABI agrees with [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1882-L1896) and SharpProspero; shadPS4 and prosper instead treat the output as a struct. The internal letter step remains valid until writing destruction and is rebuilt when a character is returned.
 - [sceFontWritingLineGetOrderingSpace](../../../core/libs/prx/libSceFont/src/WritingLine.cpp): PS5 confirms output order, calculations and zeroed outputs on invalid handles. A non-null head output with a null tail output causes an unchecked native write; the host throws instead. With no head output, the tail output remains untouched.
 - [sceFontCharacterGetSyllableStringState](../../../core/libs/prx/libSceFont/src/Text.cpp) (libSceFont) - the signature `(textCharacter, int* syllableStringState)` follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/main/src/SharpProspero/Interop/Font/SceFont.Engine.cs). Measured on PS4 firmware 11.00 `libSceFont.sprx` (not on a PS5): the state is 0 for Latin, CJK, Hangul, Arabic, Hebrew, Devanagari and the other scripts tried, and the library sets 1, 3 or 4 (never 2 on real text) for Thai while it creates the string; a null character or a null result returns `SCE_FONT_ERROR_INVALID_PARAMETER`, and a null character writes 0 to a non-null result. This returns 0 for every character outside the Thai block (U+0E00 to U+0E7F), as [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1805-L1815) does, and throws for Thai characters, whose cluster states are not modelled. SharpProspero's `SceFontSyllableString` names 0 NonDetection, 1 Starting, 2 Following, 3 Depending and 4 Connecting. PPSA06699 (Hot Shots Golf 2) calls it.
 - [sceFontCharactersRefersTextCodes, sceFontTextCodesStepNext and sceFontTextCodesStepBack](../../../core/libs/prx/libSceFont/src/Text.cpp) (libSceFont) - the signatures follow the [Orbital](https://github.com/AlexAltea/orbital/blob/cc408367da6a6ebbf5ac1ac559fefeadc73b2831/tools/ida/db_types.json#L679) IDA type database and [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Font/SceFont.Engine.cs#L395-L406), and the 64-byte `FontTextCodes` with the order pointer at 0 and the code at 8 follows SharpProspero's [SceFontTextCodes](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Font/SceFontStructs.cs#L216-L228). The traversal follows the PS4 11.00 `libSceFont.sprx` disassembly posted in [#4050](https://github.com/boykopovar/AnyPS5/pull/4050#issuecomment-6114504202), not a PS5 measurement: the cursor keeps the current, start and term characters at +0x28, +0x30 and +0x38; `Refers` never compares the character with the term and returns null for a clustered or synthetic character; `StepNext` returns null at the term after visiting it; `StepBack` returns null when the current character is the start; both steps skip synthetic characters. Assumed and not covered by the report, which says `StepNext` returns null only at the term: `StepNext` also returns null at the end of the chain (for example with a null term), and `StepBack` at the head of the chain. A null cursor or output returns null as in [KytyPS5](https://github.com/KytyPS5/KytyPS5/blob/d2413fc2ebd91d1b7234197c2dd5bd48e1cb6a51/src/libs/libFont.cpp#L1696-L1740); a null text character throws, as its console result is unknown

From a8cf7dd75fd08073f2ae0955e6343801fac3251c Mon Sep 17 00:00:00 2001
From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com>
Date: Sun, 25 Oct 2026 10:16:51 +0000
Subject: [PATCH 109/218] fix(libkernel): skip the sysctl copy-out when no
 bytes are copied

CopyOut passed a null source to memcpy for the kern.proc.env query, which reports no data. The copy length is 0 there, but a null source is undefined behavior for memcpy whatever the length, and UBSan reports it in guest_system_configuration. Copy only when there is something to copy.
---
 core/libs/prx/libkernel/System/src/SystemConfiguration.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp b/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
index 7abef3192e..33e7920ef8 100644
--- a/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
+++ b/core/libs/prx/libkernel/System/src/SystemConfiguration.cpp
@@ -32,7 +32,7 @@ int CopyOut(const void* value, std::size_t size, void* oldValue, std::size_t* ol
         return 0;
     }
     const std::size_t copied = std::min(oldLength != nullptr ? *oldLength : 0, size);
-    std::memcpy(oldValue, value, copied);
+    if (copied != 0) std::memcpy(oldValue, value, copied);
     if (oldLength != nullptr) *oldLength = copied;
     if (copied < size) {
         *__error_nid_postfix() = 12;

From 66473085c2e7a82a76de6a5938abaae471f18ec0 Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:21:16 +0100
Subject: [PATCH 110/218] fix(relinker): accept a Linux entry in a PT_LOAD
 without flags

The Linux output maps a PT_LOAD whose p_flags is 0 as RWX, so the
e_entry check now accepts an entry inside such a segment instead of
rejecting it. A new test case relinks that input in both Linux modes
and checks that the output maps the entry's segment RWX. The
R_X86_64_NONE skip in the relocation offset loop is removed, together
with its none-outside case, because extractRela drops NONE before the
relocation tables are rebuilt.
---
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp  |  5 ++--
 .../relinker/tests/test_linux_load_bounds.py  | 29 ++++++++++++++++---
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 2817ea4271..32a7cf27ba 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -106,7 +106,7 @@ void RequireFileRange(const std::vector<std::uint8_t>& buf, const Domain::Progra
 
 void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std::uint64_t address, const std::uint64_t size, const std::uint32_t flags, const std::string& what) {
     for (const auto& header : headers)
-        if (header.Type == PT_LOAD && (header.Flags & flags) == flags && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
+        if (header.Type == PT_LOAD && (header.Flags == 0 || (header.Flags & flags) == flags) && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
             return;
     const auto range = size > 1 ? " (" + std::to_string(size) + " bytes) does not fit inside " : std::string(" is not inside ");
     throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
@@ -375,8 +375,7 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     RequireLoaded(originalHeaders, Io::ReadU64(sourceElf, kEhdrEntryOffset), 1, PF_X, "e_entry");
     for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
         for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
-            if (static_cast<std::uint32_t>(Io::ReadU64(*relocationTable, entry + 8)) != R_X86_64_NONE)
-                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
+            RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
     if (!dynSection.RelaPltData.empty())
         RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
index 49e9a994c4..687e95ae2b 100644
--- a/core/relinker/relinker/tests/test_linux_load_bounds.py
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -11,14 +11,18 @@ from test_jmprel_table_bounds import fixture
 
 PT_LOAD = 1
 PT_SCE_RELRO = 0x61000010
+PF_X = 1
 PF_W = 2
 PF_R = 4
 R_X86_64_PC32 = 2
 R_X86_64_32 = 10
 E_ENTRY = 24
+FIRST_LOAD_FLAGS = 64 + 4
 SPARE_HEADER = 64 + 3 * 56
 PLTGOT_VALUE = 0x400 + 9 * 16 + 8
 OUTSIDE = 0x2000
+ENTRY = 0x200
+FIXED_BASE = 0x400000
 
 
 def with_bss(image):
@@ -41,6 +45,18 @@ def with_pltgot(image, value):
     return image
 
 
+def without_load_flags(image):
+    struct.pack_into("<I", image, FIRST_LOAD_FLAGS, 0)
+    return image
+
+
+def load_flags_at(elf, address):
+    phoff, = struct.unpack_from("<Q", elf, 0x20)
+    phentsize, phnum = struct.unpack_from("<HH", elf, 0x36)
+    headers = [struct.unpack_from("<IIQQQQQQ", elf, phoff + index * phentsize) for index in range(phnum)]
+    return [header[1] for header in headers if header[0] == PT_LOAD and header[3] <= address < header[3] + header[6]]
+
+
 def relink(relinker, work, name, image, options, error):
     source = work / (name + ".elf")
     output = work / (name + ".out")
@@ -49,10 +65,12 @@ def relink(relinker, work, name, image, options, error):
                             capture_output=True, text=True, timeout=20)
     if error is None:
         assert result.returncode == 0 and output.exists(), (name, options, result.returncode, result.stdout, result.stderr)
+        elf = output.read_bytes()
         output.unlink()
-    else:
-        assert result.returncode == 2 and error in result.stderr and not output.exists(), (
-            name, options, result.returncode, result.stdout, result.stderr)
+        return elf
+    assert result.returncode == 2 and error in result.stderr and not output.exists(), (
+        name, options, result.returncode, result.stdout, result.stderr)
+    return None
 
 
 def main():
@@ -61,7 +79,6 @@ def main():
         ("plt-valid", fixture(linux=True), None),
         ("rela-valid", fixture(linux=True, data_relocations=True), None),
         ("rela-in-bss", with_bss(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
-        ("none-outside", fixture(linux=True, data_relocations=True, relocation_type=0, symbol_index=0, target=OUTSIDE), None),
         ("rela-in-relro", with_relro(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
         ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
         ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
@@ -84,6 +101,10 @@ def main():
         for name, image, error in cases:
             for options in ([], ["--lazy-binding"]):
                 relink(relinker, work, name, image, options, error)
+        for options, base in (([], FIXED_BASE), (["--lazy-binding"], 0)):
+            elf = relink(relinker, work, "entry-in-flagless-load", without_load_flags(fixture(linux=True)), options, None)
+            flags = load_flags_at(elf, base + ENTRY)
+            assert flags == [PF_R | PF_W | PF_X], ("entry-in-flagless-load", options, flags)
         pltgot_cases = [
             ("pltgot-outside", OUTSIDE, "DT_PLTGOT 0x2000 (8 bytes) does not fit inside a PT_LOAD segment",
              "DT_PLTGOT 0x2000 (24 bytes) does not fit inside a PT_LOAD segment"),

From 1038e02b95b921cc678e705b42a8f36b3c265d0d Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:52:59 +0300
Subject: [PATCH 111/218] feat(libSceNpTus): complete the synchronous data and
 variable reads offline

---
 core/libs/prx/libSceNpTus/Export.cpp | 29 ++++++++++++----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

diff --git a/core/libs/prx/libSceNpTus/Export.cpp b/core/libs/prx/libSceNpTus/Export.cpp
index 6bf0782927..c25fd280bd 100644
--- a/core/libs/prx/libSceNpTus/Export.cpp
+++ b/core/libs/prx/libSceNpTus/Export.cpp
@@ -347,11 +347,6 @@ int APS5_VABI sceNpTusGetDataForCrossSaveVUserAsync(void) {
     return 0;
 }
 
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpTusGetFriendsVariableA(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
@@ -694,6 +689,10 @@ int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveAsync(int reqId, const std
     return StartOffline(reqId);
 }
 
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusGetMultiUserVariableForCrossSaveAsync(reqId, targetAccountIdArray, slotId, variableArray, variableArraySize, arrayLen, option));
+}
+
 int APS5_VABI sceNpTusGetMultiUserVariableForCrossSaveVUserAsync(int reqId, const NpOnlineId* targetVirtualUserIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
     (void)variableArraySize;
     if (!targetVirtualUserIdArray || !variableArray) return SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT;
@@ -1007,24 +1006,20 @@ int APS5_VABI sceNpTusCreateNpTitleCtx() {
     return 0;
 }
 
-int APS5_VABI sceNpTusGetData() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetData(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option) {
+    return Complete(reqId, sceNpTusGetDataAsync(reqId, targetNpId, slotId, dataStatus, dataStatusSize, data, recvSize, option));
 }
 
-int APS5_VABI sceNpTusGetDataVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option) {
+    return Complete(reqId, sceNpTusGetDataVUserAsync(reqId, targetVirtualUserId, slotId, dataStatus, dataStatusSize, data, recvSize, option));
 }
 
-int APS5_VABI sceNpTusGetMultiSlotVariable() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusGetMultiSlotVariableAsync(reqId, targetNpId, slotIds, variableArray, variableArraySize, arrayLen, option));
 }
 
-int APS5_VABI sceNpTusGetMultiSlotVariableVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusGetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusGetMultiSlotVariableVUserAsync(reqId, targetVirtualUserId, slotIds, variableArray, variableArraySize, arrayLen, option));
 }
 
 int APS5_VABI sceNpTusSetData() {

From d390908d1851732525369ebf27b9eb2a38d29f4d Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:52:59 +0300
Subject: [PATCH 112/218] feat(libSceNpTus): complete the synchronous data and
 variable writes offline

---
 core/libs/prx/libSceNpTus/Export.cpp | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/core/libs/prx/libSceNpTus/Export.cpp b/core/libs/prx/libSceNpTus/Export.cpp
index c25fd280bd..2f632e6d18 100644
--- a/core/libs/prx/libSceNpTus/Export.cpp
+++ b/core/libs/prx/libSceNpTus/Export.cpp
@@ -1022,24 +1022,20 @@ int APS5_VABI sceNpTusGetMultiSlotVariableVUser(int reqId, const NpOnlineId* tar
     return Complete(reqId, sceNpTusGetMultiSlotVariableVUserAsync(reqId, targetVirtualUserId, slotIds, variableArray, variableArraySize, arrayLen, option));
 }
 
-int APS5_VABI sceNpTusSetData() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetData(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option) {
+    return Complete(reqId, sceNpTusSetDataAsync(reqId, targetNpId, slotId, totalSize, sendSize, data, info, infoStructSize, isLastChangedAuthor, isLastChangedDate, option));
 }
 
-int APS5_VABI sceNpTusSetDataVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option) {
+    return Complete(reqId, sceNpTusSetDataVUserAsync(reqId, targetVirtualUserId, slotId, totalSize, sendSize, data, info, infoStructSize, isLastChangedAuthor, isLastChangedDate, option));
 }
 
-int APS5_VABI sceNpTusSetMultiSlotVariable() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusSetMultiSlotVariableAsync(reqId, targetNpId, slotIds, variableArray, arrayLen, option));
 }
 
-int APS5_VABI sceNpTusSetMultiSlotVariableVUser() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpTusSetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option) {
+    return Complete(reqId, sceNpTusSetMultiSlotVariableVUserAsync(reqId, targetVirtualUserId, slotIds, variableArray, arrayLen, option));
 }
 
 }

From cd92335cb7fec4d6d7f125eda36544ab1e569ea7 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:53:41 +0300
Subject: [PATCH 113/218] test(libSceNpTus): check the synchronous data and
 variable calls offline

---
 core/libs/prx/libSceNpTus/include/Api.hpp | 16 ++++++++--------
 core/libs/tests/GuestNpTusOffline.cpp     | 18 +++++++++++++++++-
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/core/libs/prx/libSceNpTus/include/Api.hpp b/core/libs/prx/libSceNpTus/include/Api.hpp
index b4e6807d5e..8ec3a859aa 100644
--- a/core/libs/prx/libSceNpTus/include/Api.hpp
+++ b/core/libs/prx/libSceNpTus/include/Api.hpp
@@ -138,13 +138,13 @@ int APS5_VABI sceNpTusTryAndSetVariableForCrossSaveVUser(int reqId, const NpOnli
 int APS5_VABI sceNpTusTryAndSetVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::int32_t opeType, std::int64_t variable, const std::int64_t* compareValue, const void* isLastChangedAuthor, const void* isLastChangedDate, void* resultVariable, std::uint64_t resultVariableSize, void* option);
 int APS5_VABI sceNpTssGetData();
 int APS5_VABI sceNpTusCreateNpTitleCtx();
-int APS5_VABI sceNpTusGetData();
-int APS5_VABI sceNpTusGetDataVUser();
-int APS5_VABI sceNpTusGetMultiSlotVariable();
-int APS5_VABI sceNpTusGetMultiSlotVariableVUser();
-int APS5_VABI sceNpTusSetData();
-int APS5_VABI sceNpTusSetDataVUser();
-int APS5_VABI sceNpTusSetMultiSlotVariable();
-int APS5_VABI sceNpTusSetMultiSlotVariableVUser();
+int APS5_VABI sceNpTusGetData(int reqId, const void* targetNpId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, void* dataStatus, std::uint64_t dataStatusSize, void* data, std::uint64_t recvSize, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusGetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetData(int reqId, const void* targetNpId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetDataVUser(int reqId, const NpOnlineId* targetVirtualUserId, std::int32_t slotId, std::uint64_t totalSize, std::uint64_t sendSize, const void* data, const void* info, std::uint64_t infoStructSize, const void* isLastChangedAuthor, const void* isLastChangedDate, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariable(int reqId, const void* targetNpId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
+int APS5_VABI sceNpTusSetMultiSlotVariableVUser(int reqId, const NpOnlineId* targetVirtualUserId, const std::int32_t* slotIds, const std::int64_t* variableArray, int arrayLen, void* option);
 
 }
diff --git a/core/libs/tests/GuestNpTusOffline.cpp b/core/libs/tests/GuestNpTusOffline.cpp
index 565dcceaa4..d4157cb607 100644
--- a/core/libs/tests/GuestNpTusOffline.cpp
+++ b/core/libs/tests/GuestNpTusOffline.cpp
@@ -1,4 +1,4 @@
-#include "prx/libSceNpTus/include/Api.hpp"
+#include "prx/libSceNpTus/libSceNpTus.hpp"
 #include "SceTypes.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -24,6 +24,7 @@ NpOnlineId emptyUser{};
 unsigned char npIds[2][64];
 std::uint64_t accounts[2] = {1, 2};
 std::int32_t slots[2] = {1, 2};
+std::int64_t variables[2] = {5, 6};
 std::int32_t manySlots[65] = {};
 std::uint64_t length = 0;
 int failures = 0;
@@ -128,9 +129,11 @@ int main() {
     CheckSync("sceNpTusAddAndGetVariableVUser", [&](int req) { return sceNpTusAddAndGetVariableVUser(req, &virtualUser, 1, 5, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusDeleteMultiSlotData", [&](int req) { return sceNpTusDeleteMultiSlotData(req, &npId, slots, 2, nullptr); });
     CheckSync("sceNpTusDeleteMultiSlotDataA", [&](int req) { return sceNpTusDeleteMultiSlotDataA(req, 1, slots, 2, nullptr); });
+    CheckSync("sceNpTusGetData", [&](int req) { return sceNpTusGetData(req, &npId, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetDataA", [&](int req) { return sceNpTusGetDataA(req, 1, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetDataAVUser", [&](int req) { return sceNpTusGetDataAVUser(req, &virtualUser, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetDataForCrossSave", [&](int req) { return sceNpTusGetDataForCrossSave(req, 1, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
+    CheckSync("sceNpTusGetDataVUser", [&](int req) { return sceNpTusGetDataVUser(req, &virtualUser, 1, buffer, sizeof(buffer), buffer, 16, nullptr); });
     CheckSync("sceNpTusGetFriendsDataStatus", [&](int req) { return sceNpTusGetFriendsDataStatus(req, 1, 0, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetFriendsVariable", [&](int req) { return sceNpTusGetFriendsVariable(req, 1, 0, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiSlotDataStatus", [&](int req) { return sceNpTusGetMultiSlotDataStatus(req, &npId, slots, buffer, sizeof(buffer), 2, nullptr); });
@@ -139,6 +142,8 @@ int main() {
     CheckSync("sceNpTusGetMultiSlotDataStatusForCrossSave", [&](int req) { return sceNpTusGetMultiSlotDataStatusForCrossSave(req, 1, slots, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiSlotDataStatusForCrossSaveVUser", [&](int req) { return sceNpTusGetMultiSlotDataStatusForCrossSaveVUser(req, &virtualUser, slots, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiSlotDataStatusVUser", [&](int req) { return sceNpTusGetMultiSlotDataStatusVUser(req, &virtualUser, slots, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusGetMultiSlotVariable", [&](int req) { return sceNpTusGetMultiSlotVariable(req, &npId, slots, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusGetMultiSlotVariableVUser", [&](int req) { return sceNpTusGetMultiSlotVariableVUser(req, &virtualUser, slots, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserDataStatus", [&](int req) { return sceNpTusGetMultiUserDataStatus(req, npIds, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserDataStatusA", [&](int req) { return sceNpTusGetMultiUserDataStatusA(req, accounts, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserDataStatusAVUser", [&](int req) { return sceNpTusGetMultiUserDataStatusAVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
@@ -148,16 +153,27 @@ int main() {
     CheckSync("sceNpTusGetMultiUserVariable", [&](int req) { return sceNpTusGetMultiUserVariable(req, npIds, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableA", [&](int req) { return sceNpTusGetMultiUserVariableA(req, accounts, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableAVUser", [&](int req) { return sceNpTusGetMultiUserVariableAVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusGetMultiUserVariableForCrossSave", [&](int req) { return sceNpTusGetMultiUserVariableForCrossSave(req, accounts, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableForCrossSaveVUser", [&](int req) { return sceNpTusGetMultiUserVariableForCrossSaveVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
     CheckSync("sceNpTusGetMultiUserVariableVUser", [&](int req) { return sceNpTusGetMultiUserVariableVUser(req, virtualUsers, 1, buffer, sizeof(buffer), 2, nullptr); });
+    CheckSync("sceNpTusSetData", [&](int req) { return sceNpTusSetData(req, &npId, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
     CheckSync("sceNpTusSetDataA", [&](int req) { return sceNpTusSetDataA(req, 1, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
     CheckSync("sceNpTusSetDataAVUser", [&](int req) { return sceNpTusSetDataAVUser(req, &virtualUser, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
+    CheckSync("sceNpTusSetDataVUser", [&](int req) { return sceNpTusSetDataVUser(req, &virtualUser, 1, 16, 8, buffer, buffer, sizeof(buffer), nullptr, nullptr, nullptr); });
+    CheckSync("sceNpTusSetMultiSlotVariable", [&](int req) { return sceNpTusSetMultiSlotVariable(req, &npId, slots, variables, 2, nullptr); });
+    CheckSync("sceNpTusSetMultiSlotVariableVUser", [&](int req) { return sceNpTusSetMultiSlotVariableVUser(req, &virtualUser, slots, variables, 2, nullptr); });
     CheckSync("sceNpTusTryAndSetVariable", [&](int req) { return sceNpTusTryAndSetVariable(req, &npId, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableA", [&](int req) { return sceNpTusTryAndSetVariableA(req, 1, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableAVUser", [&](int req) { return sceNpTusTryAndSetVariableAVUser(req, &virtualUser, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableForCrossSave", [&](int req) { return sceNpTusTryAndSetVariableForCrossSave(req, 1, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableForCrossSaveVUser", [&](int req) { return sceNpTusTryAndSetVariableForCrossSaveVUser(req, &virtualUser, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
     CheckSync("sceNpTusTryAndSetVariableVUser", [&](int req) { return sceNpTusTryAndSetVariableVUser(req, &virtualUser, 1, 1, 5, nullptr, nullptr, nullptr, buffer, sizeof(buffer), nullptr); });
+    {
+        const int req = NewRequest();
+        Require(sceNpTusGetData(req, &npId, 1, buffer, sizeof(buffer), buffer, 16, &buffer) == InvalidArgument, "sceNpTusGetData", "an option was not refused before waiting");
+        Require(sceNpTusSetMultiSlotVariable(req, &npId, manySlots, reinterpret_cast<const std::int64_t*>(buffer), 65, nullptr) == TooManySlotId, "sceNpTusSetMultiSlotVariable", "65 slots were not refused before waiting");
+        sceNpTusDeleteRequest(req);
+    }
     {
         int req = NewRequest();
         Require(sceNpTusAddAndGetVariableVUserAsync(req, &emptyUser, 1, 5, nullptr, nullptr, buffer, sizeof(buffer), nullptr) == InvalidArgument, "sceNpTusAddAndGetVariableVUserAsync", "an empty virtual user was taken");

From b9420dfa1b6d3dd19041120496905537cce6e75c Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:54:00 +0300
Subject: [PATCH 114/218] docs(debt): note the blocking NpTus data and variable
 calls

---
 docs/dev/debt/libSceNpTus.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceNpTus.md b/docs/dev/debt/libSceNpTus.md
index cb413bbf34..142eda2d11 100644
--- a/docs/dev/debt/libSceNpTus.md
+++ b/docs/dev/debt/libSceNpTus.md
@@ -16,7 +16,6 @@
 - [sceNpTssGetDataAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetDataForCrossSaveVUser](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetDataForCrossSaveVUserAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
-- [sceNpTusGetMultiUserVariableForCrossSave](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetFriendsVariableA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetFriendsVariableAAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
 - [sceNpTusGetFriendsVariableForCrossSave](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - unknown signature
@@ -32,3 +31,4 @@
 - [sceNpTusCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - creates a title context without checking sign-in, up to 32 contexts (`TOO_MANY_OBJECTS` beyond); shadPS4 returns the `sceNpGetNpId` error instead. Requests are limited to 256, and the limits are not measured on a console.
 - [sceNpTssCreateNpTitleCtx and sceNpTssCreateNpTitleCtxA](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - that TSS title contexts share the TUS context table and its 32-context limit is inferred from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/np/np_tus/np_tus.cpp#L146-L168), which redirects both to the TUS creators, and from TSS requests coming from `sceNpTusCreateRequest`; nothing is measured on a console. The `A` form is `sceNpTusCreateNpTitleCtxA`. The `NpId` form returns `INSUFFICIENT_ARGUMENT` for a null `npId` and `INVALID_ARGUMENT` for service label `0xFFFFFFFF` before the limit, as shadPS4's [sceNpTusCreateNpTitleCtx](https://github.com/shadps4-emu/shadPS4/blob/615bcba5e21b82dc59588575f7ecbce8da09ca2c/src/core/libraries/np/np_tus/np_tus.cpp#L122-L143) does; the signatures are shadPS4's and fpPS4's, and Orbital's for the `A` form.
 - [sceNpTusPollAsync, sceNpTusWaitAsync](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - there is no PSN, so every implemented `*Async` call whose arguments pass the checks starts a request that finishes at once with `SCE_NP_ERROR_SIGNED_OUT`, which poll and wait report and the blocking calls return; shadPS4 returns `SIGNED_OUT` from the `*Async` call itself when no shadNet client is signed in, and RPCS3 returns `INVALID_ONLINE_ID` while offline, marked there as probable behaviour. An abort stays set, so every later operation on the request, blocking ones included, finishes with `ABORTED`; in shadPS4 an abort only ends the operation in progress. Until an operation has started, poll returns 1 and wait returns `INVALID_ARGUMENT` as in shadPS4; RPCS3 [blocks until a result is set](https://github.com/RPCS3/rpcs3/blob/1a9dca3a3a84a18df866e3021918322bd295160a/rpcs3/Emu/NP/np_contexts.cpp#L40-L52).
+- [sceNpTusGetData, sceNpTusGetDataVUser, sceNpTusGetMultiSlotVariable, sceNpTusGetMultiSlotVariableVUser, sceNpTusGetMultiUserVariableForCrossSave, sceNpTusSetData, sceNpTusSetDataVUser, sceNpTusSetMultiSlotVariable and sceNpTusSetMultiSlotVariableVUser](../../../core/libs/prx/libSceNpTus/Export.cpp) (libSceNpTus) - block on their `*Async` forms with the same parameters, as [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/np/np_tus/np_tus.cpp) does, so they inherit those forms' unmeasured checks and the offline `SIGNED_OUT` result

From c2652b88ca5cd7bf64e1d9a9a76d0e3b1eb814a1 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:32:57 +0300
Subject: [PATCH 115/218] feat(libkernel_sys): report a retail console from
 sceKernelIsCEX and sceKernelIsDevKit

---
 core/libs/prx/libkernel_sys/Export.Discovery.cpp | 10 ----------
 core/libs/prx/libkernel_sys/Export.cpp           |  8 ++++++++
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index 3addcda651..bf1df5d5f0 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -1417,21 +1417,11 @@ int APS5_VABI sceKernelIsAuthenticNeo(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelIsCEX(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelIsDebuggerAttached(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
 }
 
-int APS5_VABI sceKernelIsDevKit(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelIsExperimentalBeta(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index 4125e11eea..a0a7f0f467 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -337,6 +337,14 @@ std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask) {
     return File::ExchangeCreationMask_nid_no_patch(mask);
 }
 
+int APS5_VABI sceKernelIsCEX(void) {
+    return 1;
+}
+
+int APS5_VABI sceKernelIsDevKit(void) {
+    return 0;
+}
+
 int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf) {
     return _fstatfs_nid_postfix(d, buf);
 }

From cd94200d5fd9821989e80d2d1640c3d041a7ce19 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:32:57 +0300
Subject: [PATCH 116/218] feat(libkernel_sys): describe the guest process
 through get_authinfo

---
 .../libs/prx/libkernel_sys/Export.Discovery.cpp |  5 -----
 core/libs/prx/libkernel_sys/Export.cpp          | 17 +++++++++++++++++
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index bf1df5d5f0..76361d486d 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -67,11 +67,6 @@ int APS5_VABI futimesat_nid_postfix(void) {
     return 0;
 }
 
-int APS5_VABI get_authinfo_nid_postfix(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI get_module_info_list_nid_postfix(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index a0a7f0f467..56edb6de2d 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -62,6 +62,7 @@ static int GuestFstat(int fd, bool* withoutVnode = nullptr) {
 
 constexpr int GuestEnoent = 2;
 constexpr int GuestEperm = 1;
+constexpr int GuestEsrch = 3;
 constexpr int GuestEio = 5;
 constexpr int GuestEbadf = 9;
 constexpr int GuestEfault = 14;
@@ -126,6 +127,14 @@ int GuestFileError(int error) {
     }
 }
 
+struct KernelAuthInfo {
+    std::uint64_t programAuthorityId;
+    std::uint64_t capabilities[4];
+    std::uint64_t attributes[4];
+    std::uint64_t credentials[8];
+};
+static_assert(sizeof(KernelAuthInfo) == 0x88);
+
 std::int64_t Fail(int error) {
     *__error_nid_postfix() = error;
     return -1;
@@ -345,6 +354,14 @@ int APS5_VABI sceKernelIsDevKit(void) {
     return 0;
 }
 
+int APS5_VABI get_authinfo_nid_postfix(int pid, KernelAuthInfo* info) {
+    if (info == nullptr) return static_cast<int>(Fail(GuestEperm));
+    if (pid != 0 && pid != getpid_nid_postfix()) return static_cast<int>(Fail(GuestEsrch));
+    *info = {};
+    info->capabilities[0] = 0x2000000000000000;
+    return 0;
+}
+
 int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf) {
     return _fstatfs_nid_postfix(d, buf);
 }

From afa6f6dcbc99768dc74a9be885ea75fc6e4b1aa6 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:32:57 +0300
Subject: [PATCH 117/218] feat(libkernel_sys): return the OpenPSID from
 sceKernelGetOpenPsIdForSystem

---
 core/libs/prx/libkernel_sys/Export.Discovery.cpp | 5 -----
 core/libs/prx/libkernel_sys/Export.cpp           | 6 ++++++
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index 76361d486d..c7f6bc1e49 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -982,11 +982,6 @@ int APS5_VABI sceKernelGetMemoryPstate(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelGetOpenPsIdForSystem(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceKernelGetPagingStatsOfAllObjects(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;
diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index 56edb6de2d..c6504ce0ec 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -346,6 +346,12 @@ std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask) {
     return File::ExchangeCreationMask_nid_no_patch(mask);
 }
 
+int APS5_VABI sceKernelGetOpenPsId(void* id);
+
+int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id) {
+    return sceKernelGetOpenPsId(id);
+}
+
 int APS5_VABI sceKernelIsCEX(void) {
     return 1;
 }

From af7192f686ef69ca6cd3f013a5f6f0762ad040a5 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:33:45 +0300
Subject: [PATCH 118/218] test(libkernel_sys): check the console kind, auth
 info and system OpenPSID

---
 core/libs/CMakeLists.txt                      |  9 +++
 .../tests/GuestKernelSysConsoleIdentity.cpp   | 70 +++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 core/libs/tests/GuestKernelSysConsoleIdentity.cpp

diff --git a/core/libs/CMakeLists.txt b/core/libs/CMakeLists.txt
index eea852c88a..81720715b7 100644
--- a/core/libs/CMakeLists.txt
+++ b/core/libs/CMakeLists.txt
@@ -269,6 +269,15 @@ if(BUILD_TESTING)
         set_tests_properties(guest_kernel_sys_sdk_version PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
     endif()
+    add_test_executable(guest_kernel_sys_console_identity_tests tests/GuestKernelSysConsoleIdentity.cpp)
+    target_include_directories(guest_kernel_sys_console_identity_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
+    target_link_libraries(guest_kernel_sys_console_identity_tests PRIVATE libkernel_sys libkernel libc)
+    configure_windows_unwind(guest_kernel_sys_console_identity_tests)
+    add_test(NAME guest_kernel_sys_console_identity COMMAND guest_kernel_sys_console_identity_tests)
+    if(WIN32)
+        set_tests_properties(guest_kernel_sys_console_identity PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel_sys>")
+    endif()
     add_test_executable(nid_buffer_validation_tests nid/tests/BufferValidation.cpp)
     target_include_directories(nid_buffer_validation_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/nid/include)
     target_compile_features(nid_buffer_validation_tests PRIVATE cxx_std_20)
diff --git a/core/libs/tests/GuestKernelSysConsoleIdentity.cpp b/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
new file mode 100644
index 0000000000..14b664e133
--- /dev/null
+++ b/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
@@ -0,0 +1,70 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+
+extern "C" {
+int APS5_VABI sceKernelIsCEX(void);
+int APS5_VABI sceKernelIsDevKit(void);
+int APS5_VABI get_authinfo_nid_postfix(int pid, void* info);
+int APS5_VABI sceKernelGetOpenPsId(void* id);
+int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id);
+int APS5_VABI getpid_nid_postfix(void);
+int* APS5_VABI __error_nid_postfix(void);
+}
+
+namespace {
+
+constexpr int GuestEperm = 1;
+constexpr int GuestEsrch = 3;
+
+void Require(bool condition, const char* message) {
+    if (!condition) {
+        std::fprintf(stderr, "KERNEL SYS CONSOLE IDENTITY: %s\n", message);
+        std::abort();
+    }
+}
+
+void CheckConsoleKind() {
+    Require(sceKernelIsCEX() == 1, "the console must be reported as a retail unit");
+    Require(sceKernelIsDevKit() == 0, "the console must not be reported as a development kit");
+}
+
+void CheckAuthInfo() {
+    std::array<std::uint64_t, 18> info;
+    *__error_nid_postfix() = 0;
+    Require(get_authinfo_nid_postfix(0, nullptr) == -1 && *__error_nid_postfix() == GuestEperm, "a null result must fail with EPERM");
+    info.fill(0x5a5a5a5a5a5a5a5a);
+    *__error_nid_postfix() = 0;
+    Require(get_authinfo_nid_postfix(getpid_nid_postfix() + 1, info.data()) == -1 && *__error_nid_postfix() == GuestEsrch,
+            "another process must fail with ESRCH");
+    Require(info[0] == 0x5a5a5a5a5a5a5a5a, "a refused call must not write the result");
+    for (const int pid : {0, getpid_nid_postfix()}) {
+        info.fill(0x5a5a5a5a5a5a5a5a);
+        Require(get_authinfo_nid_postfix(pid, info.data()) == 0, "the guest process must be described");
+        Require(info[0] == 0 && info[1] == 0x2000000000000000, "the authority ID or first capability word is wrong");
+        for (std::size_t i = 2; i < 17; ++i) Require(info[i] == 0, "the rest of the result must be cleared");
+        Require(info[17] == 0x5a5a5a5a5a5a5a5a, "get_authinfo wrote past its 0x88-byte result");
+    }
+}
+
+void CheckOpenPsId() {
+    std::array<std::uint8_t, 16> plain{};
+    std::array<std::uint8_t, 24> system;
+    system.fill(0xa5);
+    Require(sceKernelGetOpenPsId(plain.data()) == 0, "the OpenPSID must be readable");
+    Require(sceKernelGetOpenPsIdForSystem(system.data()) == 0, "the system OpenPSID must be readable");
+    Require(std::memcmp(plain.data(), system.data(), plain.size()) == 0, "both OpenPSID queries must agree");
+    for (std::size_t i = plain.size(); i < system.size(); ++i) Require(system[i] == 0xa5, "the system OpenPSID wrote past 16 bytes");
+}
+
+}
+
+int main() {
+    CheckConsoleKind();
+    CheckAuthInfo();
+    CheckOpenPsId();
+    return 0;
+}

From 0d851dd1f3ee28f8e65aa802c5591a86c002edb8 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:33:58 +0300
Subject: [PATCH 119/218] docs(debt): note the retail console identity in
 libkernel_sys

---
 docs/dev/debt/libkernel_sys.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/dev/debt/libkernel_sys.md b/docs/dev/debt/libkernel_sys.md
index fd4084515b..e992912552 100644
--- a/docs/dev/debt/libkernel_sys.md
+++ b/docs/dev/debt/libkernel_sys.md
@@ -27,6 +27,7 @@
 - [fork](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws: creating a child process is not supported. PPSA19111 imports it and fails to load without it. Its engine calls `fork` in `Posix_Daemonize`, only with `-daemonize`, and in `Platform_ShellExecute` before `execvp("xdg-open")`, which the main menu's Previews button reaches, so pressing Previews ends in this throw. [setsid](../../../core/libs/prx/libkernel_sys/Export.cpp) fails with `EPERM`, as FreeBSD's does for a process group leader, since the guest is taken to lead its own process group (see `kill`). [umask](../../../core/libs/prx/libkernel_sys/Export.cpp) keeps the guest's mask (initially 022, masked to 07777) and returns the previous one, Linux named shared-memory creation applies it, but ordinary files are still created with the host process's mask
 - [sceKernelGetModuleInfoInternal and sceKernelGetModuleListInternal](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5
 - [chroot](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L776-L807) and [`pwd_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L3059-L3085) for a root caller: `EFAULT` for a null path, `ENOENT` for an empty or missing one, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255, and `ENOTDIR` for a path that is not a directory or passes through a file. A directory that is the guest root (`/`, `/..`, or `.` after `fchdir` to a descriptor of `/`) succeeds and changes nothing, as the root stays the same directory; the guest is taken never to have changed its root, so open directory descriptors do not make it fail with `EPERM` (`kern.chroot_allow_open_directories` 1). Any other directory throws, naming the path: the guest path resolver has a fixed root and mount aliases (`/app0`, `/savedata0`) that do not move with it. On the console a title starts in a sandbox root, where `pwd_chroot` refuses with `EPERM` while a directory is open; whether that holds for titles, and whether a title holds `PRIV_VFS_CHROOT`, are unverified. Porpoise (PPSA99764) weak-imports it and calls it only as `fchdir` to its saved descriptor of `/` then `chroot(".")`, to put its sandbox root back after a jailbreak daemon replaced it ([`put_root_back`](https://github.com/elripalda/Porpoise-Dolphin-Emulator-for-PS5/blob/2ed1ab5a06995aa198f7bccd4da0f90c3fc29d39/src/porpoise_jailbreak.cpp#L303-L331))
+- [sceKernelIsCEX, sceKernelIsDevKit, get_authinfo and sceKernelGetOpenPsIdForSystem](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - the guest always runs on a retail unit, as in [shadPS4's process.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/process.cpp) with its devkit option off. `get_authinfo` takes shadPS4's [kernel.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/kernel.cpp) errors and capability word, so the authority ID and the other capability, attribute and credential words stay 0. `sceKernelGetOpenPsIdForSystem` returns `sceKernelGetOpenPsId`'s value, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas) does; whether the console keeps a separate ID for system callers is not known. Not measured on a console
 - [fchown](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled: the guest's own owner and group (0) and the unchanged value (-1) are accepted, a descriptor that is not open fails with `EBADF`, and any other owner or group throws, naming it. The check reads the descriptor with `fstat`, ignoring the CRT's invalid-parameter handler on Windows as `DescriptorControl` does. The console's ownership rules are unverified. Morrowind (`mshivam019/morrowind-ps5`) imports it
 - [chown, lchown and fchownat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled, as for `fchown`: owner and group 0 and the unchanged value (-1) are accepted, and any other owner or group throws, naming it. The path is looked up first, as in FreeBSD 11's `kern_fchownat`, with `stat`, with `lstat` for `lchown`, and with `fstatat` for `fchownat`, so a lookup error is returned before the owner is checked and nothing is changed on the host. `fchownat` flags other than `AT_SYMLINK_NOFOLLOW` (0x200) return `EINVAL`, as in FreeBSD 11. The console's ownership rules are unverified
 - [linkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) resolves `AT_FDCWD` (-100) and absolute paths as `link` does, and flags other than `AT_SYMLINK_FOLLOW` (0x400) return `EINVAL`, as in FreeBSD 11. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. A symbolic link as the source without `AT_SYMLINK_FOLLOW` throws, where FreeBSD links the symbolic link itself. Console behaviour is unverified

From b78f4adba0c839dfd7c4229607259779a899b05f Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sun, 25 Oct 2026 13:06:35 +0200
Subject: [PATCH 120/218] fix(libSceNpTus): expose the cross-save wrapper
 signature

---
 core/libs/prx/libSceNpTus/include/Api.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/libs/prx/libSceNpTus/include/Api.hpp b/core/libs/prx/libSceNpTus/include/Api.hpp
index 8ec3a859aa..eacd0fe74a 100644
--- a/core/libs/prx/libSceNpTus/include/Api.hpp
+++ b/core/libs/prx/libSceNpTus/include/Api.hpp
@@ -45,7 +45,7 @@ int APS5_VABI sceNpTssGetStorageAsync(void);
 int APS5_VABI sceNpTssGetDataAsync(void);
 int APS5_VABI sceNpTusGetDataForCrossSaveVUser(void);
 int APS5_VABI sceNpTusGetDataForCrossSaveVUserAsync(void);
-int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(void);
+int APS5_VABI sceNpTusGetMultiUserVariableForCrossSave(int reqId, const std::uint64_t* targetAccountIdArray, std::int32_t slotId, void* variableArray, std::uint64_t variableArraySize, int arrayLen, void* option);
 int APS5_VABI sceNpTusGetFriendsVariableA(void);
 int APS5_VABI sceNpTusGetFriendsVariableAAsync(void);
 int APS5_VABI sceNpTusGetFriendsVariableForCrossSave(void);

From 3c13d609e5f18d61f36dbb038ff68d88f7421acd Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:26:42 +0300
Subject: [PATCH 121/218] feat(libSceNpParty): report no party from
 sceNpPartyGetMembers and sceNpPartyGetMemberInfo

---
 core/libs/prx/libSceNpParty/Export.cpp | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/core/libs/prx/libSceNpParty/Export.cpp b/core/libs/prx/libSceNpParty/Export.cpp
index 4f00ce3699..006075bde5 100644
--- a/core/libs/prx/libSceNpParty/Export.cpp
+++ b/core/libs/prx/libSceNpParty/Export.cpp
@@ -49,9 +49,8 @@ int APS5_VABI sceNpPartyGetId(void* id) {
     return notInParty(id);
 }
 
-int APS5_VABI sceNpPartyGetMemberInfo(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMemberInfo(std::uint16_t, void* memberInfo) {
+    return notInParty(memberInfo);
 }
 
 int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t, void* memberInfo) {
@@ -66,9 +65,8 @@ int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t, std::uint16_t, std::ui
     return notInParty(memberVoiceState);
 }
 
-int APS5_VABI sceNpPartyGetMembers(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpPartyGetMembers(void* memberList) {
+    return notInParty(memberList);
 }
 
 int APS5_VABI sceNpPartyGetMembersA(void* memberList) {

From 9e8212fb07ad1eb4c9abaffd72c8bf088182e638 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:26:42 +0300
Subject: [PATCH 122/218] feat(libSceNpParty): accept handlers through
 sceNpPartyRegisterHandler

---
 core/libs/prx/libSceNpParty/Export.cpp | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libSceNpParty/Export.cpp b/core/libs/prx/libSceNpParty/Export.cpp
index 006075bde5..971b894470 100644
--- a/core/libs/prx/libSceNpParty/Export.cpp
+++ b/core/libs/prx/libSceNpParty/Export.cpp
@@ -104,17 +104,16 @@ int APS5_VABI sceNpPartyLeave(void) {
     return 0;
 }
 
-int APS5_VABI sceNpPartyRegisterHandler(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
-
 int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void*) {
     if (!g_initialized) return NP_PARTY_ERROR_NOT_INITIALIZED;
     if (!handlers) return NP_PARTY_ERROR_INVALID_ARGUMENT;
     return 0;
 }
 
+int APS5_VABI sceNpPartyRegisterHandler(const void* handlers, void* userdata) {
+    return sceNpPartyRegisterHandlerA(handlers, userdata);
+}
+
 int APS5_VABI sceNpPartyRegisterPrivateHandler(void) {
     NotImplemented_nid_no_patch(__func__);
     return 0;

From 0686d360f46bfa1d340c7acf70f1bfb22f293d7f Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:27:02 +0300
Subject: [PATCH 123/218] test(libSceNpParty): cover the plain member queries
 and handler registration

---
 core/libs/prx/libSceNpParty/include/Api.hpp | 6 +++---
 core/libs/tests/GuestNpParty.cpp            | 9 ++++++++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/core/libs/prx/libSceNpParty/include/Api.hpp b/core/libs/prx/libSceNpParty/include/Api.hpp
index 6ac3a20bc7..8c8f33c8eb 100644
--- a/core/libs/prx/libSceNpParty/include/Api.hpp
+++ b/core/libs/prx/libSceNpParty/include/Api.hpp
@@ -9,11 +9,11 @@ int APS5_VABI sceNpPartyCheckCallback(void);
 int APS5_VABI sceNpPartyCreate(void);
 int APS5_VABI sceNpPartyCreateA(void);
 int APS5_VABI sceNpPartyGetId(void* id);
-int APS5_VABI sceNpPartyGetMemberInfo(void);
+int APS5_VABI sceNpPartyGetMemberInfo(std::uint16_t, void* memberInfo);
 int APS5_VABI sceNpPartyGetMemberInfoA(std::uint16_t, void* memberInfo);
 int APS5_VABI sceNpPartyGetMemberSessionInfo(std::uint16_t, void* memberGameSessionInfo);
 int APS5_VABI sceNpPartyGetMemberVoiceInfo(std::uint16_t, std::uint16_t, std::uint8_t* memberVoiceState);
-int APS5_VABI sceNpPartyGetMembers(void);
+int APS5_VABI sceNpPartyGetMembers(void* memberList);
 int APS5_VABI sceNpPartyGetMembersA(void* memberList);
 int APS5_VABI sceNpPartyGetStateAsUser(void);
 int APS5_VABI sceNpPartyGetStateAsUserA(std::int32_t, std::uint16_t* state);
@@ -21,7 +21,7 @@ int APS5_VABI sceNpPartyGetVoiceChatPriority(void);
 int APS5_VABI sceNpPartyInitialize(const void* param);
 int APS5_VABI sceNpPartyJoin(void);
 int APS5_VABI sceNpPartyLeave(void);
-int APS5_VABI sceNpPartyRegisterHandler(void);
+int APS5_VABI sceNpPartyRegisterHandler(const void* handlers, void* userdata);
 int APS5_VABI sceNpPartyRegisterHandlerA(const void* handlers, void*);
 int APS5_VABI sceNpPartyRegisterPrivateHandler(void);
 int APS5_VABI sceNpPartySendBinaryMessage(const void* sendParams);
diff --git a/core/libs/tests/GuestNpParty.cpp b/core/libs/tests/GuestNpParty.cpp
index fbda80be4a..2ee253c2b5 100644
--- a/core/libs/tests/GuestNpParty.cpp
+++ b/core/libs/tests/GuestNpParty.cpp
@@ -1,4 +1,4 @@
-#include "prx/libSceNpParty/include/Api.hpp"
+#include "prx/libSceNpParty/libSceNpParty.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdio>
@@ -34,11 +34,14 @@ bool lifecycleTests() {
     return check(sceNpPartyTerminate() == kNotInitialized, "terminate before initialize did not fail")
         && check(sceNpPartyCheckCallback() == kNotInitialized, "check callback before initialize did not fail")
         && check(sceNpPartyRegisterHandlerA(handlers, nullptr) == kNotInitialized, "register handler before initialize did not fail")
+        && check(sceNpPartyRegisterHandler(handlers, nullptr) == kNotInitialized, "the plain register handler before initialize did not fail")
         && check(sceNpPartyInitialize(nullptr) == kInvalidArgument, "a null initialize param was not refused")
         && check(sceNpPartyInitialize(param) == 0, "initialize failed")
         && check(sceNpPartyInitialize(param) == kAlreadyInitialized, "a second initialize did not fail")
         && check(sceNpPartyRegisterHandlerA(nullptr, nullptr) == kInvalidArgument, "null handlers were not refused")
         && check(sceNpPartyRegisterHandlerA(handlers, param) == 0, "register handler failed")
+        && check(sceNpPartyRegisterHandler(nullptr, nullptr) == kInvalidArgument, "null plain handlers were not refused")
+        && check(sceNpPartyRegisterHandler(handlers, param) == 0, "the plain register handler failed")
         && check(sceNpPartyCheckCallback() == 0, "check callback failed")
         && check(sceNpPartyTerminate() == 0, "terminate failed")
         && check(sceNpPartyTerminate() == kNotInitialized, "a second terminate did not fail")
@@ -55,6 +58,10 @@ bool notInPartyTests() {
         && check(sceNpPartyGetMembersA(out) == kNotInParty, "get members did not report NOT_IN_PARTY")
         && check(sceNpPartyGetMemberInfoA(1, nullptr) == kInvalidArgument, "a null member info was not refused")
         && check(sceNpPartyGetMemberInfoA(1, out) == kNotInParty, "get member info did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMembers(nullptr) == kInvalidArgument, "a null plain member list was not refused")
+        && check(sceNpPartyGetMembers(out) == kNotInParty, "the plain get members did not report NOT_IN_PARTY")
+        && check(sceNpPartyGetMemberInfo(1, nullptr) == kInvalidArgument, "a null plain member info was not refused")
+        && check(sceNpPartyGetMemberInfo(1, out) == kNotInParty, "the plain get member info did not report NOT_IN_PARTY")
         && check(sceNpPartyGetMemberSessionInfo(1, nullptr) == kInvalidArgument, "a null session info was not refused")
         && check(sceNpPartyGetMemberSessionInfo(1, out) == kNotInParty, "get session info did not report NOT_IN_PARTY")
         && check(sceNpPartyGetMemberVoiceInfo(1, 2, nullptr) == kInvalidArgument, "a null voice state was not refused")

From e4c41ba71a8d1eafee008f02a56db779f97588ee Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sat, 24 Oct 2026 10:27:02 +0300
Subject: [PATCH 124/218] docs(debt): note the fpPS4 signatures of the plain
 NpParty exports

---
 docs/dev/debt/libSceNpParty.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceNpParty.md b/docs/dev/debt/libSceNpParty.md
index e88c71d92d..8d6176415e 100644
--- a/docs/dev/debt/libSceNpParty.md
+++ b/docs/dev/debt/libSceNpParty.md
@@ -5,4 +5,5 @@
 - [sceNpPartyGetState and sceNpPartyGetStateAsUserA](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the 16-bit state, its `NOT_IN_PARTY` value 2 and the `INVALID_ARGUMENT` (`0x80552504`) error follow shadPS4's [np_party.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_party.h) and [np_error.h](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_error.h) (PS4); shadPS4 does not check for a null state, and whether the console needs an initialized party library first is not known. Not measured on a PS5
 - [sceNpPartyGetId, sceNpPartyGetMembersA, sceNpPartyGetMemberInfoA, sceNpPartyGetMemberSessionInfo, sceNpPartyGetMemberVoiceInfo and sceNpPartySendBinaryMessage](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the user is never in a party, so these return `NOT_IN_PARTY` (`0x80552506`, shadPS4's np_error.h) and write nothing, or `INVALID_ARGUMENT` for a null pointer; the signatures are from [Orbital's type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json). Like `sceNpPartyGetState` they do not require `sceNpPartyInitialize`, and the order of the null and party checks on the console is not known. Not measured on a PS5
 - [sceNpPartyInitialize, sceNpPartyTerminate, sceNpPartyCheckCallback and sceNpPartyRegisterHandlerA](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - an initialized flag with `ALREADY_INITIALIZED` (`0x80552502`) and `NOT_INITIALIZED` (`0x80552503`) from shadPS4's np_error.h; the handlers are accepted but never called, since no party event can happen. Whether the console refuses a null initialize parameter, and which check comes first, is not known
-- [sceNpPartyCreate, sceNpPartyCreateA, sceNpPartyGetMemberInfo, sceNpPartyGetMembers, sceNpPartyGetStateAsUser, sceNpPartyGetVoiceChatPriority, sceNpPartyJoin, sceNpPartyLeave, sceNpPartyRegisterHandler, sceNpPartyRegisterPrivateHandler, sceNpPartySetVoiceChatPriority, sceNpPartyShowInvitationList, sceNpPartyShowInvitationListA and sceNpPartyUnregisterPrivateHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - Orbital has no prototypes for these and no credible ones were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpPartyCreate, sceNpPartyCreateA, sceNpPartyGetStateAsUser, sceNpPartyGetVoiceChatPriority, sceNpPartyJoin, sceNpPartyLeave, sceNpPartyRegisterPrivateHandler, sceNpPartySetVoiceChatPriority, sceNpPartyShowInvitationList, sceNpPartyShowInvitationListA and sceNpPartyUnregisterPrivateHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - Orbital has no prototypes for these and no credible ones were found. The declarations have no parameters solely to resolve known imports; this is not an ABI claim and callers must not call them until signatures are verified
+- [sceNpPartyGetMembers, sceNpPartyGetMemberInfo and sceNpPartyRegisterHandler](../../../core/libs/prx/libSceNpParty/Export.cpp) (libSceNpParty) - the signatures are from [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/src/np/ps4_libscenpparty.pas) (PS4) and match their `A` variants, so they behave like them: no party, `NOT_IN_PARTY` from [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/np/np_party.cpp), and handlers accepted but never called. How the console's non-`A` member structures differ from the `A` ones is not known, and nothing is written to them. Not measured on a PS5

From 803601ffa4d665dd4688340101e50e141c463434 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sun, 25 Oct 2026 13:07:08 +0200
Subject: [PATCH 125/218] fix(libkernel_sys): publish identity types and reject
 null system IDs

---
 core/libs/prx/libkernel_sys/Export.cpp        | 11 +----
 core/libs/prx/libkernel_sys/include/Api.hpp   | 12 +++++-
 .../tests/GuestKernelSysConsoleIdentity.cpp   | 41 ++++++++++---------
 docs/dev/debt/libkernel_sys.md                |  2 +-
 4 files changed, 33 insertions(+), 33 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index c6504ce0ec..444c3f19ba 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -127,14 +127,6 @@ int GuestFileError(int error) {
     }
 }
 
-struct KernelAuthInfo {
-    std::uint64_t programAuthorityId;
-    std::uint64_t capabilities[4];
-    std::uint64_t attributes[4];
-    std::uint64_t credentials[8];
-};
-static_assert(sizeof(KernelAuthInfo) == 0x88);
-
 std::int64_t Fail(int error) {
     *__error_nid_postfix() = error;
     return -1;
@@ -346,9 +338,8 @@ std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask) {
     return File::ExchangeCreationMask_nid_no_patch(mask);
 }
 
-int APS5_VABI sceKernelGetOpenPsId(void* id);
-
 int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id) {
+    if (id == nullptr) return GuestEinval;
     return sceKernelGetOpenPsId(id);
 }
 
diff --git a/core/libs/prx/libkernel_sys/include/Api.hpp b/core/libs/prx/libkernel_sys/include/Api.hpp
index 938bc8178b..dc67a83fbe 100644
--- a/core/libs/prx/libkernel_sys/include/Api.hpp
+++ b/core/libs/prx/libkernel_sys/include/Api.hpp
@@ -24,6 +24,14 @@ struct KernelTitleWorkaround {
     std::uint64_t ids[2];
 };
 
+struct KernelAuthInfo {
+    std::uint64_t programAuthorityId;
+    std::uint64_t capabilities[4];
+    std::uint64_t attributes[4];
+    std::uint64_t credentials[8];
+};
+static_assert(sizeof(KernelAuthInfo) == 0x88);
+
 extern "C" {
 
 int APS5_VABI aio_read_nid_postfix(GuestAiocb* aiocb);
@@ -80,7 +88,7 @@ int APS5_VABI cpuset_getid_nid_postfix(void);
 int APS5_VABI cpuset_setid_nid_postfix(void);
 int APS5_VABI dynlib_get_obj_member_nid_postfix(void);
 int APS5_VABI futimesat_nid_postfix(void);
-int APS5_VABI get_authinfo_nid_postfix(void);
+int APS5_VABI get_authinfo_nid_postfix(int pid, KernelAuthInfo* info);
 int APS5_VABI get_module_info_list_nid_postfix(void);
 int APS5_VABI get_page_table_stats_nid_postfix(void);
 int APS5_VABI get_sdk_compiled_version_nid_postfix(void);
@@ -265,7 +273,7 @@ int APS5_VABI sceKernelGetIpcPath(void);
 int APS5_VABI sceKernelGetKnobs(void);
 int APS5_VABI sceKernelGetKqueueFromEqueue(void);
 int APS5_VABI sceKernelGetMemoryPstate(void);
-int APS5_VABI sceKernelGetOpenPsIdForSystem(void);
+int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id);
 int APS5_VABI sceKernelGetPagingStatsOfAllObjects(void);
 int APS5_VABI sceKernelGetPagingStatsOfAllThreads(void);
 int APS5_VABI sceKernelGetParentApp(void);
diff --git a/core/libs/tests/GuestKernelSysConsoleIdentity.cpp b/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
index 14b664e133..f01ac5f625 100644
--- a/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
+++ b/core/libs/tests/GuestKernelSysConsoleIdentity.cpp
@@ -1,20 +1,12 @@
-#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libkernel_sys/libkernel_sys.hpp"
+#include "prx/libc/libc.hpp"
 #include <array>
+#include <bit>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
-extern "C" {
-int APS5_VABI sceKernelIsCEX(void);
-int APS5_VABI sceKernelIsDevKit(void);
-int APS5_VABI get_authinfo_nid_postfix(int pid, void* info);
-int APS5_VABI sceKernelGetOpenPsId(void* id);
-int APS5_VABI sceKernelGetOpenPsIdForSystem(void* id);
-int APS5_VABI getpid_nid_postfix(void);
-int* APS5_VABI __error_nid_postfix(void);
-}
-
 namespace {
 
 constexpr int GuestEperm = 1;
@@ -33,20 +25,25 @@ void CheckConsoleKind() {
 }
 
 void CheckAuthInfo() {
-    std::array<std::uint64_t, 18> info;
+    struct {
+        KernelAuthInfo value;
+        std::uint64_t guard;
+    } info;
     *__error_nid_postfix() = 0;
     Require(get_authinfo_nid_postfix(0, nullptr) == -1 && *__error_nid_postfix() == GuestEperm, "a null result must fail with EPERM");
-    info.fill(0x5a5a5a5a5a5a5a5a);
+    std::memset(&info, 0x5a, sizeof(info));
     *__error_nid_postfix() = 0;
-    Require(get_authinfo_nid_postfix(getpid_nid_postfix() + 1, info.data()) == -1 && *__error_nid_postfix() == GuestEsrch,
+    Require(get_authinfo_nid_postfix(getpid_nid_postfix() + 1, &info.value) == -1 && *__error_nid_postfix() == GuestEsrch,
             "another process must fail with ESRCH");
-    Require(info[0] == 0x5a5a5a5a5a5a5a5a, "a refused call must not write the result");
+    for (const auto byte : std::bit_cast<std::array<std::uint8_t, sizeof(info)>>(info))
+        Require(byte == 0x5a, "a refused call must not write the result");
     for (const int pid : {0, getpid_nid_postfix()}) {
-        info.fill(0x5a5a5a5a5a5a5a5a);
-        Require(get_authinfo_nid_postfix(pid, info.data()) == 0, "the guest process must be described");
-        Require(info[0] == 0 && info[1] == 0x2000000000000000, "the authority ID or first capability word is wrong");
-        for (std::size_t i = 2; i < 17; ++i) Require(info[i] == 0, "the rest of the result must be cleared");
-        Require(info[17] == 0x5a5a5a5a5a5a5a5a, "get_authinfo wrote past its 0x88-byte result");
+        std::memset(&info, 0x5a, sizeof(info));
+        Require(get_authinfo_nid_postfix(pid, &info.value) == 0, "the guest process must be described");
+        Require(info.value.programAuthorityId == 0 && info.value.capabilities[0] == 0x2000000000000000, "the authority ID or first capability word is wrong");
+        const auto bytes = std::bit_cast<std::array<std::uint8_t, sizeof(KernelAuthInfo)>>(info.value);
+        for (std::size_t i = 16; i < bytes.size(); ++i) Require(bytes[i] == 0, "the rest of the result must be cleared");
+        Require(info.guard == 0x5a5a5a5a5a5a5a5a, "get_authinfo wrote past its 0x88-byte result");
     }
 }
 
@@ -54,6 +51,10 @@ void CheckOpenPsId() {
     std::array<std::uint8_t, 16> plain{};
     std::array<std::uint8_t, 24> system;
     system.fill(0xa5);
+    *__error_nid_postfix() = GuestEsrch;
+    Require(sceKernelGetOpenPsIdForSystem(nullptr) == 22, "a null system OpenPSID must return positive EINVAL");
+    Require(*__error_nid_postfix() == GuestEsrch, "a null system OpenPSID must leave errno unchanged");
+    for (auto byte : system) Require(byte == 0xa5, "a null system OpenPSID must not write output");
     Require(sceKernelGetOpenPsId(plain.data()) == 0, "the OpenPSID must be readable");
     Require(sceKernelGetOpenPsIdForSystem(system.data()) == 0, "the system OpenPSID must be readable");
     Require(std::memcmp(plain.data(), system.data(), plain.size()) == 0, "both OpenPSID queries must agree");
diff --git a/docs/dev/debt/libkernel_sys.md b/docs/dev/debt/libkernel_sys.md
index e992912552..0286dda596 100644
--- a/docs/dev/debt/libkernel_sys.md
+++ b/docs/dev/debt/libkernel_sys.md
@@ -27,7 +27,7 @@
 - [fork](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws: creating a child process is not supported. PPSA19111 imports it and fails to load without it. Its engine calls `fork` in `Posix_Daemonize`, only with `-daemonize`, and in `Platform_ShellExecute` before `execvp("xdg-open")`, which the main menu's Previews button reaches, so pressing Previews ends in this throw. [setsid](../../../core/libs/prx/libkernel_sys/Export.cpp) fails with `EPERM`, as FreeBSD's does for a process group leader, since the guest is taken to lead its own process group (see `kill`). [umask](../../../core/libs/prx/libkernel_sys/Export.cpp) keeps the guest's mask (initially 022, masked to 07777) and returns the previous one, Linux named shared-memory creation applies it, but ordinary files are still created with the host process's mask
 - [sceKernelGetModuleInfoInternal and sceKernelGetModuleListInternal](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5
 - [chroot](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L776-L807) and [`pwd_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L3059-L3085) for a root caller: `EFAULT` for a null path, `ENOENT` for an empty or missing one, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255, and `ENOTDIR` for a path that is not a directory or passes through a file. A directory that is the guest root (`/`, `/..`, or `.` after `fchdir` to a descriptor of `/`) succeeds and changes nothing, as the root stays the same directory; the guest is taken never to have changed its root, so open directory descriptors do not make it fail with `EPERM` (`kern.chroot_allow_open_directories` 1). Any other directory throws, naming the path: the guest path resolver has a fixed root and mount aliases (`/app0`, `/savedata0`) that do not move with it. On the console a title starts in a sandbox root, where `pwd_chroot` refuses with `EPERM` while a directory is open; whether that holds for titles, and whether a title holds `PRIV_VFS_CHROOT`, are unverified. Porpoise (PPSA99764) weak-imports it and calls it only as `fchdir` to its saved descriptor of `/` then `chroot(".")`, to put its sandbox root back after a jailbreak daemon replaced it ([`put_root_back`](https://github.com/elripalda/Porpoise-Dolphin-Emulator-for-PS5/blob/2ed1ab5a06995aa198f7bccd4da0f90c3fc29d39/src/porpoise_jailbreak.cpp#L303-L331))
-- [sceKernelIsCEX, sceKernelIsDevKit, get_authinfo and sceKernelGetOpenPsIdForSystem](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - the guest always runs on a retail unit, as in [shadPS4's process.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/process.cpp) with its devkit option off. `get_authinfo` takes shadPS4's [kernel.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/kernel.cpp) errors and capability word, so the authority ID and the other capability, attribute and credential words stay 0. `sceKernelGetOpenPsIdForSystem` returns `sceKernelGetOpenPsId`'s value, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas) does; whether the console keeps a separate ID for system callers is not known. Not measured on a console
+- [sceKernelIsCEX, sceKernelIsDevKit, get_authinfo and sceKernelGetOpenPsIdForSystem](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - the guest always runs on a retail unit, as in [shadPS4's process.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/process.cpp) with its devkit option off. `get_authinfo` takes shadPS4's [kernel.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/kernel.cpp) errors and capability word, so the authority ID and the other capability, attribute and credential words stay 0. `sceKernelGetOpenPsIdForSystem` returns `sceKernelGetOpenPsId`'s value, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas) does; firmware 13.42 reads a separate `machdep.openpsid_for_sys`, but whether its value differs is unknown. Null returns positive 22 per the [module report](https://github.com/boykopovar/AnyPS5/pull/10524#issuecomment-6393566914). The kernel-side `get_authinfo` behavior remains unverified
 - [fchown](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled: the guest's own owner and group (0) and the unchanged value (-1) are accepted, a descriptor that is not open fails with `EBADF`, and any other owner or group throws, naming it. The check reads the descriptor with `fstat`, ignoring the CRT's invalid-parameter handler on Windows as `DescriptorControl` does. The console's ownership rules are unverified. Morrowind (`mshivam019/morrowind-ps5`) imports it
 - [chown, lchown and fchownat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled, as for `fchown`: owner and group 0 and the unchanged value (-1) are accepted, and any other owner or group throws, naming it. The path is looked up first, as in FreeBSD 11's `kern_fchownat`, with `stat`, with `lstat` for `lchown`, and with `fstatat` for `fchownat`, so a lookup error is returned before the owner is checked and nothing is changed on the host. `fchownat` flags other than `AT_SYMLINK_NOFOLLOW` (0x200) return `EINVAL`, as in FreeBSD 11. The console's ownership rules are unverified
 - [linkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) resolves `AT_FDCWD` (-100) and absolute paths as `link` does, and flags other than `AT_SYMLINK_FOLLOW` (0x400) return `EINVAL`, as in FreeBSD 11. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. A symbolic link as the source without `AT_SYMLINK_FOLLOW` throws, where FreeBSD links the symbolic link itself. Console behaviour is unverified

From 866ab27a801c944bbbf469953f6b69d040626166 Mon Sep 17 00:00:00 2001
From: Yossi Yadgar <yadgar360@gmail.com>
Date: Sun, 25 Oct 2026 13:11:03 +0200
Subject: [PATCH 126/218] docs(debt): clarify unverified console identity
 behavior

---
 docs/dev/debt/libkernel_sys.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libkernel_sys.md b/docs/dev/debt/libkernel_sys.md
index 0286dda596..ad1f62a1fa 100644
--- a/docs/dev/debt/libkernel_sys.md
+++ b/docs/dev/debt/libkernel_sys.md
@@ -27,7 +27,7 @@
 - [fork](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws: creating a child process is not supported. PPSA19111 imports it and fails to load without it. Its engine calls `fork` in `Posix_Daemonize`, only with `-daemonize`, and in `Platform_ShellExecute` before `execvp("xdg-open")`, which the main menu's Previews button reaches, so pressing Previews ends in this throw. [setsid](../../../core/libs/prx/libkernel_sys/Export.cpp) fails with `EPERM`, as FreeBSD's does for a process group leader, since the guest is taken to lead its own process group (see `kill`). [umask](../../../core/libs/prx/libkernel_sys/Export.cpp) keeps the guest's mask (initially 022, masked to 07777) and returns the previous one, Linux named shared-memory creation applies it, but ordinary files are still created with the host process's mask
 - [sceKernelGetModuleInfoInternal and sceKernelGetModuleListInternal](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5
 - [chroot](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L776-L807) and [`pwd_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L3059-L3085) for a root caller: `EFAULT` for a null path, `ENOENT` for an empty or missing one, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255, and `ENOTDIR` for a path that is not a directory or passes through a file. A directory that is the guest root (`/`, `/..`, or `.` after `fchdir` to a descriptor of `/`) succeeds and changes nothing, as the root stays the same directory; the guest is taken never to have changed its root, so open directory descriptors do not make it fail with `EPERM` (`kern.chroot_allow_open_directories` 1). Any other directory throws, naming the path: the guest path resolver has a fixed root and mount aliases (`/app0`, `/savedata0`) that do not move with it. On the console a title starts in a sandbox root, where `pwd_chroot` refuses with `EPERM` while a directory is open; whether that holds for titles, and whether a title holds `PRIV_VFS_CHROOT`, are unverified. Porpoise (PPSA99764) weak-imports it and calls it only as `fchdir` to its saved descriptor of `/` then `chroot(".")`, to put its sandbox root back after a jailbreak daemon replaced it ([`put_root_back`](https://github.com/elripalda/Porpoise-Dolphin-Emulator-for-PS5/blob/2ed1ab5a06995aa198f7bccd4da0f90c3fc29d39/src/porpoise_jailbreak.cpp#L303-L331))
-- [sceKernelIsCEX, sceKernelIsDevKit, get_authinfo and sceKernelGetOpenPsIdForSystem](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - the guest always runs on a retail unit, as in [shadPS4's process.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/process.cpp) with its devkit option off. `get_authinfo` takes shadPS4's [kernel.cpp](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/kernel.cpp) errors and capability word, so the authority ID and the other capability, attribute and credential words stay 0. `sceKernelGetOpenPsIdForSystem` returns `sceKernelGetOpenPsId`'s value, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas) does; firmware 13.42 reads a separate `machdep.openpsid_for_sys`, but whether its value differs is unknown. Null returns positive 22 per the [module report](https://github.com/boykopovar/AnyPS5/pull/10524#issuecomment-6393566914). The kernel-side `get_authinfo` behavior remains unverified
+- [Console identity](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - `get_authinfo` errors and capability bits remain unverified on PS5; they follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/396c2a09a38d22eaa02aab32c1967263dceab95f/src/core/libraries/kernel/kernel.cpp), leaving the authority ID and other capability, attribute and credential words zero. The host models a retail unit (`IsCEX` 1, `IsDevKit` 0). The system OpenPSID reuses the ordinary ID; firmware 13.42 reads a separate `machdep.openpsid_for_sys`, whose value is unknown. Null returns positive 22 per the [module report](https://github.com/boykopovar/AnyPS5/pull/10524#issuecomment-6393566914).
 - [fchown](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled: the guest's own owner and group (0) and the unchanged value (-1) are accepted, a descriptor that is not open fails with `EBADF`, and any other owner or group throws, naming it. The check reads the descriptor with `fstat`, ignoring the CRT's invalid-parameter handler on Windows as `DescriptorControl` does. The console's ownership rules are unverified. Morrowind (`mshivam019/morrowind-ps5`) imports it
 - [chown, lchown and fchownat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled, as for `fchown`: owner and group 0 and the unchanged value (-1) are accepted, and any other owner or group throws, naming it. The path is looked up first, as in FreeBSD 11's `kern_fchownat`, with `stat`, with `lstat` for `lchown`, and with `fstatat` for `fchownat`, so a lookup error is returned before the owner is checked and nothing is changed on the host. `fchownat` flags other than `AT_SYMLINK_NOFOLLOW` (0x200) return `EINVAL`, as in FreeBSD 11. The console's ownership rules are unverified
 - [linkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) resolves `AT_FDCWD` (-100) and absolute paths as `link` does, and flags other than `AT_SYMLINK_FOLLOW` (0x400) return `EINVAL`, as in FreeBSD 11. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. A symbolic link as the source without `AT_SYMLINK_FOLLOW` throws, where FreeBSD links the symbolic link itself. Console behaviour is unverified

From ef6f00b33bf9e5b9e41699bb0e2ba9da78b32658 Mon Sep 17 00:00:00 2001
From: JAB-dev <68183649+JAB-dev@users.noreply.github.com>
Date: Sun, 25 Oct 2026 14:29:44 +0200
Subject: [PATCH 127/218] test(libSceNgs2): keep the mastering gain test's
 waveforms alive while it renders

The test's chain helper built its PCM vector as a local and handed the sampler a
pointer into it, so every render read freed memory. Windows left the old samples
in place; Linux overwrote them and the first case rendered 0.1875 instead of 16.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
index 534115aac5..c4a7c302c2 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
@@ -9,6 +9,7 @@
 #include <cstdint>
 #include <cstdlib>
 #include <cstring>
+#include <deque>
 #include <iterator>
 #include <numbers>
 #include <stdexcept>
@@ -978,10 +979,11 @@ static void TestMasteringGain() {
 }
 
 static void TestMasteringGainClampedLikePs5() {
-    const auto chain = [](std::uint32_t channels, std::uint32_t grains, uintptr_t& master) {
+    std::deque<std::vector<std::int16_t>> waveforms;
+    const auto chain = [&waveforms](std::uint32_t channels, std::uint32_t grains, uintptr_t& master) {
         const auto system = CreateSystem();
         master = Mastering(system, channels);
-        const std::vector<std::int16_t> pcm(Grain * grains, 16384);
+        const auto& pcm = waveforms.emplace_back(Grain * grains, 16384);
         const auto source = Sampler(system, pcm, 0);
         const std::vector<float> levels(channels, 1.0f);
         Control(source, SCE_NGS2_VOICE_PARAM_MATRIX_LEVELS, Ngs2VoiceMatrixLevelsParam{{}, 0, channels, levels.data()});

From db8d2bc1c93bf7730d106c2b2b625f6fd51752cc Mon Sep 17 00:00:00 2001
From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:31:48 +0000
Subject: [PATCH 128/218] fix(libSceConvertKeycode): look up keyboard types
 without signed overflow

LookUp subtracted the first mapped type, 16, from the UserService keyboard type in 32 bits, which overflows for keyboard types below INT32_MIN + 16; sceConvertKeycodeGetImeKeyboardType passes the type it read from UserService. Compute the index in 64 bits. Every type still maps to the same IME keyboard type, and types outside the table still map to 0.
---
 core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp b/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
index 4ace3c252c..ec7e041937 100644
--- a/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
+++ b/core/libs/prx/libSceConvertKeycode/ImeKeyboardType.hpp
@@ -35,7 +35,7 @@ constexpr std::uint32_t LookUp(std::int32_t keyboardType, std::int32_t japaneseV
         constexpr std::uint32_t traditionalChinese[] = {26, 27, 28, 29, 39};
         return traditionalChineseVariant >= 0 && traditionalChineseVariant < 5 ? traditionalChinese[traditionalChineseVariant] : 0;
     }
-    const std::int32_t index = keyboardType - kFirstMappedType;
+    const std::int64_t index = std::int64_t{keyboardType} - kFirstMappedType;
     return index >= 0 && index < kMappedTypeCount ? kImeTypeByKeyboardType[index] : 0;
 }
 

From 89af2b225e64b336bf06af798fd4024e053a8c3e Mon Sep 17 00:00:00 2001
From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:31:48 +0000
Subject: [PATCH 129/218] test(libSceConvertKeycode): check the keyboard type
 lookup at both int32 limits at compile time

LookUp is constexpr, so static_assert evaluates it for INT32_MIN and INT32_MAX in a constant expression, where signed overflow is an error. With the previous 32-bit subtraction the test file no longer compiles ('overflow in constant expression'); the existing runtime case for 0x80000000 only showed the overflow under UBSan.
---
 core/libs/tests/GuestConvertKeycode.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/libs/tests/GuestConvertKeycode.cpp b/core/libs/tests/GuestConvertKeycode.cpp
index 8bf7b815b0..d2d3cb463f 100644
--- a/core/libs/tests/GuestConvertKeycode.cpp
+++ b/core/libs/tests/GuestConvertKeycode.cpp
@@ -15,6 +15,9 @@
 
 static void Require(bool value) { if (!value) std::abort(); }
 
+static_assert(ImeKeyboardType::LookUp(INT32_MIN, 0, 0) == 0);
+static_assert(ImeKeyboardType::LookUp(INT32_MAX, 0, 0) == 0);
+
 static void SetLanguage(const char* value) {
 #ifdef _WIN32
     Require(_putenv_s("ANYPS5_LANGUAGE", value != nullptr ? value : "") == 0);

From 78540129bcc58ccab6fbe6303e47f9c0167e0fc6 Mon Sep 17 00:00:00 2001
From: Rookie <175737347+rooklz@users.noreply.github.com>
Date: Sat, 24 Oct 2026 20:20:11 +0100
Subject: [PATCH 130/218] fix(libSceCesCs): encode the Big5 box-drawing
 duplicates into their lower cells as the console does

---
 core/libs/prx/libSceCesCs/Export.cpp | 2 +-
 core/libs/tests/GuestCesDbcs.cpp     | 9 ++++++---
 docs/dev/debt/libSceCesCs.md         | 2 +-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libSceCesCs/Export.cpp b/core/libs/prx/libSceCesCs/Export.cpp
index 15e18e9e3b..e0e5a7001f 100644
--- a/core/libs/prx/libSceCesCs/Export.cpp
+++ b/core/libs/prx/libSceCesCs/Export.cpp
@@ -476,7 +476,7 @@ const void* contextProfile(const void* context) {
 constexpr uint8_t EUC_KR_TAG[8] = {'E', 'U', 'C', 'K', 'R', '9', '4', '9'};
 constexpr uint8_t UHC_TAG[8] = {'U', 'H', 'C', 'C', 'P', '9', '4', '9'};
 constexpr uint8_t BIG5_TAG[8] = {'B', 'I', 'G', '5', 'C', '9', '5', '0'};
-constexpr uint16_t BIG5_LAST_CELL[6] = {0x2550, 0x255E, 0x2561, 0x256A, 0x5341, 0x5345};
+constexpr uint16_t BIG5_LAST_CELL[2] = {0x5341, 0x5345};
 
 bool isEucKr(const void* profile) {
     return profile != nullptr && std::memcmp(profile, EUC_KR_TAG, sizeof(EUC_KR_TAG)) == 0;
diff --git a/core/libs/tests/GuestCesDbcs.cpp b/core/libs/tests/GuestCesDbcs.cpp
index e8c093f13b..b200a0677e 100644
--- a/core/libs/tests/GuestCesDbcs.cpp
+++ b/core/libs/tests/GuestCesDbcs.cpp
@@ -319,8 +319,8 @@ int main() {
 
     Require(sceCesMbcsUcsContextInit(context, big5) == 0);
     RequireString(context, "\xA4\xA4\xA4\xE5", "\xE4\xB8\xAD\xE6\x96\x87");
-    RequireString(context, "\xF9\xF9\xA2\x7E\xA4\x51\xA4\xCA", "\xE2\x95\x90\xE2\x95\xAD\xE5\x8D\x81\xE5\x8D\x85");
-    RequireString(context, "\xF9\xE9\xF9\xEB\xF9\xEA\xA2\xA1\xA2\xA3\xA2\xA2", "\xE2\x95\x9E\xE2\x95\xA1\xE2\x95\xAA\xE2\x95\xAE\xE2\x95\xAF\xE2\x95\xB0");
+    RequireString(context, "\xA2\xA4\xA2\x7E\xA4\x51\xA4\xCA", "\xE2\x95\x90\xE2\x95\xAD\xE5\x8D\x81\xE5\x8D\x85");
+    RequireString(context, "\xA2\xA5\xA2\xA7\xA2\xA6\xA2\xA1\xA2\xA3\xA2\xA2", "\xE2\x95\x9E\xE2\x95\xA1\xE2\x95\xAA\xE2\x95\xAE\xE2\x95\xAF\xE2\x95\xB0");
     Require(Utf8ToMbcs(context, "\xEA\xB0\x80") == unassignedCode);
     Require(RoundTripMismatches(context) == 10);
 
@@ -363,7 +363,10 @@ int main() {
     RequireEncode(eucKrEncoders, eucKr, 0x20AC, 0, Bytes("\xA2\xE6"), 2);
     RequireEncode(eucKrEncoders, eucKr, 0xB620, unassignedCode, nullptr, 0);
     RequireEncode(uhcEncoders, uhc, 0xB620, 0, Bytes("\x8C\x63"), 2);
-    RequireEncode(big5Encoders, big5, 0x2550, 0, Bytes("\xF9\xF9"), 2);
+    RequireEncode(big5Encoders, big5, 0x2550, 0, Bytes("\xA2\xA4"), 2);
+    RequireEncode(big5Encoders, big5, 0x255E, 0, Bytes("\xA2\xA5"), 2);
+    RequireEncode(big5Encoders, big5, 0x2561, 0, Bytes("\xA2\xA7"), 2);
+    RequireEncode(big5Encoders, big5, 0x256A, 0, Bytes("\xA2\xA6"), 2);
     RequireEncode(big5Encoders, big5, 0x5341, 0, Bytes("\xA4\x51"), 2);
     RequireEncode(big5Encoders, big5, 0xAC00, unassignedCode, nullptr, 0);
     RequireEncode(eucKrEncoders, uhc, 0xAC00, invalidParameter, nullptr, 0);
diff --git a/docs/dev/debt/libSceCesCs.md b/docs/dev/debt/libSceCesCs.md
index 6905596b0a..3899712799 100644
--- a/docs/dev/debt/libSceCesCs.md
+++ b/docs/dev/debt/libSceCesCs.md
@@ -22,4 +22,4 @@
 - [Generic MBCS character and Shift-JIS code helpers](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the UTF-8 and UTF-16 buffer forms' errors and size pointers follow the other converters, unverified. The single-character encoders were measured on a PS5 (`sceCesUtf32ToMbc` over U+0000-U+110001 with each MBCS profile, each encoding's `Ucs2To*` and `Utf32To*` on surrogates and a one-byte target): 0x805C0015 for a surrogate, 0x805C0014 past U+10FFFF, the needed length with `DST_BUFFER_END` and a zero length with any other refusal. `sceCesMbcTo*` and `sceCes*ToMbc` convert one character with any profile the MBCS context accepts; an unmapped character answers `UNASSIGNED_CODE`. `sceCesSJisGetCode`/`PutCode` move one raw Shift-JIS code unchecked; `sceCesSJisCodeToJisX0213` and back use JIS X 0213 annex 1 arithmetic. `sceCesMbcsUcsContextInitCopy` copies the profile pointer. Signatures follow Orbital
 - [Single-byte profiles](../../../core/libs/prx/libSceCesCs/SingleByte.hpp) (libSceCesCs) - the console's tables for these 27 profiles are not verified. Each returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with bytes 0x00-0x7F unchanged and the high half of a public table: ISO 8859-1, -2, -4, -5, -9, -10, -13, -14, -15 and -16 from [unicode.org](https://unicode.org/Public/MAPPINGS/ISO8859/), code pages 437, 737, 775, 850, 852, 855, 860-863, 865 and 866 from [Microsoft's PC tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/), KOI8-R and KOI8-U from [unicode.org](https://unicode.org/Public/MAPPINGS/VENDORS/MISC/), and 1254, 1256 and 1258 from Microsoft's [best-fit tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/), whose unassigned bytes map to C1 controls as in Cp1250. Profiles whose public table leaves bytes undefined or maps them to private use still throw
 - [libSceCesCs firmware 3.20 pending exports](../../../core/libs/prx/libSceCesCs/PendingExports.cpp) - 62 symbol names are present in [the PS5 3.20 libSceCesCs export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCesCs.c). Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through `NotImplemented_nid_no_patch`.
-- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables, errors and Big5 duplicate choices are assumed, not measured. `sceCesUcsProfileInitEucKr`, `sceCesUcsProfileInitUhc` and `sceCesUcsProfileInitBig5Cp950` tag the caller's sheet like the EUC-JP profile. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 profile (`sceCes*UcsProfileSetSbcs`) is not implemented. User-defined areas (Private Use Area on Windows) answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+2550, U+255E, U+2561, U+256A, U+5341 and U+5345, as code page 950 does. The scalar calls to and from UCS-2 and UTF-8/16/32 convert one character as the Shift-JIS and EUC-JP scalar conversions do
+- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables and errors are assumed, not measured; the Big5 duplicate choices were measured. `sceCesUcsProfileInitEucKr`, `sceCesUcsProfileInitUhc` and `sceCesUcsProfileInitBig5Cp950` tag the caller's sheet like the EUC-JP profile. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 profile (`sceCes*UcsProfileSetSbcs`) is not implemented. User-defined areas (Private Use Area on Windows) answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+5341 and U+5345, as a PS5's `sceCesUtf32ToMbc` does for every scalar (code page 950 also takes the higher cell of U+2550, U+255E, U+2561 and U+256A; the console does not). The scalar calls to and from UCS-2 and UTF-8/16/32 convert one character as the Shift-JIS and EUC-JP scalar conversions do

From f71434eec8d4d95d6c090b1cfa390e4023a4a7a1 Mon Sep 17 00:00:00 2001
From: Rookie <175737347+rooklz@users.noreply.github.com>
Date: Sun, 25 Oct 2026 07:21:24 +0000
Subject: [PATCH 131/218] docs(libSceCesCs): keep the Big5 debt entry within
 the length limit

---
 docs/dev/debt/libSceCesCs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceCesCs.md b/docs/dev/debt/libSceCesCs.md
index 3899712799..dc7e5ff79a 100644
--- a/docs/dev/debt/libSceCesCs.md
+++ b/docs/dev/debt/libSceCesCs.md
@@ -22,4 +22,4 @@
 - [Generic MBCS character and Shift-JIS code helpers](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the UTF-8 and UTF-16 buffer forms' errors and size pointers follow the other converters, unverified. The single-character encoders were measured on a PS5 (`sceCesUtf32ToMbc` over U+0000-U+110001 with each MBCS profile, each encoding's `Ucs2To*` and `Utf32To*` on surrogates and a one-byte target): 0x805C0015 for a surrogate, 0x805C0014 past U+10FFFF, the needed length with `DST_BUFFER_END` and a zero length with any other refusal. `sceCesMbcTo*` and `sceCes*ToMbc` convert one character with any profile the MBCS context accepts; an unmapped character answers `UNASSIGNED_CODE`. `sceCesSJisGetCode`/`PutCode` move one raw Shift-JIS code unchecked; `sceCesSJisCodeToJisX0213` and back use JIS X 0213 annex 1 arithmetic. `sceCesMbcsUcsContextInitCopy` copies the profile pointer. Signatures follow Orbital
 - [Single-byte profiles](../../../core/libs/prx/libSceCesCs/SingleByte.hpp) (libSceCesCs) - the console's tables for these 27 profiles are not verified. Each returns a profile accepted by `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the MBCS context conversions, with bytes 0x00-0x7F unchanged and the high half of a public table: ISO 8859-1, -2, -4, -5, -9, -10, -13, -14, -15 and -16 from [unicode.org](https://unicode.org/Public/MAPPINGS/ISO8859/), code pages 437, 737, 775, 850, 852, 855, 860-863, 865 and 866 from [Microsoft's PC tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/PC/), KOI8-R and KOI8-U from [unicode.org](https://unicode.org/Public/MAPPINGS/VENDORS/MISC/), and 1254, 1256 and 1258 from Microsoft's [best-fit tables](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WindowsBestFit/), whose unassigned bytes map to C1 controls as in Cp1250. Profiles whose public table leaves bytes undefined or maps them to private use still throw
 - [libSceCesCs firmware 3.20 pending exports](../../../core/libs/prx/libSceCesCs/PendingExports.cpp) - 62 symbol names are present in [the PS5 3.20 libSceCesCs export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceCesCs.c). Their signatures and console behaviour are unverified. The declarations use the existing no-parameter unknown-signature convention solely to resolve imports, and every call throws through `NotImplemented_nid_no_patch`.
-- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables and errors are assumed, not measured; the Big5 duplicate choices were measured. `sceCesUcsProfileInitEucKr`, `sceCesUcsProfileInitUhc` and `sceCesUcsProfileInitBig5Cp950` tag the caller's sheet like the EUC-JP profile. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 profile (`sceCes*UcsProfileSetSbcs`) is not implemented. User-defined areas (Private Use Area on Windows) answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+5341 and U+5345, as a PS5's `sceCesUtf32ToMbc` does for every scalar (code page 950 also takes the higher cell of U+2550, U+255E, U+2561 and U+256A; the console does not). The scalar calls to and from UCS-2 and UTF-8/16/32 convert one character as the Shift-JIS and EUC-JP scalar conversions do
+- [EUC-KR, UHC and Big5 conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables and errors are assumed, not measured; the Big5 duplicate choices were measured. The three inits tag the caller's sheet like EUC-JP's. The tables are Microsoft's [CP949.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP949.TXT) and [CP950.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP950.TXT); EUC-KR is CP949 limited to bytes `0xA1`-`0xFE`. Bytes below `0x80` are ASCII; the KS X 1003 profile (`sceCes*UcsProfileSetSbcs`) is not implemented. User-defined areas (Private Use Area on Windows) answer `UNASSIGNED_CODE`. Big5 encoding takes the lower of two cells except for U+5341 and U+5345, as a PS5's `sceCesUtf32ToMbc` does for every scalar (CP950 takes the higher cell of U+2550, U+255E, U+2561 and U+256A; the console does not). Scalar calls to and from UCS-2 and UTF-8/16/32 convert one character as the Shift-JIS and EUC-JP ones do

From e84640cd83bb7272b37ed6783ea594d431f653eb Mon Sep 17 00:00:00 2001
From: JAB-dev <68183649+JAB-dev@users.noreply.github.com>
Date: Sun, 25 Oct 2026 14:47:07 +0200
Subject: [PATCH 132/218] test(libSceNgs2): drop the throw assertion for a NaN
 gain into PCM_I16L

NaN-to-PCM_I16L output is marked unimplemented in Render.cpp and the debt entry,
and the test rule excludes asserting that an unimplemented path throws. The
production exception and the debt entry stay.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
index c4a7c302c2..24375e7f39 100644
--- a/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
+++ b/core/libs/prx/libSceNgs2.native/tests/Ngs2Render.cpp
@@ -1050,17 +1050,6 @@ static void TestMasteringGainClampedLikePs5() {
     Event(master, SCE_NGS2_VOICE_EVENT_PLAY);
     expect(render(system, 6), 6, 1.0f, 1.0f);
     Require(sceNgs2SystemDestroy(system, nullptr) == SCE_NGS2_OK);
-
-    const auto nanSystem = chain(1, 1, master);
-    Control(master, SCE_NGS2_MASTERING_VOICE_PARAM_GAIN, Ngs2MasteringVoiceGainParam{{}, NAN, 1.0f});
-    bool threw = false;
-    try {
-        RenderI16(nanSystem);
-    } catch (const std::runtime_error&) {
-        threw = true;
-    }
-    Require(threw);
-    Require(sceNgs2SystemDestroy(nanSystem, nullptr) == SCE_NGS2_OK);
 }
 
 static uintptr_t RackVoice(uintptr_t rack, std::uint32_t index) {

From 10f2994bb65e5f55d3d4c7b1271b4bd6bc2611fc Mon Sep 17 00:00:00 2001
From: louise-patra <rocklouis055@gmail.com>
Date: Sun, 25 Oct 2026 18:50:17 +0530
Subject: [PATCH 133/218] fix(libSceNpUtility): refuse null results and
 synchronous requests in polls and waits

Firmware 13.42's module checks a null result first (0x80550704) and
refuses a synchronous request in the lookup poll and wait with
0x80550307; the word filter keeps INVALID_ID. The debt entry records the
measurement and that IDs here do not carry the console's service bits.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceNpUtility/Export.cpp  | 27 +++++++++++++----------
 core/libs/tests/GuestNpUtilityOffline.cpp | 11 ++++++---
 docs/dev/debt/libSceNpUtility.md          |  2 +-
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/core/libs/prx/libSceNpUtility/Export.cpp b/core/libs/prx/libSceNpUtility/Export.cpp
index bd009d549a..78daa1fe62 100644
--- a/core/libs/prx/libSceNpUtility/Export.cpp
+++ b/core/libs/prx/libSceNpUtility/Export.cpp
@@ -17,6 +17,7 @@ static constexpr int SCE_NP_COMMUNITY_ERROR_ABORTED = static_cast<int>(0x8055070
 static constexpr int SCE_NP_COMMUNITY_ERROR_INSUFFICIENT_ARGUMENT = static_cast<int>(0x8055070C);
 static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_ID = static_cast<int>(0x8055070E);
 static constexpr int SCE_NP_COMMUNITY_ERROR_INVALID_TYPE = static_cast<int>(0x80550711);
+static constexpr int SCE_NP_LOOKUP_ERROR_SYNCHRONOUS_REQUEST = static_cast<int>(0x80550307);
 static constexpr int POLL_FINISHED = 0;
 static constexpr int POLL_RUNNING = 1;
 static constexpr std::size_t MAX_TITLE_CONTEXTS = 32;
@@ -110,25 +111,29 @@ int AbortRequest(Service& service, int reqId) {
     return 0;
 }
 
-int PollAsync(Service& service, int reqId, int* result, bool asyncOnly) {
+int PollAsync(Service& service, int reqId, int* result, int synchronousError) {
+    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(service.mutex);
     const auto request = service.requests.find(reqId);
-    if (request == service.requests.end() || (asyncOnly && !request->second.async)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.async) return synchronousError;
     if (!request->second.finished) return POLL_RUNNING;
-    if (result) *result = request->second.result;
+    *result = request->second.result;
     return POLL_FINISHED;
 }
 
-int WaitAsync(Service& service, int reqId, int* result, bool asyncOnly) {
+int WaitAsync(Service& service, int reqId, int* result, int synchronousError) {
+    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
     std::unique_lock lock(service.mutex);
     auto request = service.requests.find(reqId);
-    if (request == service.requests.end() || (asyncOnly && !request->second.async)) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
+    if (!request->second.async) return synchronousError;
     service.finished.wait(lock, [&] {
         request = service.requests.find(reqId);
         return request == service.requests.end() || request->second.finished;
     });
     if (request == service.requests.end()) return SCE_NP_COMMUNITY_ERROR_INVALID_ID;
-    if (result) *result = request->second.result;
+    *result = request->second.result;
     return 0;
 }
 
@@ -498,7 +503,7 @@ int APS5_VABI sceNpLookupNpId(int reqId, const NpOnlineId* onlineId, void* npId,
 }
 
 int APS5_VABI sceNpLookupPollAsync(int reqId, int* result) {
-    return PollAsync(lookup, reqId, result, false);
+    return PollAsync(lookup, reqId, result, SCE_NP_LOOKUP_ERROR_SYNCHRONOUS_REQUEST);
 }
 
 int APS5_VABI sceNpLookupSetTimeout(int id, int resolveRetry, std::uint32_t resolveTimeout, std::uint32_t connTimeout, std::uint32_t sendTimeout, std::uint32_t recvTimeout) {
@@ -506,7 +511,7 @@ int APS5_VABI sceNpLookupSetTimeout(int id, int resolveRetry, std::uint32_t reso
 }
 
 int APS5_VABI sceNpLookupWaitAsync(int reqId, int* result) {
-    return WaitAsync(lookup, reqId, result, false);
+    return WaitAsync(lookup, reqId, result, SCE_NP_LOOKUP_ERROR_SYNCHRONOUS_REQUEST);
 }
 
 int APS5_VABI sceNpWordFilterAbortRequest(int reqId) {
@@ -542,8 +547,7 @@ int APS5_VABI sceNpWordFilterDeleteTitleCtx(int titleCtxId) {
 }
 
 int APS5_VABI sceNpWordFilterPollAsync(int reqId, int* result) {
-    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
-    return PollAsync(wordFilter, reqId, result, true);
+    return PollAsync(wordFilter, reqId, result, SCE_NP_COMMUNITY_ERROR_INVALID_ID);
 }
 
 int APS5_VABI sceNpWordFilterSanitizeComment(int reqId, const char* comment, char* sanitizedComment, void* option) {
@@ -558,8 +562,7 @@ int APS5_VABI sceNpWordFilterSetTimeout(int id, int resolveRetry, std::uint32_t
 }
 
 int APS5_VABI sceNpWordFilterWaitAsync(int reqId, int* result) {
-    if (!result) return SCE_NP_COMMUNITY_ERROR_INVALID_ARGUMENT;
-    return WaitAsync(wordFilter, reqId, result, true);
+    return WaitAsync(wordFilter, reqId, result, SCE_NP_COMMUNITY_ERROR_INVALID_ID);
 }
 
 }
diff --git a/core/libs/tests/GuestNpUtilityOffline.cpp b/core/libs/tests/GuestNpUtilityOffline.cpp
index f4c627f347..b8879b9256 100644
--- a/core/libs/tests/GuestNpUtilityOffline.cpp
+++ b/core/libs/tests/GuestNpUtilityOffline.cpp
@@ -16,6 +16,7 @@ constexpr int Aborted = static_cast<int>(0x80550707u);
 constexpr int InsufficientArgument = static_cast<int>(0x8055070Cu);
 constexpr int InvalidId = static_cast<int>(0x8055070Eu);
 constexpr int InvalidType = static_cast<int>(0x80550711u);
+constexpr int LookupSynchronousRequest = static_cast<int>(0x80550307u);
 constexpr int PollFinished = 0;
 constexpr int PollRunning = 1;
 constexpr int WordFilterTitleCtxBase = 0x01000000;
@@ -172,16 +173,20 @@ void CheckLookupAsync() {
     Require(sceNpLookupSetTimeout(async, 0, 1000000, 10000000, 10000000, 10000000) == 0, "sceNpLookupSetTimeout", "a request timeout was refused");
     int result = 7;
     Require(sceNpLookupPollAsync(async + 100, &result) == InvalidId, "sceNpLookupPollAsync", "an unknown request was taken");
-    Require(sceNpLookupPollAsync(async, nullptr) == PollRunning, "sceNpLookupPollAsync", "an unstarted request was not running");
+    Require(sceNpLookupPollAsync(async, nullptr) == InvalidArgument, "sceNpLookupPollAsync", "a null result was taken");
+    Require(sceNpLookupPollAsync(async + 100, nullptr) == InvalidArgument, "sceNpLookupPollAsync", "an unknown request was checked before a null result");
+    Require(sceNpLookupWaitAsync(async, nullptr) == InvalidArgument, "sceNpLookupWaitAsync", "a null result was taken");
+    Require(sceNpLookupPollAsync(async, &result) == PollRunning && result == 7, "sceNpLookupPollAsync", "an unstarted request was not running");
     Require(WaitInThread("sceNpLookupWaitAsync", sceNpLookupWaitAsync, async, &result, StartLookup) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "waiting did not end with SIGNED_OUT when the lookup started");
-    Require(sceNpLookupPollAsync(async, nullptr) == PollFinished, "sceNpLookupPollAsync", "a null result was refused on a finished request");
+    Require(sceNpLookupPollAsync(async, nullptr) == InvalidArgument, "sceNpLookupPollAsync", "a null result was taken on a finished request");
     result = 7;
     Require(sceNpLookupPollAsync(async, &result) == PollFinished && result == SignedOut, "sceNpLookupPollAsync", "the request did not finish with SIGNED_OUT");
 
     const int sync = sceNpLookupCreateRequest(context);
     StartLookup(sync);
     result = 7;
-    Require(sceNpLookupWaitAsync(sync, &result) == 0 && result == SignedOut, "sceNpLookupWaitAsync", "a finished synchronous request was not returned");
+    Require(sceNpLookupWaitAsync(sync, &result) == LookupSynchronousRequest && result == 7, "sceNpLookupWaitAsync", "a synchronous request was not refused with 0x80550307");
+    Require(sceNpLookupPollAsync(sync, &result) == LookupSynchronousRequest && result == 7, "sceNpLookupPollAsync", "a synchronous request was not refused with 0x80550307");
 
     const int aborted = sceNpLookupCreateAsyncRequest(context, asyncParam);
     Require(sceNpLookupAbortRequest(aborted + 100) == InvalidId, "sceNpLookupAbortRequest", "an unknown request was taken");
diff --git a/docs/dev/debt/libSceNpUtility.md b/docs/dev/debt/libSceNpUtility.md
index d83539b646..f163571610 100644
--- a/docs/dev/debt/libSceNpUtility.md
+++ b/docs/dev/debt/libSceNpUtility.md
@@ -19,4 +19,4 @@
 ### Functional
 
 - [NpLookup and NpWordFilter](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline only, not measured on a PS5: the argument checks and their order, the limit of 32 title contexts and 32 requests, the word filter id bases `0x01000001` and `0x02000001`, the 0x400-byte comment limit and single-use requests (`INVALID_TYPE`) follow shadPS4's [lookup](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L41-L222) and [word filter](https://github.com/shadps4-emu/shadPS4/blob/91e6afa69b0a64b0afaa0281b80f8fbb0cd88136/src/core/libraries/np/np_utility/np_utility.cpp#L705-L909) calls. `sceNpLookupNpId`, `sceNpWordFilterCensorComment` and `sceNpWordFilterSanitizeComment` then finish with `SCE_NP_ERROR_SIGNED_OUT` and write no NpId or comment; shadPS4's word filter accepts every comment as a stand-in for the server, so its result is not used
-- [NpLookup and NpWordFilter waits and timeouts](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - offline, not measured on a PS5: the timeouts of `sceNpLookupSetTimeout` and `sceNpWordFilterSetTimeout` are checked and then have no effect, since no request reaches a server. A wait on a request deleted meanwhile returns `INVALID_ID`. The checks and results follow shadPS4's [lookup](https://github.com/shadps4-emu/shadPS4/blob/cc4dbd45bc10049ea8a445eb0e697de268ef4723/src/core/libraries/np/np_utility/np_utility.cpp#L120-L321) and [word filter](https://github.com/shadps4-emu/shadPS4/blob/cc4dbd45bc10049ea8a445eb0e697de268ef4723/src/core/libraries/np/np_utility/np_utility.cpp#L911-L951) calls: the lookup poll and wait take a null result and a synchronous request, the word filter ones refuse both
+- [NpLookup and NpWordFilter waits and timeouts](../../../core/libs/prx/libSceNpUtility/Export.cpp) (libSceNpUtility) - IDs here carry no service: on the console, measured on firmware 13.42's module in an emulator (#10640), each ID holds its service in its high bits (Lookup requests `0x2xxxxxxx` and title contexts `0x4xxxxxxx`, word filter `0x02xxxxxx` and `0x04xxxxxx`), and `SetTimeout`, `AbortRequest`, `PollAsync` and `WaitAsync` find the object by those bits whichever service's call is made; here each call finds only its own service's IDs, which keep the ranges above. The timeouts are checked as measured and then have no effect, since no request reaches a server; the console stores them. A wait on a request deleted meanwhile returns `INVALID_ID`, unmeasured. The measured checks are followed: a null result first (`0x80550704`), a synchronous request (`0x80550307` for Lookup, `INVALID_ID` for the word filter), the timeout bounds and the 0x18-byte async parameter

From b6f33d10cc53b25cf428b915bc085f8ff1a47389 Mon Sep 17 00:00:00 2001
From: plexerPK <160128888+plexerPK@users.noreply.github.com>
Date: Sat, 24 Oct 2026 14:07:47 +0200
Subject: [PATCH 134/218] fix(tools): preserve recorded SELF segment host
 mapping

---
 tools/tests/test_unwrap_self.py | 24 ++++++++++++++++++++++++
 tools/unwrap_self.py            |  6 ++++++
 2 files changed, 30 insertions(+)

diff --git a/tools/tests/test_unwrap_self.py b/tools/tests/test_unwrap_self.py
index 59d334cfc1..33cfe1f642 100644
--- a/tools/tests/test_unwrap_self.py
+++ b/tools/tests/test_unwrap_self.py
@@ -484,6 +484,30 @@ class UnwrapTest(unittest.TestCase):
                     self.assertEqual(embedded[2] - host[2], embedded[3] - host[3])
                     self.assertEqual(data[embedded[2]:embedded[2] + size], payload[0x90:0x90 + size])
 
+    def test_recorded_embedded_segments_keep_their_overlapping_load_host(self):
+        payload = b"overlapping load payload\0" * 16
+        for kind in (PT_DYNAMIC, PT_TLS):
+            for delta, size in ((0, 0x10), (0x10, 0x10), (0x40, 0x20), (0xF0, 0x10)):
+                for relocated in (False, True):
+                    with self.subTest(kind=kind, delta=delta, size=size, relocated=relocated):
+                        source = 0x800 if relocated else 0x1000
+                        segments = [(PT_LOAD, 5, 0x1000, 0x1000, 0x100, PAGE),
+                                    (PT_LOAD, 6, 0x1080, 0x3080, 0x100, PAGE),
+                                    (kind, 4, 0x1080 + delta, 0x3080 + delta, size, 8)]
+                        records = [(0x800, source, 0x100), (0x100800, source + 0x80, 0x100)] if relocated else []
+                        records.append((0x200800, source + 0x80 + delta, size))
+                        container = build_container(segments, records, {source: payload})
+                        result, output = self.convert(container)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        data, headers = read_program_headers(output)
+                        host, embedded = headers[1:]
+                        self.assertEqual(embedded[2] - host[2], delta)
+                        for header, start in zip(headers[:2], (0, 0x80)):
+                            self.assertEqual(header[2] % header[7], header[3] % header[7])
+                            self.assertEqual(data[header[2]:header[2] + header[5]], payload[start:start + 0x100])
+                        self.assertEqual(data[embedded[2]:embedded[2] + size], payload[0x80 + delta:0x80 + delta + size])
+                        self.assertEqual((Path(self.directory) / "input.self").read_bytes(), container)
+
     def test_segments_after_the_recorded_comment_are_read_from_the_container(self):
         segments = default_segments() + [(SCE_COMMENT, 4, 0x15A0, 0x0, 0x20, 0x10), (PT_NOTE, 4, 0x15C0, 0x0, 0x18, 4),
                                          (SCE_VERSION, 4, 0x15D8, 0x0, 0x10, 1)]
diff --git a/tools/unwrap_self.py b/tools/unwrap_self.py
index ca98d9e02c..bf874360b6 100644
--- a/tools/unwrap_self.py
+++ b/tools/unwrap_self.py
@@ -186,6 +186,12 @@ def place_segments(data, headers, records):
         if header["type"] == PT_LOAD:
             continue
         if header["index"] in placed:
+            host = load_for(header["vaddr"], header["size"])
+            if host is not None:
+                offset = header["vaddr"] - host["vaddr"]
+                if (host["size"] and offset <= host["size"] and header["size"] <= host["size"] - offset
+                        and header["source"] == host["source"] + offset):
+                    header["host"] = host
             if header["size"] and (tail is None or header["offset"] > tail[0]):
                 tail = (header["offset"], header["source"] - header["offset"])
             continue

From 3086bd25ea2883c0ac7a550684f1684e1ce64bff Mon Sep 17 00:00:00 2001
From: lakhantheboss <61951686+lakhantheboss@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:38:24 +0530
Subject: [PATCH 135/218] fix(libSceNpGameIntent): return error for invalid
 arguments

Return NpGameIntentErrorInvalidArgument (0x80550004) instead of throwing APS5_INVALID_ARG_EX when invalid arguments are passed to sceNpGameIntentGetPropertyValueString or sceNpGameIntentReceiveIntent. Add regression test coverage in GuestNpGameIntent.
---
 core/libs/prx/libSceNpGameIntent/Export.cpp |  4 ++--
 core/libs/tests/GuestNpGameIntent.cpp       | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceNpGameIntent/Export.cpp b/core/libs/prx/libSceNpGameIntent/Export.cpp
index 751b4b1c5b..783411faca 100644
--- a/core/libs/prx/libSceNpGameIntent/Export.cpp
+++ b/core/libs/prx/libSceNpGameIntent/Export.cpp
@@ -19,7 +19,7 @@ extern "C" {
 
 int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize) {
  if (intentData == nullptr || key == nullptr || valueBuf == nullptr || bufSize == 0) {
-  APS5_INVALID_ARG_EX;
+  return NpGameIntentErrorInvalidArgument;
  }
 
  valueBuf[0] = '\0';
@@ -33,7 +33,7 @@ int APS5_VABI sceNpGameIntentInitialize(const void* initParam) {
 
 int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo) {
  if (intentInfo == nullptr) {
-  APS5_INVALID_ARG_EX;
+  return NpGameIntentErrorInvalidArgument;
  }
 
  intentInfo->user_id = NpGameIntentUserIdInvalid;
diff --git a/core/libs/tests/GuestNpGameIntent.cpp b/core/libs/tests/GuestNpGameIntent.cpp
index dd362cdad4..3ffb412f14 100644
--- a/core/libs/tests/GuestNpGameIntent.cpp
+++ b/core/libs/tests/GuestNpGameIntent.cpp
@@ -23,6 +23,7 @@ static bool Throws(TCall call) {
 }
 
 int main() {
+    constexpr int kInvalidArgument = -2141898748;
     constexpr int kIntentNotFound = -2141898746;
     constexpr int kValueNotFound = -2141898745;
 
@@ -42,9 +43,18 @@ int main() {
     Require(info.user_id == -1, "info user_id mismatch");
 
     Require(sceNpGameIntentInitialize(&initParam) == 0, "initialization failed");
+    Require(sceNpGameIntentReceiveIntent(nullptr) == kInvalidArgument, "null receive intent did not fail");
     Require(sceNpGameIntentReceiveIntent(&info) == kIntentNotFound, "receive intent mismatch");
 
     char buf[64]{};
+    Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", buf, sizeof(buf)) == kInvalidArgument,
+            "null intent data did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, nullptr, buf, sizeof(buf)) == kInvalidArgument,
+            "null key did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", nullptr, sizeof(buf)) == kInvalidArgument,
+            "null value buf did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, 0) == kInvalidArgument,
+            "zero buf size did not fail");
     Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, sizeof(buf)) == kValueNotFound,
             "get property value mismatch");
 

From d0269109d5e184a3be80fb6b6f3ad5d17657cb13 Mon Sep 17 00:00:00 2001
From: lakhantheboss <61951686+lakhantheboss@users.noreply.github.com>
Date: Sat, 24 Oct 2026 12:52:39 +0530
Subject: [PATCH 136/218] test(libSceNpGameIntent): remove obsolete app
 launcher throw assertion

---
 core/libs/tests/GuestNpGameIntent.cpp | 2 --
 1 file changed, 2 deletions(-)

diff --git a/core/libs/tests/GuestNpGameIntent.cpp b/core/libs/tests/GuestNpGameIntent.cpp
index 3ffb412f14..6e326bb65e 100644
--- a/core/libs/tests/GuestNpGameIntent.cpp
+++ b/core/libs/tests/GuestNpGameIntent.cpp
@@ -65,8 +65,6 @@ int main() {
     unsigned char appLauncherParam[0x28]{};
     *reinterpret_cast<std::uint64_t*>(appLauncherParam) = 0x28;
     Require(sceNpAppLauncherInitialize(appLauncherParam) == 0, "app launcher init failed");
-    Require(Throws<std::runtime_error>([] { sceNpAppLauncherLaunchApp(); }),
-            "app launcher launch must throw until implemented");
     Require(sceNpAppLauncherTerminate() == 0, "app launcher terminate failed");
     *reinterpret_cast<std::uint64_t*>(appLauncherParam) = 0x10;
     Require(sceNpAppLauncherInitialize(appLauncherParam) == 0,

From b08f1f0234be1947ea113aaffa5fe3a05fb37540 Mon Sep 17 00:00:00 2001
From: lakhantheboss <61951686+lakhantheboss@users.noreply.github.com>
Date: Sun, 25 Oct 2026 18:52:51 +0530
Subject: [PATCH 137/218] fix(libSceNpGameIntent): return errors for invalid
 arguments and uninitialized calls

---
 core/libs/prx/libSceNpGameIntent/Export.cpp | 45 ++++++++++++------
 core/libs/tests/GuestNpGameIntent.cpp       | 52 ++++++++++++++++++++-
 docs/dev/debt/libSceNpGameIntent.md         |  7 +--
 3 files changed, 84 insertions(+), 20 deletions(-)

diff --git a/core/libs/prx/libSceNpGameIntent/Export.cpp b/core/libs/prx/libSceNpGameIntent/Export.cpp
index 783411faca..dfea590bc3 100644
--- a/core/libs/prx/libSceNpGameIntent/Export.cpp
+++ b/core/libs/prx/libSceNpGameIntent/Export.cpp
@@ -1,4 +1,5 @@
 #include "prx/libSceNpGameIntent/include/Api.hpp"
+#include <atomic>
 #include <cstdint>
 #include <cstddef>
 #include <cstring>
@@ -8,43 +9,57 @@
 
 namespace {
 
+constexpr int NpGameIntentErrorNotInitialized = -2141898750;
 constexpr int NpGameIntentErrorInvalidArgument = -2141898748;
 constexpr int NpGameIntentErrorIntentNotFound = -2141898746;
 constexpr int NpGameIntentErrorValueNotFound = -2141898745;
 constexpr int NpGameIntentUserIdInvalid = -1;
 
+std::atomic_bool& NpGameIntentInitialized() {
+    static std::atomic_bool initialized{false};
+    return initialized;
+}
+
 }
 
 extern "C" {
 
 int APS5_VABI sceNpGameIntentGetPropertyValueString(const NpGameIntentData* intentData, const char* key, char* valueBuf, size_t bufSize) {
- if (intentData == nullptr || key == nullptr || valueBuf == nullptr || bufSize == 0) {
-  return NpGameIntentErrorInvalidArgument;
- }
+	if (!NpGameIntentInitialized()) {
+		return NpGameIntentErrorNotInitialized;
+	}
+	if (intentData == nullptr || key == nullptr || key[0] == '\0' || valueBuf == nullptr || bufSize == 0) {
+		return NpGameIntentErrorInvalidArgument;
+	}
 
- valueBuf[0] = '\0';
- return NpGameIntentErrorValueNotFound;
+	valueBuf[0] = '\0';
+	return NpGameIntentErrorValueNotFound;
 }
 
 int APS5_VABI sceNpGameIntentInitialize(const void* initParam) {
- (void)initParam;
- return 0;
+	(void)initParam;
+	NpGameIntentInitialized() = true;
+	return 0;
 }
 
 int APS5_VABI sceNpGameIntentReceiveIntent(NpGameIntentInfo* intentInfo) {
- if (intentInfo == nullptr) {
-  return NpGameIntentErrorInvalidArgument;
- }
+	if (!NpGameIntentInitialized()) {
+		return NpGameIntentErrorNotInitialized;
+	}
+	if (intentInfo == nullptr || intentInfo->size != 0x4140) {
+		return NpGameIntentErrorInvalidArgument;
+	}
 
- intentInfo->user_id = NpGameIntentUserIdInvalid;
- std::memset(intentInfo->intent_type, 0, sizeof(intentInfo->intent_type));
- std::memset(&intentInfo->intent_data, 0, sizeof(intentInfo->intent_data));
+	intentInfo->user_id = NpGameIntentUserIdInvalid;
+	std::memset(intentInfo->intent_type, 0, sizeof(intentInfo->intent_type));
+	std::memset(&intentInfo->intent_data, 0, sizeof(intentInfo->intent_data));
 
- return NpGameIntentErrorIntentNotFound;
+	return NpGameIntentErrorIntentNotFound;
 }
 
 int APS5_VABI sceNpGameIntentTerminate(void) {
- return 0;
+	NpGameIntentInitialized() = false;
+	return 0;
 }
 
 int APS5_VABI sceNpGameIntentInitParamInit(NpGameIntentInitParam* param) {
diff --git a/core/libs/tests/GuestNpGameIntent.cpp b/core/libs/tests/GuestNpGameIntent.cpp
index 6e326bb65e..8e74607008 100644
--- a/core/libs/tests/GuestNpGameIntent.cpp
+++ b/core/libs/tests/GuestNpGameIntent.cpp
@@ -4,6 +4,7 @@
 
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 
 static void Require(bool value, const char* what) {
@@ -23,6 +24,7 @@ static bool Throws(TCall call) {
 }
 
 int main() {
+    constexpr int kNotInitialized = -2141898750;
     constexpr int kInvalidArgument = -2141898748;
     constexpr int kIntentNotFound = -2141898746;
     constexpr int kValueNotFound = -2141898745;
@@ -42,26 +44,72 @@ int main() {
     Require(info.size == sizeof(NpGameIntentInfo), "info size mismatch");
     Require(info.user_id == -1, "info user_id mismatch");
 
+    char preBuf[64]{};
+    Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", preBuf, sizeof(preBuf)) == kNotInitialized,
+            "uninitialized get property string with null data must report not-initialized");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", preBuf, sizeof(preBuf)) == kNotInitialized,
+            "uninitialized get property string with valid data must report not-initialized");
+    Require(sceNpGameIntentReceiveIntent(nullptr) == kNotInitialized,
+            "uninitialized receive intent with null pointer must report not-initialized");
+    Require(sceNpGameIntentReceiveIntent(&info) == kNotInitialized,
+            "uninitialized receive intent with valid pointer must report not-initialized");
+
     Require(sceNpGameIntentInitialize(&initParam) == 0, "initialization failed");
     Require(sceNpGameIntentReceiveIntent(nullptr) == kInvalidArgument, "null receive intent did not fail");
-    Require(sceNpGameIntentReceiveIntent(&info) == kIntentNotFound, "receive intent mismatch");
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "mismatched struct size must report invalid argument");
+    info.size = 0;
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "zero size must report invalid argument");
+    info.size = 0x413f;
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "0x413f size must report invalid argument");
+    info.size = 0x4141;
+    Require(sceNpGameIntentReceiveIntent(&info) == kInvalidArgument, "0x4141 size must report invalid argument");
+    info.size = sizeof(NpGameIntentInfo);
 
     char buf[64]{};
     Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", buf, sizeof(buf)) == kInvalidArgument,
             "null intent data did not fail");
     Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, nullptr, buf, sizeof(buf)) == kInvalidArgument,
             "null key did not fail");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "", buf, sizeof(buf)) == kInvalidArgument,
+            "empty key did not fail");
     Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", nullptr, sizeof(buf)) == kInvalidArgument,
             "null value buf did not fail");
     Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, 0) == kInvalidArgument,
             "zero buf size did not fail");
-    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, sizeof(buf)) == kValueNotFound,
+
+    char canaryBuf[64]{};
+    std::memset(canaryBuf, 'X', sizeof(canaryBuf));
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", canaryBuf, 0) == kInvalidArgument,
+            "zero buf size canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on zero size error");
+    Require(sceNpGameIntentGetPropertyValueString(nullptr, "key", canaryBuf, sizeof(canaryBuf)) == kInvalidArgument,
+            "null data canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on null data error");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, nullptr, canaryBuf, sizeof(canaryBuf)) == kInvalidArgument,
+            "null key canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on null key error");
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "", canaryBuf, sizeof(canaryBuf)) == kInvalidArgument,
+            "empty key canary call did not fail");
+    Require(canaryBuf[0] == 'X', "buffer was modified on empty key error");
+
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", canaryBuf, sizeof(canaryBuf)) == kValueNotFound,
             "get property value mismatch");
+    Require(canaryBuf[0] == '\0', "valid call did not write terminator");
+
+    canaryBuf[0] = 'Y';
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", canaryBuf, 1) == kValueNotFound,
+            "bufSize 1 did not succeed");
+    Require(canaryBuf[0] == '\0', "bufSize 1 did not write terminator");
 
     Require(sceNpGameIntentVshInitialize() == 0, "vsh init failed");
     Require(sceNpGameIntentVshTerminate() == 0, "vsh terminate failed");
     Require(sceNpGameIntentTerminate() == 0, "terminate failed");
 
+    Require(sceNpGameIntentGetPropertyValueString(&info.intent_data, "key", buf, sizeof(buf)) == kNotInitialized,
+            "post-terminate get property value must report not-initialized");
+    Require(sceNpGameIntentReceiveIntent(&info) == kNotInitialized,
+            "post-terminate receive intent must report not-initialized");
+
     unsigned char appLauncherParam[0x28]{};
     *reinterpret_cast<std::uint64_t*>(appLauncherParam) = 0x28;
     Require(sceNpAppLauncherInitialize(appLauncherParam) == 0, "app launcher init failed");
diff --git a/docs/dev/debt/libSceNpGameIntent.md b/docs/dev/debt/libSceNpGameIntent.md
index 622b40a2c2..8476d2c449 100644
--- a/docs/dev/debt/libSceNpGameIntent.md
+++ b/docs/dev/debt/libSceNpGameIntent.md
@@ -2,11 +2,12 @@
 
 ### Silent stubs
 
-- [sceNpGameIntentVshInitialize, sceNpGameIntentVshTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - VSH initialization and termination return 0 without performing shell operations, matching `sceNpGameIntentInitialize` and `sceNpGameIntentTerminate`
-- [sceNpAppLauncherInitialize, sceNpAppLauncherTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - app-launcher lifecycle returns success without tracking launch state; `sceNpAppLauncherInitialize` accepts its init parameter without validation, following the silent-stub precedent of `sceNpGameIntentInitialize` — a title calls it early in boot, and returning success lets it continue
+- [sceNpGameIntentVshInitialize, sceNpGameIntentVshTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - VSH initialization and termination return 0 without performing shell operations
+- [sceNpAppLauncherInitialize, sceNpAppLauncherTerminate](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - app-launcher lifecycle returns success without tracking launch state; `sceNpAppLauncherInitialize` accepts its init parameter without validation — a title calls it early in boot, and returning success lets it continue
 
 ### Unknown function info
 
+- [sceNpGameIntentReceiveIntent, sceNpGameIntentGetPropertyValueString](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - firmware 13.42 emulator traces report `0x80553802` when called before `sceNpGameIntentInitialize` (precedence over argument validity), and `0x80553804` for invalid arguments (null pointer, empty key, or zero buffer size); `sceNpGameIntentTerminate` resetting the initialization state is modeled lifecycle behavior rather than independently hardware-verified. `sceNpGameIntentReceiveIntent` reportedly requires `info->size == 0x4140` on firmware 13.42, while the current AnyPS5 `NpGameIntentInfo` is `0x560` bytes (matching fpPS4) and `sceNpGameIntentInfoInit` sets that size. Consequently, an object initialized by the current helper is rejected by the receiver's measured size guard. The complete retail layout, its output field offsets, and the retail behavior of `sceNpGameIntentInfoInit` have not been verified, and expanding the type with unverified reserved bytes is not an evidence-backed solution.
 - [sceNpAppLauncherLaunchApp, sceNpGameIntentGetUdsNpComId, sceNpGameIntentLaunchApp, sceNpGameIntentLaunchApp2, sceNpGameIntentNotifyAppLaunched, sceNpSessionServiceGetJoinedPartySession, sceNpSessionServiceGetRunningGamePlayerSession and sceNpSessionServiceSendPlayerSessionInvitations](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpGameIntent.c). Call sites in a title's executable give a partial prototype: `sceNpAppLauncherLaunchApp` takes `(user_id, uri struct, context)` and returns int — throws because no launcher-service semantics are derivable. The rest are declared without parameters solely to resolve known imports and make no ABI claim.
 - [sceNpGameIntentInitParamInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L17) `SceNpGameIntentInitParam`; setting `size`, zeroing reserved bytes, and throwing on null pointer follow Sony SDK `*ParamInit` conventions but are unverified on retail hardware
-- [sceNpGameIntentInfoInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L28) `SceNpGameIntentInfo`; setting `size`, `user_id = -1`, zeroing fields, and throwing on null pointer match `sceNpGameIntentReceiveIntent` defaults but are unverified on retail hardware
+- [sceNpGameIntentInfoInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L28) `SceNpGameIntentInfo`; setting `size = 0x560`, `user_id = -1`, zeroing fields, and throwing on null pointer follow fpPS4 defaults, but reported firmware 13.42 behavior requires `0x4140` for `sceNpGameIntentReceiveIntent`, so the helper's `0x560` size does not match retail receiver defaults; the complete retail structure layout and retail behavior of `sceNpGameIntentInfoInit` remain unverified

From 59c7e535c0d2d6ea2c6e2ba0ac8e0ec5f752e105 Mon Sep 17 00:00:00 2001
From: lakhantheboss <61951686+lakhantheboss@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:21:19 +0530
Subject: [PATCH 138/218] docs(libSceNpGameIntent): concise technical debt
 entry for receive intent size guard

---
 docs/dev/debt/libSceNpGameIntent.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceNpGameIntent.md b/docs/dev/debt/libSceNpGameIntent.md
index 8476d2c449..cc0daa50c5 100644
--- a/docs/dev/debt/libSceNpGameIntent.md
+++ b/docs/dev/debt/libSceNpGameIntent.md
@@ -7,7 +7,7 @@
 
 ### Unknown function info
 
-- [sceNpGameIntentReceiveIntent, sceNpGameIntentGetPropertyValueString](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - firmware 13.42 emulator traces report `0x80553802` when called before `sceNpGameIntentInitialize` (precedence over argument validity), and `0x80553804` for invalid arguments (null pointer, empty key, or zero buffer size); `sceNpGameIntentTerminate` resetting the initialization state is modeled lifecycle behavior rather than independently hardware-verified. `sceNpGameIntentReceiveIntent` reportedly requires `info->size == 0x4140` on firmware 13.42, while the current AnyPS5 `NpGameIntentInfo` is `0x560` bytes (matching fpPS4) and `sceNpGameIntentInfoInit` sets that size. Consequently, an object initialized by the current helper is rejected by the receiver's measured size guard. The complete retail layout, its output field offsets, and the retail behavior of `sceNpGameIntentInfoInit` have not been verified, and expanding the type with unverified reserved bytes is not an evidence-backed solution.
+- [sceNpGameIntentReceiveIntent, sceNpGameIntentGetPropertyValueString](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - firmware 13.42 traces report `0x80553802` before `sceNpGameIntentInitialize` (precedence over argument validity), and `0x80553804` for invalid arguments (null pointer, empty key, or zero buffer size); `sceNpGameIntentTerminate` resetting initialized state is modeled lifecycle behavior rather than hardware-verified. `sceNpGameIntentReceiveIntent` reportedly requires `info->size == 0x4140` on firmware 13.42, while AnyPS5 `NpGameIntentInfo` is `0x560` bytes (matching fpPS4) and set by `sceNpGameIntentInfoInit`, so initialized objects are rejected by the receiver's measured size guard. Complete retail layout, output field offsets, and retail behavior of `sceNpGameIntentInfoInit` are unverified; expanding the type with unverified reserved bytes is not an evidence-backed solution.
 - [sceNpAppLauncherLaunchApp, sceNpGameIntentGetUdsNpComId, sceNpGameIntentLaunchApp, sceNpGameIntentLaunchApp2, sceNpGameIntentNotifyAppLaunched, sceNpSessionServiceGetJoinedPartySession, sceNpSessionServiceGetRunningGamePlayerSession and sceNpSessionServiceSendPlayerSessionInvitations](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - names and NIDs are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceNpGameIntent.c). Call sites in a title's executable give a partial prototype: `sceNpAppLauncherLaunchApp` takes `(user_id, uri struct, context)` and returns int — throws because no launcher-service semantics are derivable. The rest are declared without parameters solely to resolve known imports and make no ABI claim.
 - [sceNpGameIntentInitParamInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L17) `SceNpGameIntentInitParam`; setting `size`, zeroing reserved bytes, and throwing on null pointer follow Sony SDK `*ParamInit` conventions but are unverified on retail hardware
 - [sceNpGameIntentInfoInit](../../../core/libs/prx/libSceNpGameIntent/Export.cpp) (libSceNpGameIntent) - struct layout matches [fpPS4](https://github.com/red-prig/fpPS4/blob/master/src/np/ps4_libscenpgameintent.pas#L28) `SceNpGameIntentInfo`; setting `size = 0x560`, `user_id = -1`, zeroing fields, and throwing on null pointer follow fpPS4 defaults, but reported firmware 13.42 behavior requires `0x4140` for `sceNpGameIntentReceiveIntent`, so the helper's `0x560` size does not match retail receiver defaults; the complete retail structure layout and retail behavior of `sceNpGameIntentInfoInit` remain unverified

From d1dc3a5920b5017e1b958151eca93479187fb75f Mon Sep 17 00:00:00 2001
From: Ondra97 <47064087+Ondra97@users.noreply.github.com>
Date: Fri, 23 Oct 2026 21:30:37 +0200
Subject: [PATCH 139/218] fix(agc): check whole storage views for native
 surface overlap

---
 .../Graphics/src/ShaderResources.cpp          |  4 +-
 .../execution/NativeMultisampleDepth.cpp      | 43 +++++++++++++++++++
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
index f73b2c2b0e..fcedb7b71c 100644
--- a/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
+++ b/core/libs/prx/libSceAgcDriver/Graphics/src/ShaderResources.cpp
@@ -1185,9 +1185,9 @@ std::shared_ptr<StorageTexture> cachedStorageTexture(const Context& context, std
     const auto viewed = ArrayLayerWindow(requested, context.limits.maxImageArrayLayers);
     if (viewed.baseAddress != requested.baseAddress) guestBytes = 0;
     Require(viewed.dimension != TextureDimension::k2DMsaa, "storage image access to a multisampled texture is not implemented");
-    RequireNoMultisampleTarget(viewed.baseAddress, guestBytes != 0 ? static_cast<std::size_t>(guestBytes) : 1u, "a storage image access");
-    if (auto depth = DepthSurfaceStorage(context, words, viewed, mip)) return depth;
     const auto viewedBytes = guestBytes != 0 ? guestBytes : DescribeSurface(viewed).guestBytes;
+    RequireNoMultisampleTarget(viewed.baseAddress, static_cast<std::size_t>(viewedBytes), "a storage image access");
+    if (auto depth = DepthSurfaceStorage(context, words, viewed, mip)) return depth;
     if (viewedBytes >= (1ull << 30u)) {
         static std::atomic<std::uint64_t> large{0};
         const auto count = large.fetch_add(1) + 1;
diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
index b837e0411d..3d3531a577 100644
--- a/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/NativeMultisampleDepth.cpp
@@ -704,6 +704,48 @@ void CheckDepthAttachmentAlias() {
     std::puts("native depth attachment alias changes layout while retaining held GPU views");
 }
 
+void CheckStorageAliasRetirement() {
+    const auto device = OpenVulkanTestDevice();
+    Require(device != nullptr, "native depth storage alias requires Vulkan");
+    const auto context = device->graphicsContext();
+    constexpr VkExtent2D extent{5u, 3u};
+    constexpr std::uint32_t samples = 4u;
+    constexpr std::size_t prefix = 65536u;
+    const auto bytes = static_cast<std::size_t>(MultisampledDepthBytes_nid_no_patch(extent, 4u, samples));
+    TargetMemory memory(prefix + bytes), metadata(65536u);
+    std::memset(memory.Data(), 0x3c, prefix + bytes);
+    std::memset(metadata.Data(), 0, 65536u);
+    struct Cleanup {
+        AgcDriver::VulkanDevice& device;
+        ~Cleanup() { device.WaitIdle(); ClearCachedTextures(device.Device()); ClearDepthSurfaces(device.Device()); }
+    } cleanup{*device};
+    GuestTextureResource alias{};
+    alias.baseAddress = memory.Address();
+    alias.width = 256u;
+    alias.height = static_cast<std::uint32_t>((prefix + bytes) / 1024u);
+    alias.mipCount = alias.allocatedMipCount = 1u;
+    alias.dimension = TextureDimension::k2D;
+    alias.tileMode = TextureTileMode::kLinear;
+    alias.format = 22u;
+    alias.dstSelX = 0u;
+    alias.dstSelY = alias.dstSelZ = 4u;
+    alias.dstSelW = 5u;
+    auto cached = CachedStorageSurface(context, alias);
+    Require(cached != nullptr, "storage alias was not cached before native depth creation");
+    DepthTarget depth{memory.Address() + prefix, 0u, extent, VK_FORMAT_D32_SFLOAT, 0.0f, 0u, metadata.Address(), false, samples};
+    depth.depthSwizzle = 24u;
+    depth.iterate256 = depth.htilePipeAligned = depth.htileDepthOnly = true;
+    Require(DepthSurfaceView(context, depth) != VK_NULL_HANDLE && DepthSurfaceAt(depth.address), "storage alias fixture has no native depth owner");
+    auto disjoint = alias;
+    disjoint.height = static_cast<std::uint32_t>(prefix / 1024u);
+    Require(CachedStorageSurface(context, disjoint) != nullptr, "disjoint storage alias was not created");
+    Require(DepthSurfaceAt(depth.address), "storage access ending at native depth retired a disjoint owner");
+    Require(CachedStorageSurface(context, alias) != nullptr, "overlapping cached storage alias was not returned");
+    Require(!DepthSurfaceAt(depth.address), "a cached storage view kept a native depth owner inside its range");
+    for (std::size_t offset = 0u; offset < prefix + bytes; ++offset) Require(memory.Data()[offset] == std::byte{0x3c}, "retiring unwritten native depth changed guest bytes");
+    std::puts("cached storage span retires only intersecting native depth owners");
+}
+
 enum class ClearFault { None, PartialStore, CpuWrite, DepthWrite, BadMetadata, UnprovenDispatch, PendingWrite, Overlap, PossibleStore, CompletedPossibleStore, DriverDispatch, ImportWindowWrite };
 
 void CheckClearDispatch() {
@@ -1337,6 +1379,7 @@ int main(int argc, char** argv) {
         CheckDrawFeedback();
         const auto context = device->GetContext();
         if (argc == 1) CheckDepthAttachmentAlias();
+        if (argc == 1) CheckStorageAliasRetirement();
         std::unique_lock lock(AgcDriver::GuestMemory::GpuMutex());
         Require(DepthSupported(context, VK_FORMAT_D32_SFLOAT, 4u), "the native depth regression requires sampled D32 with four samples");
         if (argc == 2 && std::string_view(argv[1]) == "--clear-refusals") {

From 89fc74fa2bbb13f14a15cc9601d4a81d89c8ce04 Mon Sep 17 00:00:00 2001
From: "Brantley T. Roberson" <brantleyroberson43@gmail.com>
Date: Sun, 25 Oct 2026 09:47:29 -0400
Subject: [PATCH 140/218] ci: skip the upstream-only jobs in forks

Forks inherit three jobs that cannot succeed there. Pages progress fails
on `gh api repos/<fork>/pages` (HTTP 404) after every push to main that
touches core/libs/prx, Pages fails at the release download or the
deployment, and the Build linux job waits for the self-hosted
`anyps5` runner, which forks don't have, until GitHub drops it. These
jobs now run only when the repository is not a fork.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build.yml          | 2 +-
 .github/workflows/pages-progress.yml | 1 +
 .github/workflows/pages.yml          | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7813e6b53e..69f6ed8c96 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -421,7 +421,7 @@ jobs:
 
   linux:
     needs: eligibility
-    if: ${{ (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.linux)) && needs.eligibility.outputs.full == 'true' }}
+    if: ${{ !github.event.repository.fork && (github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.linux)) && needs.eligibility.outputs.full == 'true' }}
     runs-on: [self-hosted, linux, x64, anyps5]
     timeout-minutes: 60
     env:
diff --git a/.github/workflows/pages-progress.yml b/.github/workflows/pages-progress.yml
index 88c1f81d5a..5aa5f304a6 100644
--- a/.github/workflows/pages-progress.yml
+++ b/.github/workflows/pages-progress.yml
@@ -18,6 +18,7 @@ concurrency:
 
 jobs:
   progress:
+    if: ${{ !github.event.repository.fork }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 0dc28284b0..bf8d6a0313 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -33,7 +33,7 @@ concurrency:
 
 jobs:
   pages:
-    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
+    if: ${{ !github.event.repository.fork && (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') }}
     runs-on: ubuntu-latest
     environment:
       name: github-pages

From f30a7444a89ac8801d3ebf3f1e7665446bd06496 Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 03:24:03 +1300
Subject: [PATCH 141/218] test(savedata): unwind the null-input throw on
 Windows

guest_savedata_convert catches the runtime_error that the PRX raises for null arguments, so the target needs configure_windows_unwind like the other savedata targets that catch; without it the throw terminates the process on MinGW.
---
 core/libs/prx/libSceSaveData.native/CMakeLists.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/libs/prx/libSceSaveData.native/CMakeLists.txt b/core/libs/prx/libSceSaveData.native/CMakeLists.txt
index 6b03a2c86c..6cda0de4de 100644
--- a/core/libs/prx/libSceSaveData.native/CMakeLists.txt
+++ b/core/libs/prx/libSceSaveData.native/CMakeLists.txt
@@ -25,6 +25,7 @@ if(BUILD_TESTING)
     add_test_executable(guest_savedata_convert_tests ${LIBS_INCLUDE_DIR}/tests/GuestSaveDataConvert.cpp)
     target_include_directories(guest_savedata_convert_tests PRIVATE ${LIBS_INCLUDE_DIR})
     target_link_libraries(guest_savedata_convert_tests PRIVATE libSceSaveData.native libc)
+    configure_windows_unwind(guest_savedata_convert_tests)
     add_test(NAME guest_savedata_convert COMMAND guest_savedata_convert_tests)
     if(WIN32)
         set_tests_properties(guest_savedata_convert PROPERTIES ENVIRONMENT_MODIFICATION

From 7259cf0a8708aa625027f3f413ec778d317a48d0 Mon Sep 17 00:00:00 2001
From: plexerPK <160128888+plexerPK@users.noreply.github.com>
Date: Sun, 25 Oct 2026 00:17:27 +0200
Subject: [PATCH 142/218] fix(tools): shorten stubgen temporary filenames

---
 tools/stubgen.py            |  2 +-
 tools/tests/test_stubgen.py | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/tools/stubgen.py b/tools/stubgen.py
index 7426cd8aa2..436233cb23 100644
--- a/tools/stubgen.py
+++ b/tools/stubgen.py
@@ -187,7 +187,7 @@ def write_outputs(outputs):
             path = Path(filename).resolve()
             if path.is_dir():
                 raise IsADirectoryError(str(path))
-            with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", newline="\n", dir=path.parent, prefix=path.name + ".", suffix=".tmp", delete=False) as handle:
+            with tempfile.NamedTemporaryFile(mode="w", encoding="utf-8", newline="\n", dir=path.parent, prefix=".stubgen-", suffix=".tmp", delete=False) as handle:
                 temporary = Path(handle.name)
                 staged.append((temporary, path))
                 handle.write(content)
diff --git a/tools/tests/test_stubgen.py b/tools/tests/test_stubgen.py
index eedd1e3a09..41fab273fb 100644
--- a/tools/tests/test_stubgen.py
+++ b/tools/tests/test_stubgen.py
@@ -42,6 +42,34 @@ class StubgenTests(unittest.TestCase):
 
 
 class StubGeneratorTests(unittest.TestCase):
+    def test_long_output_names(self):
+        import subprocess
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory).resolve()
+            if os.name == "nt":
+                root = Path("\\\\?\\" + str(root))
+            limit = os.pathconf(root, "PC_NAME_MAX") if os.name == "posix" else 255
+            nids = root / "nids.txt"
+            nids.write_text("AAAAAAAAAAA\n", encoding="utf-8")
+            expected = stubgen.generate("libSceExample", ["AAAAAAAAAAA"], {})
+            for option, extra, content in (("--out", [], expected[0]),
+                                           ("--td-out", ["--td-only"], expected[1])):
+                for existing in (False, True):
+                    with self.subTest(option=option, existing=existing):
+                        output = root / ("a" * (limit - 4) + ".txt")
+                        output.write_bytes(b"previous output\n")
+                        if not existing:
+                            output.unlink()
+                        result = subprocess.run(
+                            [sys.executable, str(Path(stubgen.__file__)), "--module", "libSceExample",
+                             "--nids", str(nids), option, str(output), *extra],
+                            capture_output=True, text=True)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertEqual(output.read_text(encoding="utf-8"), content)
+                        self.assertEqual(nids.read_text(encoding="utf-8"), "AAAAAAAAAAA\n")
+                        self.assertEqual(set(root.iterdir()), {nids, output})
+                        output.unlink()
+
     @unittest.skipUnless(os.name == "nt", "Windows denies replacing read-only output files")
     def test_readonly_second_output_preserves_both_outputs(self):
         import subprocess

From a006b57dbba1c28e4173dc6be06e1dc478d0ff0b Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 03:54:56 +1300
Subject: [PATCH 143/218] fix(libc): declare the underflow_error destructor
 once in the public header

The new export is declared next to its siblings in prx/libc/include/Api.hpp and GuestUnderflowError.cpp uses the canonical declarations instead of local externs, which public_headers rejects.
---
 core/libs/prx/libc/include/Api.hpp      | 1 +
 core/libs/tests/GuestUnderflowError.cpp | 6 ++----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/core/libs/prx/libc/include/Api.hpp b/core/libs/prx/libc/include/Api.hpp
index c37482c644..0924da35d1 100644
--- a/core/libs/prx/libc/include/Api.hpp
+++ b/core/libs/prx/libc/include/Api.hpp
@@ -1265,6 +1265,7 @@ void APS5_VABI _ZNSt11range_errorD1Ev_nid_postfix(LibcException::ExceptionObject
 void APS5_VABI _ZNSt11range_errorD2Ev_nid_postfix(LibcException::ExceptionObject* self);
 void APS5_VABI _ZNSt11range_errorD0Ev_nid_postfix(LibcException::ExceptionObject* self);
 void APS5_VABI _ZNSt14overflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
+void APS5_VABI _ZNSt15underflow_errorD1Ev_nid_postfix(LibcException::ExceptionObject* self);
 void APS5_VABI _ZNSt8ios_base7failureD1Ev_nid_postfix(LibcException::ExceptionObject* self);
 void APS5_VABI _ZNSt8ios_base7failureD2Ev_nid_postfix(LibcException::ExceptionObject* self);
 void APS5_VABI _ZNSt8ios_base7failureD0Ev_nid_postfix(LibcException::ExceptionObject* self);
diff --git a/core/libs/tests/GuestUnderflowError.cpp b/core/libs/tests/GuestUnderflowError.cpp
index 4f91d5cfe3..b1bfda125c 100644
--- a/core/libs/tests/GuestUnderflowError.cpp
+++ b/core/libs/tests/GuestUnderflowError.cpp
@@ -1,10 +1,10 @@
+#include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstddef>
 #include <cstdlib>
 #include <cstring>
 
 struct TypeRecord { const void* const* vtable; const char* name; const TypeRecord* base; };
-struct Object { const void* vtable; const char* message; };
 struct Vtable { std::ptrdiff_t offset; const TypeRecord* type; const void* destroy; const void* deleteObject; const void* what; };
 
 extern "C" {
@@ -12,8 +12,6 @@ extern const TypeRecord _ZTISt13runtime_error_nid_postfix;
 extern const TypeRecord _ZTISt15underflow_error_nid_postfix;
 extern const Vtable _ZTVSt13runtime_error_nid_postfix;
 extern const Vtable _ZTVSt15underflow_error_nid_postfix;
-void APS5_VABI _ZNSt13runtime_errorC1EPKc_nid_postfix(Object*, const char*);
-void APS5_VABI _ZNSt15underflow_errorD1Ev_nid_postfix(Object*);
 }
 
 static void Require(bool value) { if (!value) std::abort(); }
@@ -27,7 +25,7 @@ int main() {
     const auto& runtimeTable = _ZTVSt13runtime_error_nid_postfix;
     Require(table.offset == 0 && table.type == &type);
     Require(table.destroy == runtimeTable.destroy && table.deleteObject == runtimeTable.deleteObject && table.what == runtimeTable.what);
-    Object object{};
+    LibcException::ExceptionObject object{};
     _ZNSt13runtime_errorC1EPKc_nid_postfix(&object, "value too small");
     Require(object.message != nullptr && std::strcmp(object.message, "value too small") == 0);
     _ZNSt15underflow_errorD1Ev_nid_postfix(&object);

From a81fcbfacdee052959f3ca7b21b4cdee2d28faf1 Mon Sep 17 00:00:00 2001
From: David <David.Samir.WD@gmail.com>
Date: Thu, 22 Oct 2026 03:17:04 +0100
Subject: [PATCH 144/218] feat(libkernel): sync each write on a file whose
 O_FSYNC flag is set

FreeBSD's F_SETFL may change O_FSYNC (FCNTLFLAGS), and vn_write then
writes with IO_SYNC. The flag now lives in the status table, and the
write entry points sync a regular file after the write while it is set.
---
 core/libs/prx/libkernel/CMakeLists.txt        |  10 ++
 .../File/include/DescriptorControl.hpp        |  14 +++
 .../libkernel/File/src/DescriptorControl.cpp  |  23 +++-
 core/libs/prx/libkernel/File/src/Open.cpp     |   1 +
 core/libs/prx/libkernel/File/src/Stdio.cpp    |   7 ++
 core/libs/tests/GuestKernelFcntl.cpp          |   2 +-
 core/libs/tests/GuestKernelFcntlSync.cpp      | 115 ++++++++++++++++++
 docs/dev/debt/libkernel.md                    |   2 +-
 8 files changed, 171 insertions(+), 3 deletions(-)
 create mode 100644 core/libs/tests/GuestKernelFcntlSync.cpp

diff --git a/core/libs/prx/libkernel/CMakeLists.txt b/core/libs/prx/libkernel/CMakeLists.txt
index b974a09d57..2e73b9940f 100644
--- a/core/libs/prx/libkernel/CMakeLists.txt
+++ b/core/libs/prx/libkernel/CMakeLists.txt
@@ -1947,6 +1947,16 @@ if(BUILD_TESTING)
     configure_windows_unwind(guest_append_writes_tests)
     add_test(NAME guest_append_writes COMMAND guest_append_writes_tests)
     set_tests_properties(guest_append_writes PROPERTIES TIMEOUT 20)
+    add_test_executable(guest_kernel_fcntl_sync_tests ${LIBS_INCLUDE_DIR}/tests/GuestKernelFcntlSync.cpp)
+    target_include_directories(guest_kernel_fcntl_sync_tests PRIVATE ${LIBS_INCLUDE_DIR})
+    target_link_libraries(guest_kernel_fcntl_sync_tests PRIVATE libkernel libc)
+    configure_windows_unwind(guest_kernel_fcntl_sync_tests)
+    add_test(NAME guest_kernel_fcntl_sync COMMAND guest_kernel_fcntl_sync_tests)
+    set_tests_properties(guest_kernel_fcntl_sync PROPERTIES TIMEOUT 15)
+    if(WIN32)
+        set_tests_properties(guest_kernel_fcntl_sync PROPERTIES ENVIRONMENT_MODIFICATION
+            "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
+    endif()
     if(WIN32)
         set_tests_properties(guest_kernel_fcntl guest_append_writes PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libkernel>")
diff --git a/core/libs/prx/libkernel/File/include/DescriptorControl.hpp b/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
index e927284888..1d307391d5 100644
--- a/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
+++ b/core/libs/prx/libkernel/File/include/DescriptorControl.hpp
@@ -2,6 +2,7 @@
 #define CORE_LIBS_PRX_LIBKERNEL_FILE_DESCRIPTORCONTROL_HPP
 
 #include <cstdint>
+#include <exception>
 
 namespace File {
 
@@ -17,6 +18,19 @@ void RememberPipe(int fd);
 void ShareDescriptor(int from, int to);
 void ForgetDescriptor(int fd);
 bool Appends(int fd);
+void SyncWrites(int fd);
+
+class WriteSync {
+public:
+    explicit WriteSync(int fd) : _fd(fd), _exceptions(std::uncaught_exceptions()) {}
+    ~WriteSync() noexcept(false) {
+        if (std::uncaught_exceptions() == _exceptions) SyncWrites(_fd);
+    }
+
+private:
+    int _fd;
+    int _exceptions;
+};
 bool IsVnode(int fd);
 bool IsCharacterDevice(int fd);
 
diff --git a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
index 34b7fe576a..bc6e9f09e1 100644
--- a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
+++ b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
@@ -36,6 +36,8 @@
 #include <unistd.h>
 #endif
 
+extern "C" int APS5_VABI sceKernelFsync(int fd);
+
 namespace {
 
 constexpr int GuestEintr = 4;
@@ -378,7 +380,6 @@ int ChangeStatus(int fd, Kind kind, int mask, int value, const char* function) {
     const int next = (status & ~mask) | (value & mask);
     const int changed = status ^ next;
     if ((changed & Asynchronous) && (kind == Kind::Pipe || kind == Kind::Socket || kind == Kind::Device)) Unsupported(function, "O_ASYNC", kind, fd);
-    if ((changed & Synchronous) && kind == Kind::File) Unsupported(function, "changing O_FSYNC", kind, fd);
     ApplyHostStatus(fd, kind, changed, next, function);
     status = next;
     return 0;
@@ -617,6 +618,21 @@ void ForgetDescriptor(int fd) {
     g_entries.erase(fd);
 }
 
+std::uint64_t g_synchronousWrites = 0;
+
+void SyncWrites(int fd) {
+    {
+        std::lock_guard lock(g_mutex);
+        const auto found = g_entries.find(fd);
+        if (found == g_entries.end() || !found->second.status || (*found->second.status & Synchronous) == 0) return;
+    }
+    if (Classify(fd, "write") != Kind::File) return;
+    if (const int result = sceKernelFsync(fd); result != 0)
+        throw std::runtime_error("write: syncing an O_FSYNC file failed, fd=" + std::to_string(fd) + ", error=" + std::to_string(result & 0xffff));
+    std::lock_guard lock(g_mutex);
+    ++g_synchronousWrites;
+}
+
 bool Appends(int fd) {
     std::lock_guard lock(g_mutex);
     const auto found = g_entries.find(fd);
@@ -650,3 +666,8 @@ bool IsVnode(int fd) {
 extern "C" bool DescriptorHasNoVnode_nid_no_patch(int fd) {
     return !File::IsVnode(fd) && !File::IsCharacterDevice(fd) && !File::IsRandomDevice(fd);
 }
+
+extern "C" std::uint64_t FileSynchronousWritesForTest_nid_no_patch() {
+    std::lock_guard lock(g_mutex);
+    return File::g_synchronousWrites;
+}
diff --git a/core/libs/prx/libkernel/File/src/Open.cpp b/core/libs/prx/libkernel/File/src/Open.cpp
index 57b71b5628..94bcf950e4 100644
--- a/core/libs/prx/libkernel/File/src/Open.cpp
+++ b/core/libs/prx/libkernel/File/src/Open.cpp
@@ -347,6 +347,7 @@ std::int64_t APS5_VABI sceKernelWrite(int d, const void* buf, std::size_t nbytes
         const char empty = 0;
         return sceKernelWrite(d, &empty, 0);
     }
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     auto n = NativeWrite(d, buf, nbytes);
     if (n < 0) return SceIoErrorFromErrno(errno);
diff --git a/core/libs/prx/libkernel/File/src/Stdio.cpp b/core/libs/prx/libkernel/File/src/Stdio.cpp
index 486416f762..d0fab409ea 100644
--- a/core/libs/prx/libkernel/File/src/Stdio.cpp
+++ b/core/libs/prx/libkernel/File/src/Stdio.cpp
@@ -1012,6 +1012,7 @@ int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int d, const void* buf, size_
     if (ExceedsTransferLimit(nbytes)) return PosixFailure(GUEST_EINVAL);
     if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return PosixFailure(error);
     if (FailPosixPositionedGuestSocket(d)) return -1;
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     char empty = 0;
     const auto result = NativePwrite(d, buf == nullptr ? &empty : buf, nbytes, offset);
@@ -1346,6 +1347,7 @@ int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset
 int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t offset) {
     if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     char empty = 0;
     const auto result = NativePwrite(d, nbytes == 0 && buf == nullptr ? &empty : buf, nbytes, offset);
@@ -1374,6 +1376,8 @@ static std::int64_t TransferIovecs(int d, const KernelIovec* guestIov, int iovcn
                                   : GuestSockets::Readv(d, reinterpret_cast<const GuestSockets::Iovec*>(iov), iovcnt);
         return result < 0 ? SceKernelError(*__error_nid_postfix()) : result;
     }
+    std::optional<File::WriteSync> sync;
+    if (write) sync.emplace(d);
     if (write) PrepareWriteIovecs(iov, iovcnt);
     if (!write && File::IsRandomDevice(d)) return ReadRandomIovecs(d, iov, iovcnt);
     if (!write) {
@@ -1445,6 +1449,7 @@ int64_t APS5_VABI sceKernelPread(int d, void* buf, size_t nbytes, int64_t offset
 int64_t APS5_VABI sceKernelPwrite(int d, const void* buf, size_t nbytes, int64_t offset) {
     if (const int error = PositionedArgumentError(d, buf == nullptr && nbytes != 0, offset)) return SceErrorFromErrno(error);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
+    const File::WriteSync sync(d);
     GuestArena::GuestArenaPrepareHostRead_nid_no_patch(buf, nbytes);
     const auto result = NativePwrite(d, buf, nbytes, offset);
     return result < 0 ? SceErrorFromErrno(errno) : result;
@@ -1474,6 +1479,7 @@ int64_t APS5_VABI sceKernelWritev(int d, const KernelIovec* guestIov, int iovcnt
         const auto result = GuestSockets::Writev(d, reinterpret_cast<const GuestSockets::Iovec*>(iov), iovcnt);
         return result < 0 ? SceKernelError(*__error_nid_postfix()) : result;
     }
+    const File::WriteSync sync(d);
     PrepareWriteIovecs(iov, iovcnt);
     const auto sharedResult = File::WritevSharedMemory_nid_no_patch(d, NativeIovecs(iov), iovcnt);
     if (sharedResult != -2) return sharedResult < 0 ? SceErrorFromErrno(errno) : sharedResult;
@@ -1501,6 +1507,7 @@ int64_t APS5_VABI sceKernelPwritev(int d, const KernelIovec* guestIov, int iovcn
     const auto* iov = vectors.data();
     if (offset < 0) return SceErrorFromErrno(GUEST_EINVAL);
     if (const auto error = PositionedGuestSocketError(d); error != 0) return error;
+    const File::WriteSync sync(d);
     PrepareWriteIovecs(iov, iovcnt);
     const auto sharedResult = File::PwritevSharedMemory_nid_no_patch(d, NativeIovecs(iov), iovcnt, offset);
     if (sharedResult != -2) return sharedResult < 0 ? SceErrorFromErrno(errno) : sharedResult;
diff --git a/core/libs/tests/GuestKernelFcntl.cpp b/core/libs/tests/GuestKernelFcntl.cpp
index 1e57a5b542..492633063c 100644
--- a/core/libs/tests/GuestKernelFcntl.cpp
+++ b/core/libs/tests/GuestKernelFcntl.cpp
@@ -283,7 +283,7 @@ static void FileFlagsRoundTrip() {
     char written[16]{};
     Require(sceKernelRead(reading, written, sizeof(written)) == 8 && std::memcmp(written, "Ybcdeabc", 8) == 0);
     Require(sceKernelClose(reading) == 0);
-    Require(ThrowsWith([appending] { fcntl_nid_postfix(appending, SetFlags, Append | 0x80); }, "fcntl: changing O_FSYNC on a file is not implemented"));
+    Require(fcntl_nid_postfix(appending, SetFlags, Append | 0x80) == 0 && fcntl_nid_postfix(appending, GetFlags) == (WriteOnly | Append | 0x80));
     Require(sceKernelClose(appending) == 0);
     std::remove("kernel_fcntl_probe.bin");
 }
diff --git a/core/libs/tests/GuestKernelFcntlSync.cpp b/core/libs/tests/GuestKernelFcntlSync.cpp
new file mode 100644
index 0000000000..9a5c0e8b3d
--- /dev/null
+++ b/core/libs/tests/GuestKernelFcntlSync.cpp
@@ -0,0 +1,115 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <chrono>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+#include <source_location>
+#include <string>
+
+namespace {
+
+struct Iovec {
+    const void* base;
+    std::size_t length;
+};
+
+}
+
+extern "C" {
+int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
+int APS5_VABI close_nid_postfix(int descriptor);
+int APS5_VABI dup_nid_postfix(int descriptor);
+int APS5_VABI pipe_nid_postfix(int* descriptors);
+int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
+std::int64_t APS5_VABI write_nid_postfix(int descriptor, const char* buffer, std::int64_t size);
+std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int descriptor, const void* buffer, std::size_t size, std::int64_t offset);
+std::int64_t APS5_VABI writev_nid_postfix(int descriptor, const Iovec* vectors, int count);
+std::int64_t APS5_VABI pwritev_nid_postfix(int descriptor, const Iovec* vectors, int count, std::int64_t offset);
+std::int64_t APS5_VABI pread_nid_postfix(int descriptor, void* buffer, std::size_t size, std::int64_t offset);
+std::uint64_t FileSynchronousWritesForTest_nid_no_patch();
+}
+
+namespace {
+
+constexpr int GetFlags = 3;
+constexpr int SetFlags = 4;
+constexpr int Synchronous = 0x80;
+constexpr int ReadWrite = 2;
+constexpr int Create = 0x200;
+
+void Require(bool condition, std::source_location location = std::source_location::current()) {
+    if (condition) return;
+    std::fprintf(stderr, "check failed at line %u\n", static_cast<unsigned>(location.line()));
+    std::exit(1);
+}
+
+std::uint64_t Synced() {
+    return FileSynchronousWritesForTest_nid_no_patch();
+}
+
+void Toggle(const std::string& path) {
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create, 0600);
+    Require(file >= 0);
+    Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) == 0);
+    auto before = Synced();
+    Require(write_nid_postfix(file, "a", 1) == 1 && Synced() == before);
+
+    Require(fcntl_nid_postfix(file, SetFlags, Synchronous) == 0);
+    Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) != 0);
+    before = Synced();
+    Require(write_nid_postfix(file, "b", 1) == 1 && Synced() == before + 1);
+    const Iovec vectors[] = {{"c", 1}, {"d", 1}};
+    Require(writev_nid_postfix(file, vectors, 2) == 2 && Synced() == before + 2);
+    Require(pwrite_nid_disambig1_nid_postfix(file, "x", 1, 10) == 1 && Synced() == before + 3);
+    const Iovec tail[] = {{"y", 1}, {"z", 1}};
+    Require(pwritev_nid_postfix(file, tail, 2, 11) == 2 && Synced() == before + 4);
+
+    const int duplicate = dup_nid_postfix(file);
+    Require(duplicate >= 0 && (fcntl_nid_postfix(duplicate, GetFlags) & Synchronous) != 0);
+    Require(write_nid_postfix(duplicate, "e", 1) == 1 && Synced() == before + 5);
+
+    Require(fcntl_nid_postfix(duplicate, SetFlags, 0) == 0);
+    Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) == 0);
+    before = Synced();
+    Require(write_nid_postfix(file, "f", 1) == 1 && Synced() == before);
+
+    char contents[13] = {};
+    Require(pread_nid_postfix(file, contents, sizeof(contents), 0) == 13);
+    Require(std::memcmp(contents, "abcdef", 6) == 0 && std::memcmp(contents + 10, "xyz", 3) == 0);
+    Require(close_nid_postfix(duplicate) == 0 && close_nid_postfix(file) == 0);
+}
+
+void OpenedSynchronous(const std::string& path) {
+    const int file = open_nid_postfix(path.c_str(), ReadWrite | Create | Synchronous, 0600);
+    Require(file >= 0 && (fcntl_nid_postfix(file, GetFlags) & Synchronous) != 0);
+    const auto before = Synced();
+    Require(write_nid_postfix(file, "h", 1) == 1 && Synced() == before + 1);
+    Require(close_nid_postfix(file) == 0);
+}
+
+void Pipes() {
+    int ends[2] = {-1, -1};
+    Require(pipe_nid_postfix(ends) == 0);
+    Require(fcntl_nid_postfix(ends[1], SetFlags, Synchronous) == 0);
+    Require((fcntl_nid_postfix(ends[1], GetFlags) & Synchronous) != 0);
+    const auto before = Synced();
+    Require(write_nid_postfix(ends[1], "i", 1) == 1 && Synced() == before);
+    Require(close_nid_postfix(ends[0]) == 0 && close_nid_postfix(ends[1]) == 0);
+}
+
+}
+
+int main() {
+    const auto stamp = std::to_string(std::chrono::steady_clock::now().time_since_epoch().count());
+    const std::string first = "anyps5-fsync-" + stamp + ".bin";
+    const std::string second = "anyps5-fsync-open-" + stamp + ".bin";
+    Toggle(first);
+    OpenedSynchronous(second);
+    Pipes();
+    std::filesystem::remove(first);
+    std::filesystem::remove(second);
+    std::puts("guest_kernel_fcntl_sync passed");
+    return 0;
+}
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 9a5292f65c..837bcb6168 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -257,7 +257,7 @@
 - [kill, killpg](../../../core/libs/prx/libkernel/System/src/Signals.cpp) (libkernel) follow FreeBSD's `kern_kill` and `killpg1` for the only guest process: `EINVAL` for signals outside 0 to 128 and for negative `killpg` process groups, signal 0 only checks that the target exists, and its own pid, 0 and minus its own pid (the guest is taken to lead its own process group) signal it through `raise`, so they share `raise`'s limits above. Any other pid, and -1, which skips the caller, report `ESRCH`, so `EPERM` is never reported
 - [sceKernelFcntl](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) runs the POSIX `fcntl` below and returns its guest errno as `SCE_KERNEL_ERROR_*`, the form the other `sceKernel` file exports use. The return values and error codes are unverified on a console
 - [Creating through a trailing slash](../../../core/libs/prx/libkernel/File/src/Open.cpp) (libkernel) - `open` and `sceKernelOpen` with `O_CREAT` on a missing name followed by a slash (`new/`) fail with `EINVAL` on Windows and with the host's `EISDIR` on Linux, where FreeBSD 11.4's `lookup()` (sys/kern/vfs_lookup.c) fails with `ENOENT` because only a directory may be created through a trailing slash
-- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. Changing `O_FSYNC` on a file, `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console
+- [fcntl](../../../core/libs/prx/libkernel/File/src/DescriptorControl.cpp) (libkernel) follows FreeBSD 11.4's [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L479-L799) and [`kern_dup`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L812) on file, directory, pipe and character device descriptors; a socket keeps the libSceNet path (`F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFL`, `F_SETFL` with `O_NONBLOCK`, `F_GETFD` and `F_SETFD`, `EINVAL` for every other command, see the next entry). On Linux and macOS a host socket that is not a guest socket, such as a standard descriptor a service manager connected to its journal, takes the flag handling of a pipe end and `FIONREAD` asks the host for its queued bytes (for a datagram socket Linux counts only the next datagram, where FreeBSD's [`soo_ioctl`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/sys/kern/sys_socket.c#L202-L205) counts every buffered byte); its record locks and read-ahead hints fail with `EBADF`, as FreeBSD fails them on a descriptor without a vnode, and `O_ASYNC` on it throws. The close-on-exec flag and the status flags live in a guest table, the status flags shared by `dup`, `dup2` and `F_DUPFD` as in an open file description; a descriptor the table has not seen, such as 0 to 2, starts from the host's flags, since the console's are not known. `F_DUPFD` and `F_DUPFD_CLOEXEC` return the lowest free host descriptor at or above the start, so the bound is the host table (`EMFILE` on Windows, `EINVAL` past `RLIMIT_NOFILE` on Linux), not the console's unknown `RLIMIT_NOFILE` and `kern.maxfilesperproc`. `O_NONBLOCK` switches a host pipe (`PIPE_NOWAIT` on Windows, where an empty read and a full write then report `EAGAIN`) and is only recorded on files, directories and the random device, as their reads never block; on a Windows console or other character device it throws. `O_ASYNC` on a pipe or character device (`SIGIO` is not delivered), `F_GETOWN`, `F_SETOWN` and `F_SETLK_REMOTE` throw; `O_FSYNC` set by `open` or `F_SETFL` makes each `write`, `pwrite`, `writev` and `pwritev` on a file sync it before returning, as `vn_write` adds `IO_SYNC`; the `sceKernelAioSubmitWriteCommands` writes are not synced, as whether the console's AIO honours the flag is unknown; on Linux a file opened with it keeps the host `O_SYNC` after `F_SETFL` clears it. `O_DIRECT`, `F_RDAHEAD` and `F_READAHEAD` are recorded as the hints they are. Record locks (`F_GETLK`, `F_SETLK`, `F_SETLKW` and their forms without `l_sysid`) use the host's POSIX locks on Linux and macOS. `F_GETLK` with `F_UNLCK` asks the host with `F_RDLCK`: as in [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) only another owner's overlapping write lock conflicts with either request. On Windows they follow [`kern_fcntl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L607-L752) and [`lf_advlockasync`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L433-L487) for the one guest process, which owns every lock: `EOVERFLOW` for an `SEEK_CUR` start past `OFF_MAX`, then `EBADF` for `F_RDLCK` without read access or `F_WRLCK` without write access and `EINVAL` for another type, then `EINVAL` and `EOVERFLOW` for the range; as [`lf_blocks`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_lockf.c#L866) never lets locks of one owner conflict, whichever descriptor or thread asks, `F_SETLK` and `F_SETLKW` then succeed without waiting and `F_GETLK` reports `F_UNLCK`, so no lock list is kept and merging, splitting and the release on close have nothing to change. Nothing is held on the host, since Windows byte-range locks are mandatory and would fail the guest's own reads and writes through other descriptors, so other host processes neither see these locks nor are seen; a lock from the end of a directory throws. The return values and error codes are unverified on a console
 - [fcntl on a guest socket](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) answers `F_DUPFD`, `F_DUP2FD`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC`, `F_GETFD`, `F_SETFD`, `F_GETFL` and `F_SETFL` and fails every other command with `EINVAL`; FreeBSD 11.4's `kern_fcntl` also handles `F_GETOWN` and `F_SETOWN` on a socket. `FD_CLOEXEC` is only recorded (there is no `exec`): `dup`, `dup2`, `F_DUPFD`, `F_DUP2FD` onto another descriptor and an accepted socket start without it, `F_DUP2FD` onto the same descriptor keeps it, and `SOCK_CLOEXEC`, `F_DUPFD_CLOEXEC`, `F_DUP2FD_CLOEXEC` and `F_SETFD` set it. None of this was measured on a console.
 - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) handle only `FIONBIO` and `FIONREAD` on a socket, and any other request there fails with `ENOTTY`. On the other descriptors they follow FreeBSD's [`kern_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L758), [`vn_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_vnops.c#L1488) and [`pipe_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_pipe.c#L1346): `FIONBIO` sets `O_NONBLOCK` as `fcntl` does, `FIOCLEX` and `FIONCLEX` set and clear the close-on-exec flag `F_GETFD` reports, and `FIONREAD` reports the size past the offset of a file, the queued bytes of a pipe's read end, 0 on its write end and `ENOTTY` on the random device, while it throws on a directory or another character device. Every termios request (group `t`, `TIOCGWINSZ` included) fails with `ENOTTY`, since those descriptors are taken as not a terminal, as in `tcgetattr`, and any other well-formed request throws. An input request with length 0 is not rejected as malformed: [`sys_ioctl`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/sys_generic.c#L703-L718) rejects it only in a kernel built without `COMPAT_FREEBSD4`, `COMPAT_FREEBSD5` and `COMPAT_43`, and which of these the PS5 kernel has is unknown. Stremio Plus (PPSA74126) imports `_ioctl` for its statically linked `tc*` functions, which send `TIOCGETA`, `TIOCSETA`, `TIOCSPGRP` and the other termios requests
 - [ioctl, _ioctl](../../../core/libs/prx/libkernel/Socket/src/Udp.cpp) (libkernel) do not pass a `sceNetSocket` socket to libSceNet as `fcntl` does. On Linux its number duplicates the host socket, so `FIONBIO` switches the host `O_NONBLOCK` but not the library's `SO_NBIO` state; on Windows it is a `NUL` placeholder, so `FIONREAD` and enabling `FIONBIO` throw as on a character device. `sceNetIoctl` handles both requests on such a socket.

From 60603545ffc824235b29f746e6e8fa6a7ed51c62 Mon Sep 17 00:00:00 2001
From: David <David.Samir.WD@gmail.com>
Date: Thu, 22 Oct 2026 08:47:57 +0100
Subject: [PATCH 145/218] fix(libkernel): keep the writev sync guard out of
 std::optional

Destroying a std::optional is noexcept in libstdc++, so a failing sync in
the guard's destructor ended the process with std::terminate instead of
raising the sync error. The Windows writev and pwritev path now uses a
plain guard, which does nothing for -1. The debt line names the synced
write calls and leaves out the AIO writes.
---
 core/libs/prx/libkernel/File/src/Stdio.cpp | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/core/libs/prx/libkernel/File/src/Stdio.cpp b/core/libs/prx/libkernel/File/src/Stdio.cpp
index d0fab409ea..e565b355d5 100644
--- a/core/libs/prx/libkernel/File/src/Stdio.cpp
+++ b/core/libs/prx/libkernel/File/src/Stdio.cpp
@@ -1376,8 +1376,7 @@ static std::int64_t TransferIovecs(int d, const KernelIovec* guestIov, int iovcn
                                   : GuestSockets::Readv(d, reinterpret_cast<const GuestSockets::Iovec*>(iov), iovcnt);
         return result < 0 ? SceKernelError(*__error_nid_postfix()) : result;
     }
-    std::optional<File::WriteSync> sync;
-    if (write) sync.emplace(d);
+    const File::WriteSync sync(write ? d : -1);
     if (write) PrepareWriteIovecs(iov, iovcnt);
     if (!write && File::IsRandomDevice(d)) return ReadRandomIovecs(d, iov, iovcnt);
     if (!write) {

From df0bfbee9084d53005f26db4b0f58264c6839871 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Franch?= <adriadam10@gmail.com>
Date: Sun, 25 Oct 2026 17:14:58 +0100
Subject: [PATCH 146/218] fix(libkernel): drop the duplicate sceKernelFsync
 declaration

---
 core/libs/prx/libkernel/File/src/DescriptorControl.cpp | 2 --
 1 file changed, 2 deletions(-)

diff --git a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
index bc6e9f09e1..f66cee5134 100644
--- a/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
+++ b/core/libs/prx/libkernel/File/src/DescriptorControl.cpp
@@ -36,8 +36,6 @@
 #include <unistd.h>
 #endif
 
-extern "C" int APS5_VABI sceKernelFsync(int fd);
-
 namespace {
 
 constexpr int GuestEintr = 4;

From 00f9c53495f7b9b6d26c2efa6f5b42b7bfa766a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Franch?= <adriadam10@gmail.com>
Date: Sun, 25 Oct 2026 17:17:22 +0100
Subject: [PATCH 147/218] fix(libkernel): declare the fcntl sync test's calls
 through the public header

---
 core/libs/tests/GuestKernelFcntlSync.cpp | 28 ++++--------------------
 1 file changed, 4 insertions(+), 24 deletions(-)

diff --git a/core/libs/tests/GuestKernelFcntlSync.cpp b/core/libs/tests/GuestKernelFcntlSync.cpp
index 9a5c0e8b3d..308778633a 100644
--- a/core/libs/tests/GuestKernelFcntlSync.cpp
+++ b/core/libs/tests/GuestKernelFcntlSync.cpp
@@ -1,3 +1,4 @@
+#include "prx/libkernel/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <chrono>
 #include <cstdint>
@@ -8,28 +9,7 @@
 #include <source_location>
 #include <string>
 
-namespace {
-
-struct Iovec {
-    const void* base;
-    std::size_t length;
-};
-
-}
-
-extern "C" {
-int APS5_VABI open_nid_postfix(const char* path, int flags, int mode);
-int APS5_VABI close_nid_postfix(int descriptor);
-int APS5_VABI dup_nid_postfix(int descriptor);
-int APS5_VABI pipe_nid_postfix(int* descriptors);
-int APS5_VABI fcntl_nid_postfix(int descriptor, int command, ...);
-std::int64_t APS5_VABI write_nid_postfix(int descriptor, const char* buffer, std::int64_t size);
-std::int64_t APS5_VABI pwrite_nid_disambig1_nid_postfix(int descriptor, const void* buffer, std::size_t size, std::int64_t offset);
-std::int64_t APS5_VABI writev_nid_postfix(int descriptor, const Iovec* vectors, int count);
-std::int64_t APS5_VABI pwritev_nid_postfix(int descriptor, const Iovec* vectors, int count, std::int64_t offset);
-std::int64_t APS5_VABI pread_nid_postfix(int descriptor, void* buffer, std::size_t size, std::int64_t offset);
-std::uint64_t FileSynchronousWritesForTest_nid_no_patch();
-}
+extern "C" std::uint64_t FileSynchronousWritesForTest_nid_no_patch();
 
 namespace {
 
@@ -60,10 +40,10 @@ void Toggle(const std::string& path) {
     Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) != 0);
     before = Synced();
     Require(write_nid_postfix(file, "b", 1) == 1 && Synced() == before + 1);
-    const Iovec vectors[] = {{"c", 1}, {"d", 1}};
+    const KernelIovec vectors[] = {{"c", 1}, {"d", 1}};
     Require(writev_nid_postfix(file, vectors, 2) == 2 && Synced() == before + 2);
     Require(pwrite_nid_disambig1_nid_postfix(file, "x", 1, 10) == 1 && Synced() == before + 3);
-    const Iovec tail[] = {{"y", 1}, {"z", 1}};
+    const KernelIovec tail[] = {{"y", 1}, {"z", 1}};
     Require(pwritev_nid_postfix(file, tail, 2, 11) == 2 && Synced() == before + 4);
 
     const int duplicate = dup_nid_postfix(file);

From e02cfc04c0dcdc36ae84919fce9bd6cb74f1a43f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Franch?= <adriadam10@gmail.com>
Date: Sun, 25 Oct 2026 17:17:44 +0100
Subject: [PATCH 148/218] fix(libkernel): declare the fcntl sync test's calls
 through the public header (amend)

---
 core/libs/tests/GuestKernelFcntlSync.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/core/libs/tests/GuestKernelFcntlSync.cpp b/core/libs/tests/GuestKernelFcntlSync.cpp
index 308778633a..e5f6665f44 100644
--- a/core/libs/tests/GuestKernelFcntlSync.cpp
+++ b/core/libs/tests/GuestKernelFcntlSync.cpp
@@ -40,10 +40,11 @@ void Toggle(const std::string& path) {
     Require((fcntl_nid_postfix(file, GetFlags) & Synchronous) != 0);
     before = Synced();
     Require(write_nid_postfix(file, "b", 1) == 1 && Synced() == before + 1);
-    const KernelIovec vectors[] = {{"c", 1}, {"d", 1}};
+    char c[] = "c", d[] = "d", y[] = "y", z[] = "z";
+    const KernelIovec vectors[] = {{c, 1}, {d, 1}};
     Require(writev_nid_postfix(file, vectors, 2) == 2 && Synced() == before + 2);
     Require(pwrite_nid_disambig1_nid_postfix(file, "x", 1, 10) == 1 && Synced() == before + 3);
-    const KernelIovec tail[] = {{"y", 1}, {"z", 1}};
+    const KernelIovec tail[] = {{y, 1}, {z, 1}};
     Require(pwritev_nid_postfix(file, tail, 2, 11) == 2 && Synced() == before + 4);
 
     const int duplicate = dup_nid_postfix(file);

From b56107fb3efab24ab3aca51183b97587f381063c Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 05:17:51 +1300
Subject: [PATCH 149/218] test(ajm): expect the Vorbis header packet
 invalid-parameter error for a null parameter

sceAjmDecWVorbisCreateHeaderPacket returns AJM_WVORBIS_ERROR_INVALID_PARAMETER (0x8A6E0001) for nullptr, not the generic 0x80B50001.
---
 core/libs/tests/GuestAjm.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestAjm.cpp b/core/libs/tests/GuestAjm.cpp
index 198edc4e08..b474290569 100644
--- a/core/libs/tests/GuestAjm.cpp
+++ b/core/libs/tests/GuestAjm.cpp
@@ -2025,6 +2025,6 @@ int main() {
     TestAt9GaplessSegments(context);
     TestAt9RunDecodesWholeInput(context);
     TestPcmResample(context);
-    Require(sceAjmDecWVorbisCreateHeaderPacket(nullptr) == static_cast<int>(0x80B50001));
+    Require(sceAjmDecWVorbisCreateHeaderPacket(nullptr) == static_cast<int>(0x8A6E0001));
     Require(sceAjmFinalize(context) == 0);
 }

From 814aea6f50903428d3629fb61c616a1db249afd3 Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 05:18:43 +1300
Subject: [PATCH 150/218] test(playgo): use the valid handle and the pinned
 error codes for the speed, ETA and prefetch checks

The implementation checks the handle first and reports BAD_HANDLE (0x80B20009) or BAD_POINTER (0x80B2000A); handle 1 is the valid one, so the pointer and speed cases use it and the invalid-handle cases expect BAD_HANDLE.
---
 core/libs/tests/GuestPlayGo.cpp | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/core/libs/tests/GuestPlayGo.cpp b/core/libs/tests/GuestPlayGo.cpp
index fc0b371eb8..2df22de9cc 100644
--- a/core/libs/tests/GuestPlayGo.cpp
+++ b/core/libs/tests/GuestPlayGo.cpp
@@ -262,12 +262,16 @@ int main(int argc, char** argv) {
     RunLayout(argv[0], "--scenario-with-chunk-table", {{"playgo-chunk.dat", ChunkTableFile()}, {"playgo-scenario.json", "{}"}});
     std::int64_t eta = -1;
     std::int32_t speed = -1;
-    Require(scePlayGoGetEta(-1, nullptr, 0, &eta) == static_cast<int>(0x80CF0002));
-    Require(scePlayGoGetEta(0x506C476F, nullptr, 0, nullptr) == static_cast<int>(0x80CF0004));
-    Require(scePlayGoGetInstallSpeed(-1, &speed) == static_cast<int>(0x80CF0002));
-    Require(scePlayGoGetInstallSpeed(0x506C476F, nullptr) == static_cast<int>(0x80CF0004));
-    Require(scePlayGoGetInstallSpeed(0x506C476F, &speed) == 0 && speed == 2);
-    Require(scePlayGoPrefetch(-1, nullptr, 0, 0) == static_cast<int>(0x80CF0002));
+    constexpr int validHandle = 1;
+    constexpr int badHandleError = static_cast<int>(0x80B20009);
+    constexpr int badPointerError = static_cast<int>(0x80B2000A);
+    Require(scePlayGoGetEta(-1, nullptr, 0, &eta) == badHandleError);
+    Require(scePlayGoGetEta(validHandle, nullptr, 0, nullptr) == badPointerError);
+    Require(scePlayGoGetInstallSpeed(-1, &speed) == badHandleError);
+    Require(scePlayGoGetInstallSpeed(0x506C476F, &speed) == badHandleError && speed == -1);
+    Require(scePlayGoGetInstallSpeed(validHandle, nullptr) == badPointerError);
+    Require(scePlayGoGetInstallSpeed(validHandle, &speed) == 0 && speed == 2);
+    Require(scePlayGoPrefetch(-1, nullptr, 0, 0) == badHandleError);
     RunLayout(argv[0], "--scenario-only", {{"playgo-scenario.json", "{}"}});
     RunLayout(argv[0], "--ficm-only", {{"playgo-ficm.dat", "x"}});
     RunLayout(argv[0], "--hash-table-only", {{"playgo-hash-table.dat", "x"}});

From 8c7b35c6725448e8dd43e9ca76715c5b62b8e5d0 Mon Sep 17 00:00:00 2001
From: slopgobblercobbler <slopgobblercobbler@users.noreply.github.com>
Date: Sun, 25 Oct 2026 02:28:42 +0100
Subject: [PATCH 151/218] feat(libkernel): complete FreeBSD 11.4 errno parity
 (ENOTRECOVERABLE and EOWNERDEAD)

---
 core/libs/prx/libkernel/KernelErrors.hpp | 2 ++
 core/libs/tests/KernelError.cpp          | 7 +++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libkernel/KernelErrors.hpp b/core/libs/prx/libkernel/KernelErrors.hpp
index b7d37ba4f2..e3e5b759fd 100644
--- a/core/libs/prx/libkernel/KernelErrors.hpp
+++ b/core/libs/prx/libkernel/KernelErrors.hpp
@@ -99,5 +99,7 @@ inline constexpr int SCE_KERNEL_ERROR_ENOLINK = SceKernelError(91);
 inline constexpr int SCE_KERNEL_ERROR_EPROTO = SceKernelError(92);
 inline constexpr int SCE_KERNEL_ERROR_ENOTCAPABLE = SceKernelError(93);
 inline constexpr int SCE_KERNEL_ERROR_ECAPMODE = SceKernelError(94);
+inline constexpr int SCE_KERNEL_ERROR_ENOTRECOVERABLE = SceKernelError(95);
+inline constexpr int SCE_KERNEL_ERROR_EOWNERDEAD = SceKernelError(96);
 
 #endif
diff --git a/core/libs/tests/KernelError.cpp b/core/libs/tests/KernelError.cpp
index 52c41c28db..d0c1aa0bac 100644
--- a/core/libs/tests/KernelError.cpp
+++ b/core/libs/tests/KernelError.cpp
@@ -12,14 +12,17 @@ static void Require(bool value) { if (!value) throw std::runtime_error("Kernel e
 
 int main() {
     *__error_nid_postfix() = 123;
-    const std::array<std::pair<std::int32_t, std::int32_t>, 6> cases{{
+    const std::array<std::pair<std::int32_t, std::int32_t>, 8> cases{{
         {0, 0}, {1, SCE_KERNEL_ERROR_EPERM}, {2, SCE_KERNEL_ERROR_ENOENT},
-        {4, SCE_KERNEL_ERROR_EINTR}, {14, SCE_KERNEL_ERROR_EFAULT}, {22, SCE_KERNEL_ERROR_EINVAL}
+        {4, SCE_KERNEL_ERROR_EINTR}, {14, SCE_KERNEL_ERROR_EFAULT}, {22, SCE_KERNEL_ERROR_EINVAL},
+        {95, SCE_KERNEL_ERROR_ENOTRECOVERABLE}, {96, SCE_KERNEL_ERROR_EOWNERDEAD}
     }};
     for (const auto [input, expected] : cases) {
         Require(sceKernelError(input) == expected);
         Require(*__error_nid_postfix() == 123);
     }
+    Require(SCE_KERNEL_ERROR_ENOTRECOVERABLE == static_cast<std::int32_t>(0x8002005fu));
+    Require(SCE_KERNEL_ERROR_EOWNERDEAD == static_cast<std::int32_t>(0x80020060u));
     Require(sceKernelError(-1) == static_cast<std::int32_t>(0x8001ffffu));
     Require(sceKernelError(std::numeric_limits<std::int32_t>::max()) == 0x1ffff);
     Require(sceKernelError(std::numeric_limits<std::int32_t>::min()) == 0x20000);

From 31a69542058e8272820a20a7bab4d44f2ec1a2cf Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 05:39:51 +1300
Subject: [PATCH 152/218] test(playgo): initialize and open PlayGo for the
 valid-handle checks

The speed, ETA and prefetch checks now take their valid handle from scePlayGoInitialize and scePlayGoOpen in the same process and close it afterwards, instead of assuming handle 1.
---
 core/libs/tests/GuestPlayGo.cpp | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestPlayGo.cpp b/core/libs/tests/GuestPlayGo.cpp
index 2df22de9cc..76bfd50679 100644
--- a/core/libs/tests/GuestPlayGo.cpp
+++ b/core/libs/tests/GuestPlayGo.cpp
@@ -262,7 +262,10 @@ int main(int argc, char** argv) {
     RunLayout(argv[0], "--scenario-with-chunk-table", {{"playgo-chunk.dat", ChunkTableFile()}, {"playgo-scenario.json", "{}"}});
     std::int64_t eta = -1;
     std::int32_t speed = -1;
-    constexpr int validHandle = 1;
+    PlayGoInitParams fixtureInit{};
+    int validHandle = -1;
+    Require(scePlayGoInitialize(&fixtureInit) == 0);
+    Require(scePlayGoOpen(&validHandle, nullptr) == 0);
     constexpr int badHandleError = static_cast<int>(0x80B20009);
     constexpr int badPointerError = static_cast<int>(0x80B2000A);
     Require(scePlayGoGetEta(-1, nullptr, 0, &eta) == badHandleError);
@@ -272,6 +275,7 @@ int main(int argc, char** argv) {
     Require(scePlayGoGetInstallSpeed(validHandle, nullptr) == badPointerError);
     Require(scePlayGoGetInstallSpeed(validHandle, &speed) == 0 && speed == 2);
     Require(scePlayGoPrefetch(-1, nullptr, 0, 0) == badHandleError);
+    Require(scePlayGoClose(validHandle) == 0);
     RunLayout(argv[0], "--scenario-only", {{"playgo-scenario.json", "{}"}});
     RunLayout(argv[0], "--ficm-only", {{"playgo-ficm.dat", "x"}});
     RunLayout(argv[0], "--hash-table-only", {{"playgo-hash-table.dat", "x"}});

From c889c1c742cfc422ec0d027862a4d948b3e0f58a Mon Sep 17 00:00:00 2001
From: Alexandre <caramel.alexandre@gmail.com>
Date: Thu, 22 Oct 2026 17:21:39 +0200
Subject: [PATCH 153/218] feat(libSceNpWebApi): add user contexts, requests and
 push event callbacks offline

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RoucYS7mQpV23WDUEwXLuU
---
 core/libs/prx/libSceNpWebApi/Export.cpp      | 181 ++++++++++++++---
 core/libs/prx/libSceNpWebApi/include/Api.hpp |  28 ++-
 core/libs/tests/GuestNpWebApi.cpp            | 195 ++++++++++++++++++-
 docs/dev/debt/libSceNpWebApi.md              |   4 +-
 4 files changed, 367 insertions(+), 41 deletions(-)

diff --git a/core/libs/prx/libSceNpWebApi/Export.cpp b/core/libs/prx/libSceNpWebApi/Export.cpp
index c78414d680..269bbec537 100644
--- a/core/libs/prx/libSceNpWebApi/Export.cpp
+++ b/core/libs/prx/libSceNpWebApi/Export.cpp
@@ -1,51 +1,133 @@
 #include "prx/libSceNpWebApi/include/Api.hpp"
 #include "SceTypes.hpp"
+#include "prx/libc/include/ApplicationHeap.hpp"
 #include "prx/libc/include/General.hpp"
+#include "prx/libSceUserService/UserService.hpp"
 #include <cstddef>
 #include <cstdint>
+#include <cstring>
 #include <mutex>
+#include <stdexcept>
 #include <unordered_map>
 #include <unordered_set>
 
 static constexpr int SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT = static_cast<int>(0x80552902);
+static constexpr int SCE_NP_WEBAPI_ERROR_INVALID_LIB_CONTEXT_ID = static_cast<int>(0x80552903);
 static constexpr int SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND = static_cast<int>(0x80552904);
+static constexpr int SCE_NP_WEBAPI_ERROR_USER_CONTEXT_NOT_FOUND = static_cast<int>(0x80552905);
+static constexpr int SCE_NP_WEBAPI_ERROR_REQUEST_NOT_FOUND = static_cast<int>(0x80552906);
+static constexpr int SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN = static_cast<int>(0x80552907);
+static constexpr int SCE_NP_WEBAPI_ERROR_INVALID_CONTENT_PARAMETER = static_cast<int>(0x80552908);
+static constexpr int SCE_NP_WEBAPI_ERROR_ABORTED = static_cast<int>(0x80552909);
+static constexpr int SCE_NP_WEBAPI_ERROR_USER_CONTEXT_ALREADY_EXIST = static_cast<int>(0x8055290A);
 static constexpr int SCE_NP_WEBAPI_ERROR_PUSH_EVENT_FILTER_NOT_FOUND = static_cast<int>(0x8055290B);
+static constexpr int SCE_NP_WEBAPI_ERROR_PUSH_EVENT_CALLBACK_NOT_FOUND = static_cast<int>(0x8055290C);
 static constexpr int SCE_NP_WEBAPI_ERROR_HANDLE_NOT_FOUND = static_cast<int>(0x8055290D);
 static constexpr int SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_FILTER_NOT_FOUND = static_cast<int>(0x8055290E);
+static constexpr int SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_CALLBACK_NOT_FOUND = static_cast<int>(0x8055290F);
 static constexpr int SCE_NP_WEBAPI_ERROR_SIGNED_IN_USER_NOT_FOUND = static_cast<int>(0x80552910);
 static constexpr int SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_MAX = static_cast<int>(0x8055291A);
 
+static constexpr int SCE_NP_WEBAPI_HTTP_METHOD_DELETE = 3;
+static constexpr std::uint32_t SCE_NP_INVALID_SERVICE_LABEL = 0xFFFFFFFF;
+static constexpr std::uint32_t SDK_VERSION_1_00 = 0x01000000;
+static constexpr std::uint32_t SDK_VERSION_2_00 = 0x02000000;
+static constexpr std::uint32_t SDK_VERSION_2_50 = 0x02500000;
+
 namespace {
 
+struct Request {
+    bool aborted;
+};
+
+struct UserContext {
+    int userId;
+    std::unordered_map<std::int64_t, Request> requests;
+    std::unordered_set<int> pushEventCallbacks;
+    std::unordered_set<int> servicePushEventCallbacks;
+};
+
 struct LibraryContext {
     int libHttpCtxId;
     std::size_t poolSize;
     std::unordered_set<int> handles;
     std::unordered_set<int> pushEventFilters;
+    std::unordered_map<int, UserContext> userContexts;
+};
+
+struct UserContextLookup {
+    int error;
+    LibraryContext* library;
+    UserContext* user;
+};
+
+struct RequestLookup {
+    int error;
+    UserContext* user;
+    Request* request;
 };
 
 std::mutex contextsMutex;
 std::unordered_map<int, LibraryContext> contexts;
 int lastContext = 0;
 int lastObject = 0;
+int lastUserContext = 0;
+std::int64_t lastRequest = 0;
 
 int nextObject() {
     lastObject = lastObject % 0xefffffff + 1;
     return lastObject;
 }
 
+std::uint32_t compiledSdkVersion() {
+    const auto* process = static_cast<const std::byte*>(ApplicationProcessParameters_nid_no_patch());
+    std::uint32_t version;
+    std::memcpy(&version, process + 16, sizeof(version));
+    return version;
+}
+
+UserContextLookup findUserContext(int titleUserCtxId) {
+    const auto library = contexts.find(titleUserCtxId >> 16);
+    if (library == contexts.end()) return {SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND, nullptr, nullptr};
+    const auto user = library->second.userContexts.find(titleUserCtxId);
+    if (user == library->second.userContexts.end()) return {SCE_NP_WEBAPI_ERROR_USER_CONTEXT_NOT_FOUND, &library->second, nullptr};
+    return {0, &library->second, &user->second};
+}
+
+RequestLookup findRequest(std::int64_t requestId) {
+    const auto lookup = findUserContext(static_cast<int>(requestId >> 32));
+    if (lookup.error != 0) return {lookup.error, nullptr, nullptr};
+    const auto request = lookup.user->requests.find(requestId);
+    if (request == lookup.user->requests.end()) return {SCE_NP_WEBAPI_ERROR_REQUEST_NOT_FOUND, lookup.user, nullptr};
+    return {0, lookup.user, &request->second};
+}
+
 }
 
 extern "C" {
 
-int APS5_VABI sceNpWebApiAbortRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiAbortRequest(std::int64_t requestId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findRequest(requestId);
+    if (lookup.error != 0) return lookup.error;
+    lookup.request->aborted = true;
     return 0;
 }
 
-int APS5_VABI sceNpWebApiCreateContext() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiCreateContext(int libCtxId, const void* onlineId) {
+    if (libCtxId >= 0x8000) return SCE_NP_WEBAPI_ERROR_INVALID_LIB_CONTEXT_ID;
+    if (!onlineId) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto context = contexts.find(libCtxId);
+    if (context == contexts.end()) return SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND;
+    auto& userContexts = context->second.userContexts;
+    for (const auto& [id, user] : userContexts) {
+        if (user.userId == USER_SERVICE_INITIAL_USER_ID) return SCE_NP_WEBAPI_ERROR_USER_CONTEXT_ALREADY_EXIST;
+    }
+    lastUserContext = lastUserContext % 0xffff + 1;
+    const int titleUserCtxId = (libCtxId << 16) | lastUserContext;
+    userContexts.emplace(titleUserCtxId, UserContext{USER_SERVICE_INITIAL_USER_ID, {}, {}, {}});
+    return titleUserCtxId;
 }
 
 int APS5_VABI sceNpWebApiCreateHandle(int libCtxId) {
@@ -67,14 +149,26 @@ int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterP
     return filter;
 }
 
-int APS5_VABI sceNpWebApiCreateRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiCreateRequest(int titleUserCtxId, const char* apiGroup, const char* path, int method, const NpWebApiContentParameter* contentParameter, std::int64_t* requestId) {
+    if (!apiGroup || !path) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    if (contentParameter && contentParameter->contentLength != 0 && !contentParameter->contentType) return SCE_NP_WEBAPI_ERROR_INVALID_CONTENT_PARAMETER;
+    if (method > SCE_NP_WEBAPI_HTTP_METHOD_DELETE && compiledSdkVersion() >= SDK_VERSION_2_50) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    lastRequest = lastRequest % 0xffffffff + 1;
+    const std::int64_t base = static_cast<std::int64_t>(titleUserCtxId) << 32;
+    std::int64_t id = base | lastRequest;
+    while (lookup.user->requests.contains(id)) --id;
+    if (id <= base) throw std::runtime_error("sceNpWebApiCreateRequest: every request id of the user context is in use");
+    lookup.user->requests.emplace(id, Request{false});
+    if (requestId) *requestId = id;
     return 0;
 }
 
 int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, std::uint32_t npServiceLabel, const void* filterParam, std::size_t filterParamNum) {
-    (void)npServiceLabel;
     if (!npServiceName || !filterParam || filterParamNum == 0) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    if (npServiceLabel == SCE_NP_INVALID_SERVICE_LABEL && compiledSdkVersion() >= SDK_VERSION_2_00) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
     std::lock_guard lock(contextsMutex);
     const auto context = contexts.find(libCtxId);
     if (context == contexts.end()) return SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND;
@@ -82,8 +176,11 @@ int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId
     return SCE_NP_WEBAPI_ERROR_SIGNED_IN_USER_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiDeleteContext() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiDeleteContext(int titleUserCtxId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    lookup.library->userContexts.erase(titleUserCtxId);
     return 0;
 }
 
@@ -101,8 +198,11 @@ int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId) {
     return context->second.pushEventFilters.erase(filterId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_PUSH_EVENT_FILTER_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiDeleteRequest() {
-    NotImplemented_nid_no_patch(__func__);
+int APS5_VABI sceNpWebApiDeleteRequest(std::int64_t requestId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findRequest(requestId);
+    if (lookup.error != 0) return lookup.error;
+    lookup.user->requests.erase(requestId);
     return 0;
 }
 
@@ -133,7 +233,7 @@ int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize) {
     for (int attempt = 0; attempt < 0x7fff; ++attempt) {
         lastContext = lastContext % 0x7fff + 1;
         if (contexts.contains(lastContext)) continue;
-        contexts[lastContext] = {libHttpCtxId, poolSize, {}, {}};
+        contexts[lastContext] = {libHttpCtxId, poolSize, {}, {}, {}};
         return lastContext;
     }
     return SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_MAX;
@@ -144,19 +244,40 @@ int APS5_VABI sceNpWebApiReadData() {
     return 0;
 }
 
-int APS5_VABI sceNpWebApiRegisterPushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiRegisterPushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg) {
+    (void)userArg;
+    if (!callback && compiledSdkVersion() >= SDK_VERSION_1_00) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    if (!lookup.library->pushEventFilters.contains(filterId) && compiledSdkVersion() >= SDK_VERSION_2_50) return SCE_NP_WEBAPI_ERROR_PUSH_EVENT_FILTER_NOT_FOUND;
+    const auto callbackId = nextObject();
+    lookup.user->pushEventCallbacks.insert(callbackId);
+    return callbackId;
 }
 
-int APS5_VABI sceNpWebApiRegisterServicePushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiRegisterServicePushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg) {
+    (void)filterId;
+    (void)userArg;
+    if (!callback && compiledSdkVersion() >= SDK_VERSION_1_00) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    if (compiledSdkVersion() >= SDK_VERSION_2_50) return SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_FILTER_NOT_FOUND;
+    if (!callback) return SCE_NP_WEBAPI_ERROR_INVALID_ARGUMENT;
+    const auto callbackId = nextObject();
+    lookup.user->servicePushEventCallbacks.insert(callbackId);
+    return callbackId;
 }
 
-int APS5_VABI sceNpWebApiSendRequest() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiSendRequest(std::int64_t requestId, const void* data, std::size_t dataSize) {
+    (void)data;
+    (void)dataSize;
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findRequest(requestId);
+    if (lookup.error != 0) return lookup.error;
+    if (lookup.request->aborted) return SCE_NP_WEBAPI_ERROR_ABORTED;
+    return SCE_NP_WEBAPI_ERROR_NOT_SIGNED_IN;
 }
 
 int APS5_VABI sceNpWebApiTerminate(int libCtxId) {
@@ -164,14 +285,18 @@ int APS5_VABI sceNpWebApiTerminate(int libCtxId) {
     return contexts.erase(libCtxId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_LIB_CONTEXT_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiUnregisterPushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiUnregisterPushEventCallback(int titleUserCtxId, int callbackId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    return lookup.user->pushEventCallbacks.erase(callbackId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_PUSH_EVENT_CALLBACK_NOT_FOUND;
 }
 
-int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback() {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback(int titleUserCtxId, int callbackId) {
+    std::lock_guard lock(contextsMutex);
+    const auto lookup = findUserContext(titleUserCtxId);
+    if (lookup.error != 0) return lookup.error;
+    return lookup.user->servicePushEventCallbacks.erase(callbackId) != 0 ? 0 : SCE_NP_WEBAPI_ERROR_SERVICE_PUSH_EVENT_CALLBACK_NOT_FOUND;
 }
 
 int APS5_VABI sceNpWebApiUtilityParseNpId() {
diff --git a/core/libs/prx/libSceNpWebApi/include/Api.hpp b/core/libs/prx/libSceNpWebApi/include/Api.hpp
index 567364a9bf..ec9ce3c836 100644
--- a/core/libs/prx/libSceNpWebApi/include/Api.hpp
+++ b/core/libs/prx/libSceNpWebApi/include/Api.hpp
@@ -2,30 +2,38 @@
 
 #include "SceTypes.hpp"
 
+struct NpWebApiContentParameter {
+    std::uint64_t contentLength;
+    const char* contentType;
+    std::uint8_t reserved[16];
+};
+
+static_assert(sizeof(NpWebApiContentParameter) == 32);
+
 extern "C" {
 
-int APS5_VABI sceNpWebApiAbortRequest();
-int APS5_VABI sceNpWebApiCreateContext();
+int APS5_VABI sceNpWebApiAbortRequest(std::int64_t requestId);
+int APS5_VABI sceNpWebApiCreateContext(int libCtxId, const void* onlineId);
 int APS5_VABI sceNpWebApiCreateHandle(int libCtxId);
 int APS5_VABI sceNpWebApiCreatePushEventFilter(int libCtxId, const void* filterParam, std::size_t filterParamNum);
-int APS5_VABI sceNpWebApiCreateRequest();
+int APS5_VABI sceNpWebApiCreateRequest(int titleUserCtxId, const char* apiGroup, const char* path, int method, const NpWebApiContentParameter* contentParameter, std::int64_t* requestId);
 int APS5_VABI sceNpWebApiCreateServicePushEventFilter(int libCtxId, int handleId, const char* npServiceName, std::uint32_t npServiceLabel, const void* filterParam, std::size_t filterParamNum);
-int APS5_VABI sceNpWebApiDeleteContext();
+int APS5_VABI sceNpWebApiDeleteContext(int titleUserCtxId);
 int APS5_VABI sceNpWebApiDeleteHandle(int libCtxId, int handleId);
 int APS5_VABI sceNpWebApiDeletePushEventFilter(int libCtxId, int filterId);
-int APS5_VABI sceNpWebApiDeleteRequest();
+int APS5_VABI sceNpWebApiDeleteRequest(std::int64_t requestId);
 int APS5_VABI sceNpWebApiDeleteServicePushEventFilter(int libCtxId, int filterId);
 int APS5_VABI sceNpWebApiGetHttpResponseHeaderValue();
 int APS5_VABI sceNpWebApiGetHttpResponseHeaderValueLength();
 int APS5_VABI sceNpWebApiGetHttpStatusCode();
 int APS5_VABI sceNpWebApiInitialize(int libHttpCtxId, std::size_t poolSize);
 int APS5_VABI sceNpWebApiReadData();
-int APS5_VABI sceNpWebApiRegisterPushEventCallback();
-int APS5_VABI sceNpWebApiRegisterServicePushEventCallback();
-int APS5_VABI sceNpWebApiSendRequest();
+int APS5_VABI sceNpWebApiRegisterPushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg);
+int APS5_VABI sceNpWebApiRegisterServicePushEventCallback(int titleUserCtxId, int filterId, void* callback, void* userArg);
+int APS5_VABI sceNpWebApiSendRequest(std::int64_t requestId, const void* data, std::size_t dataSize);
 int APS5_VABI sceNpWebApiTerminate(int libCtxId);
-int APS5_VABI sceNpWebApiUnregisterPushEventCallback();
-int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback();
+int APS5_VABI sceNpWebApiUnregisterPushEventCallback(int titleUserCtxId, int callbackId);
+int APS5_VABI sceNpWebApiUnregisterServicePushEventCallback(int titleUserCtxId, int callbackId);
 int APS5_VABI sceNpWebApiUtilityParseNpId();
 
 }
diff --git a/core/libs/tests/GuestNpWebApi.cpp b/core/libs/tests/GuestNpWebApi.cpp
index 55fc787258..dbcad1ca9f 100644
--- a/core/libs/tests/GuestNpWebApi.cpp
+++ b/core/libs/tests/GuestNpWebApi.cpp
@@ -1,18 +1,40 @@
+#include "ProcessParametersFixture.hpp"
 #include "prx/libSceNpWebApi/include/Api.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <array>
 #include <cstddef>
+#include <cstdint>
 #include <cstdio>
 #include <cstdlib>
+#include <cstring>
 
 namespace {
 
 constexpr int InvalidArgument = static_cast<int>(0x80552902u);
+constexpr int InvalidLibContextId = static_cast<int>(0x80552903u);
 constexpr int LibContextNotFound = static_cast<int>(0x80552904u);
+constexpr int UserContextNotFound = static_cast<int>(0x80552905u);
+constexpr int RequestNotFound = static_cast<int>(0x80552906u);
+constexpr int NotSignedIn = static_cast<int>(0x80552907u);
+constexpr int InvalidContentParameter = static_cast<int>(0x80552908u);
+constexpr int Aborted = static_cast<int>(0x80552909u);
+constexpr int UserContextAlreadyExist = static_cast<int>(0x8055290Au);
 constexpr int PushEventFilterNotFound = static_cast<int>(0x8055290Bu);
+constexpr int PushEventCallbackNotFound = static_cast<int>(0x8055290Cu);
 constexpr int HandleNotFound = static_cast<int>(0x8055290Du);
 constexpr int ServicePushEventFilterNotFound = static_cast<int>(0x8055290Eu);
+constexpr int ServicePushEventCallbackNotFound = static_cast<int>(0x8055290Fu);
 constexpr int SignedInUserNotFound = static_cast<int>(0x80552910u);
 
+constexpr int MethodGet = 0;
+constexpr int MethodPost = 1;
+constexpr int MethodPatch = 4;
+
+alignas(16) std::array<std::byte, 0x40> process{};
+const char onlineId[20] = "player";
+const char filterParam[16] = {};
+const char body[] = "{}";
+
 void Require(bool condition, const char* message) {
     if (!condition) {
         std::fprintf(stderr, "NpWebApi: %s\n", message);
@@ -20,9 +42,26 @@ void Require(bool condition, const char* message) {
     }
 }
 
+void APS5_VABI PushEvent() {
 }
 
-int main() {
+void* PushEventCallback() {
+    return reinterpret_cast<void*>(&PushEvent);
+}
+
+void SetSdkVersion(std::uint32_t version) {
+    std::memcpy(process.data() + 16, &version, sizeof(version));
+}
+
+void InstallProcessParameters() {
+    const std::uint64_t size = process.size();
+    const std::uint32_t magic = 0x4942524f;
+    std::memcpy(process.data(), &size, sizeof(size));
+    std::memcpy(process.data() + 8, &magic, sizeof(magic));
+    Require(ProcessParametersFixture::Install(process.data(), process.size()), "process parameters were not installed");
+}
+
+void TestLibraryContexts() {
     const int context = sceNpWebApiInitialize(1, 0x10000);
     Require(context > 0 && context <= 0x7fff, "library context id out of range");
     const int other = sceNpWebApiInitialize(1, 0x10000);
@@ -31,7 +70,6 @@ int main() {
 
     const int handle = sceNpWebApiCreateHandle(context);
     Require(handle > 0 && static_cast<unsigned>(handle) < 0xf0000000u, "handle id out of range");
-    const char filterParam[16] = {};
     Require(sceNpWebApiCreatePushEventFilter(context, nullptr, 1) == InvalidArgument, "push event filter without its parameter");
     Require(sceNpWebApiCreatePushEventFilter(context, filterParam, 0) == InvalidArgument, "push event filter with no parameters");
     const int filter = sceNpWebApiCreatePushEventFilter(context, filterParam, 1);
@@ -40,6 +78,8 @@ int main() {
     Require(sceNpWebApiCreateServicePushEventFilter(context, handle, nullptr, 0, filterParam, 1) == InvalidArgument, "service filter without a service name");
     Require(sceNpWebApiCreateServicePushEventFilter(0x7fff + 1, handle, "service", 0, filterParam, 1) == LibContextNotFound, "service filter of an unknown context");
     Require(sceNpWebApiCreateServicePushEventFilter(other, handle, "service", 0, filterParam, 1) == HandleNotFound, "service filter with another context's handle");
+    Require(sceNpWebApiCreateServicePushEventFilter(context, handle, "service", 0xffffffffu, filterParam, 1) == InvalidArgument, "service filter with the invalid service label from SDK 2.00");
+    Require(sceNpWebApiCreateServicePushEventFilter(0x7fff + 1, handle, "service", 0xffffffffu, filterParam, 1) == InvalidArgument, "the service label is checked before the library context");
     Require(sceNpWebApiCreateServicePushEventFilter(context, handle, "service", 0, filterParam, 1) == SignedInUserNotFound, "service filter without a signed-in user");
     Require(sceNpWebApiDeleteServicePushEventFilter(context, 1) == ServicePushEventFilterNotFound, "no service filter exists");
 
@@ -53,5 +93,156 @@ int main() {
     Require(sceNpWebApiTerminate(context) == LibContextNotFound, "library context terminated twice");
     Require(sceNpWebApiCreateHandle(context) == LibContextNotFound, "handle of a terminated context");
     Require(sceNpWebApiTerminate(other) == 0, "terminate the second library context");
+}
+
+void TestUserContexts() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int other = sceNpWebApiInitialize(1, 0x10000);
+    Require(context > 0 && other > 0, "library contexts for user contexts");
+    Require(sceNpWebApiTerminate(other) == 0, "terminate the unused library context");
+
+    Require(sceNpWebApiCreateContext(0x8000, onlineId) == InvalidLibContextId, "user context of a library context id above the range");
+    Require(sceNpWebApiCreateContext(0x8000, nullptr) == InvalidLibContextId, "the library context id is checked before the online id");
+    Require(sceNpWebApiCreateContext(context, nullptr) == InvalidArgument, "user context without an online id");
+    Require(sceNpWebApiCreateContext(0, onlineId) == LibContextNotFound, "user context of library context 0");
+    Require(sceNpWebApiCreateContext(other, onlineId) == LibContextNotFound, "user context of a terminated library context");
+
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0 && (user >> 16) == context && (user & 0xffff) != 0, "user context id holds its library context");
+    Require(sceNpWebApiCreateContext(context, onlineId) == UserContextAlreadyExist, "a second user context for the same user");
+
+    Require(sceNpWebApiDeleteContext(user + 1) == UserContextNotFound, "delete an unknown user context");
+    Require(sceNpWebApiDeleteContext((other << 16) | 1) == LibContextNotFound, "delete a user context of a terminated library context");
+    Require(sceNpWebApiDeleteContext(user) == 0, "delete the user context");
+    Require(sceNpWebApiDeleteContext(user) == UserContextNotFound, "user context deleted twice");
+
+    const int next = sceNpWebApiCreateContext(context, onlineId);
+    Require(next > 0 && next != user && (next >> 16) == context, "a new user context after the first was deleted");
+    std::int64_t request = 0;
+    Require(sceNpWebApiCreateRequest(next, "group", "/path", MethodGet, nullptr, &request) == 0, "request before termination");
+    Require(sceNpWebApiTerminate(context) == 0, "terminate a library context with a user context");
+    Require(sceNpWebApiDeleteContext(next) == LibContextNotFound, "user context of a terminated library context");
+    Require(sceNpWebApiSendRequest(request, nullptr, 0) == LibContextNotFound, "request of a terminated library context");
+}
+
+void TestRequests() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0, "user context for requests");
+
+    std::int64_t request = 0;
+    Require(sceNpWebApiCreateRequest(user, nullptr, "/path", MethodGet, nullptr, &request) == InvalidArgument, "request without an API group");
+    Require(sceNpWebApiCreateRequest(user, "group", nullptr, MethodGet, nullptr, &request) == InvalidArgument, "request without a path");
+    const NpWebApiContentParameter untyped{sizeof(body), nullptr, {}};
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPost, &untyped, &request) == InvalidContentParameter, "content without a type");
+    Require(sceNpWebApiCreateRequest(0, "group", "/path", MethodPost, &untyped, &request) == InvalidContentParameter, "content is checked before the user context");
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPatch, nullptr, &request) == InvalidArgument, "PATCH with SDK 2.50 or later");
+    Require(sceNpWebApiCreateRequest(user + 1, "group", "/path", MethodGet, nullptr, &request) == UserContextNotFound, "request of an unknown user context");
+    Require(sceNpWebApiCreateRequest(0, "group", "/path", MethodGet, nullptr, &request) == LibContextNotFound, "request of user context 0");
+    Require(request == 0, "a failed request leaves the id alone");
+
+    const NpWebApiContentParameter empty{0, nullptr, {}};
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodGet, &empty, nullptr) == 0, "empty content without a type and no id output");
+    const NpWebApiContentParameter typed{sizeof(body), "application/json", {}};
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPost, &typed, &request) == 0, "create a request");
+    Require(static_cast<int>(request >> 32) == user && (request & 0xffffffff) != 0, "request id holds its user context");
+    std::int64_t second = 0;
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodGet, nullptr, &second) == 0 && second != request && static_cast<int>(second >> 32) == user, "a second request");
+
+    Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == NotSignedIn, "a request cannot be sent without a signed-in user");
+    Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == NotSignedIn, "a failed send can be retried");
+    Require(sceNpWebApiSendRequest(request + 0x10000, nullptr, 0) == RequestNotFound, "send an unknown request");
+    Require(sceNpWebApiSendRequest(static_cast<std::int64_t>(user + 1) << 32 | 1, nullptr, 0) == UserContextNotFound, "send a request of an unknown user context");
+    Require(sceNpWebApiSendRequest(1, nullptr, 0) == LibContextNotFound, "send a request of library context 0");
+
+    Require(sceNpWebApiAbortRequest(request + 0x10000) == RequestNotFound, "abort an unknown request");
+    Require(sceNpWebApiAbortRequest(request) == 0, "abort the request");
+    Require(sceNpWebApiAbortRequest(request) == 0, "abort the request twice");
+    Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == Aborted, "send an aborted request");
+    Require(sceNpWebApiSendRequest(second, nullptr, 0) == NotSignedIn, "aborting one request leaves the other");
+
+    Require(sceNpWebApiDeleteRequest(request) == 0, "delete the request");
+    Require(sceNpWebApiDeleteRequest(request) == RequestNotFound, "request deleted twice");
+    Require(sceNpWebApiSendRequest(request, nullptr, 0) == RequestNotFound, "send a deleted request");
+    Require(sceNpWebApiDeleteContext(user) == 0, "delete the user context with a request");
+    Require(sceNpWebApiSendRequest(second, nullptr, 0) == UserContextNotFound, "request of a deleted user context");
+    Require(sceNpWebApiDeleteRequest(second) == UserContextNotFound, "delete a request of a deleted user context");
+    Require(sceNpWebApiTerminate(context) == 0, "terminate the request library context");
+}
+
+void TestPushEventCallbacks() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int other = sceNpWebApiInitialize(1, 0x10000);
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0, "user context for callbacks");
+    const int filter = sceNpWebApiCreatePushEventFilter(context, filterParam, 1);
+    const int otherFilter = sceNpWebApiCreatePushEventFilter(other, filterParam, 1);
+    Require(filter > 0 && otherFilter > 0, "push event filters for callbacks");
+    int argument = 0;
+
+    Require(sceNpWebApiRegisterPushEventCallback(user, filter, nullptr, &argument) == InvalidArgument, "push event callback without a function");
+    Require(sceNpWebApiRegisterPushEventCallback(user + 1, filter, nullptr, &argument) == InvalidArgument, "the function is checked before the user context");
+    Require(sceNpWebApiRegisterPushEventCallback(user + 1, filter, PushEventCallback(), &argument) == UserContextNotFound, "push event callback of an unknown user context");
+    Require(sceNpWebApiRegisterPushEventCallback(user, otherFilter, PushEventCallback(), &argument) == PushEventFilterNotFound, "push event callback with another context's filter");
+    const int callback = sceNpWebApiRegisterPushEventCallback(user, filter, PushEventCallback(), &argument);
+    Require(callback > 0 && static_cast<unsigned>(callback) < 0xf0000000u, "push event callback id");
+    Require(sceNpWebApiUnregisterPushEventCallback(user + 1, callback) == UserContextNotFound, "unregister through an unknown user context");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, callback) == ServicePushEventCallbackNotFound, "a push event callback is not a service callback");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, callback) == 0, "unregister the push event callback");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, callback) == PushEventCallbackNotFound, "push event callback unregistered twice");
+
+    Require(sceNpWebApiRegisterServicePushEventCallback(user, 1, nullptr, &argument) == InvalidArgument, "service callback without a function");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user + 1, 1, PushEventCallback(), &argument) == UserContextNotFound, "service callback of an unknown user context");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user, filter, PushEventCallback(), &argument) == ServicePushEventFilterNotFound, "a push event filter is not a service filter");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, 1) == ServicePushEventCallbackNotFound, "no service callback exists");
+
+    Require(sceNpWebApiTerminate(context) == 0 && sceNpWebApiTerminate(other) == 0, "terminate the callback library contexts");
+}
+
+void TestOlderSdks() {
+    const int context = sceNpWebApiInitialize(1, 0x10000);
+    const int user = sceNpWebApiCreateContext(context, onlineId);
+    Require(user > 0, "user context for older SDKs");
+    int argument = 0;
+
+    SetSdkVersion(0x02000000);
+    std::int64_t request = 0;
+    Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPatch, nullptr, &request) == 0, "PATCH before SDK 2.50");
+    Require(sceNpWebApiSendRequest(request, nullptr, 0) == NotSignedIn, "send a PATCH request");
+    Require(sceNpWebApiRegisterPushEventCallback(user, 1, nullptr, &argument) == InvalidArgument, "push event callback without a function from SDK 1.00");
+    const int callback = sceNpWebApiRegisterPushEventCallback(user, 1, PushEventCallback(), &argument);
+    Require(callback > 0, "push event callback without a filter before SDK 2.50");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, callback) == 0, "unregister the unfiltered push event callback");
+    const int service = sceNpWebApiRegisterServicePushEventCallback(user, 1, PushEventCallback(), &argument);
+    Require(service > 0 && service != callback, "service callback without a filter before SDK 2.50");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, service) == PushEventCallbackNotFound, "a service callback is not a push event callback");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, service) == 0, "unregister the service callback");
+    Require(sceNpWebApiUnregisterServicePushEventCallback(user, service) == ServicePushEventCallbackNotFound, "service callback unregistered twice");
+
+    SetSdkVersion(0x01000000);
+    const int handle = sceNpWebApiCreateHandle(context);
+    Require(sceNpWebApiCreateServicePushEventFilter(context, handle, "service", 0xffffffffu, filterParam, 1) == SignedInUserNotFound, "the invalid service label is accepted before SDK 2.00");
+
+    SetSdkVersion(0x00900000);
+    const int unchecked = sceNpWebApiRegisterPushEventCallback(user, 1, nullptr, &argument);
+    Require(unchecked > 0, "push event callback without a function before SDK 1.00");
+    Require(sceNpWebApiUnregisterPushEventCallback(user, unchecked) == 0, "unregister the push event callback without a function");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user + 1, 1, nullptr, &argument) == UserContextNotFound, "the user context is checked before the service callback function before SDK 1.00");
+    Require(sceNpWebApiRegisterServicePushEventCallback(user, 1, nullptr, &argument) == InvalidArgument, "service callback without a function before SDK 1.00");
+
+    SetSdkVersion(0x04508001);
+    Require(sceNpWebApiTerminate(context) == 0, "terminate the older SDK library context");
+}
+
+}
+
+int main() {
+    InstallProcessParameters();
+    SetSdkVersion(0x04508001);
+    TestLibraryContexts();
+    TestUserContexts();
+    TestRequests();
+    TestPushEventCallbacks();
+    TestOlderSdks();
     return 0;
 }
diff --git a/docs/dev/debt/libSceNpWebApi.md b/docs/dev/debt/libSceNpWebApi.md
index 95fb314c74..d67af49268 100644
--- a/docs/dev/debt/libSceNpWebApi.md
+++ b/docs/dev/debt/libSceNpWebApi.md
@@ -3,4 +3,6 @@
 ### Unknown function info
 
 - [sceNpWebApiInitialize, sceNpWebApiTerminate, sceNpWebApiCreateHandle, sceNpWebApiDeleteHandle, sceNpWebApiCreatePushEventFilter, sceNpWebApiDeletePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - signatures, id ranges (library contexts 1 to 0x7fff, handles and filters below 0xf0000000) and errors (`LIB_CONTEXT_NOT_FOUND`, `HANDLE_NOT_FOUND`, `PUSH_EVENT_FILTER_NOT_FOUND`, `INVALID_ARGUMENT` for a missing filter parameter) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp); they are not checked on a console. The libHttp context and pool size are kept but not used, since no request is ever sent. Limbo (CUSA01664) creates a context, a handle and filters when its game starts.
-- [sceNpWebApiCreateServicePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - a filter for a PSN service needs the signed-in user, and no user is signed in to PSN, so a valid call returns `SIGNED_IN_USER_NOT_FOUND` after the context and handle checks, as shadPS4 does with its network disabled. shadPS4 also rejects an invalid service label for titles built with SDK 2.00 or later; AnyPS5 has no compiled-SDK version for libraries yet, so such a call returns `SIGNED_IN_USER_NOT_FOUND` instead of `INVALID_ARGUMENT`. `sceNpWebApiDeleteServicePushEventFilter` therefore never finds a filter.
+- [sceNpWebApiCreateServicePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - a filter for a PSN service needs the signed-in user, and no user is signed in to PSN, so a valid call returns `SIGNED_IN_USER_NOT_FOUND` after the context and handle checks, as shadPS4 does with its network disabled. `sceNpWebApiDeleteServicePushEventFilter` therefore never finds a filter.
+- [sceNpWebApiCreateContext, sceNpWebApiDeleteContext, sceNpWebApiCreateRequest, sceNpWebApiDeleteRequest, sceNpWebApiAbortRequest, sceNpWebApiSendRequest](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - the online id is not looked up: as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp), a user context belongs to the initial user, so a library context holds at most one. No user is signed in to PSN, so `sceNpWebApiSendRequest` returns `NOT_SIGNED_IN` for a request that is not aborted, as shadPS4 does with its network disabled. Id layouts (`libCtxId << 16 | counter` for user contexts, `userCtxId << 32 | counter` for requests), check order and errors follow shadPS4, including `INVALID_ARGUMENT` for a method after DELETE from SDK 2.50; none is checked on a console. `sceNpWebApiTerminate` also deletes the user contexts and requests; shadPS4 returns after deleting the first user context.
+- [sceNpWebApiRegisterPushEventCallback, sceNpWebApiUnregisterPushEventCallback, sceNpWebApiRegisterServicePushEventCallback, sceNpWebApiUnregisterServicePushEventCallback](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - registered callbacks are never called, since no push event arrives. A null function is rejected from SDK 1.00 and the filter must exist in the library context from SDK 2.50, as in shadPS4; this is not checked on a console. No service filter can be created, so from SDK 2.50 a service callback returns `SERVICE_PUSH_EVENT_FILTER_NOT_FOUND`. Callback ids come from the counter of handles and filters.

From 0435d0b254d58c4d38ae0bfa9f3020be9efca0c3 Mon Sep 17 00:00:00 2001
From: Alexandre <caramel.alexandre@gmail.com>
Date: Fri, 23 Oct 2026 14:33:48 +0200
Subject: [PATCH 154/218] test(libSceNpWebApi): pin the results measured on a
 PS4 Pro

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RoucYS7mQpV23WDUEwXLuU
---
 core/libs/tests/GuestNpWebApi.cpp | 4 ++++
 docs/dev/debt/libSceNpWebApi.md   | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestNpWebApi.cpp b/core/libs/tests/GuestNpWebApi.cpp
index dbcad1ca9f..465ee0900c 100644
--- a/core/libs/tests/GuestNpWebApi.cpp
+++ b/core/libs/tests/GuestNpWebApi.cpp
@@ -112,6 +112,7 @@ void TestUserContexts() {
     Require(sceNpWebApiCreateContext(context, onlineId) == UserContextAlreadyExist, "a second user context for the same user");
 
     Require(sceNpWebApiDeleteContext(user + 1) == UserContextNotFound, "delete an unknown user context");
+    Require(sceNpWebApiDeleteContext(-1) == LibContextNotFound, "delete user context -1");
     Require(sceNpWebApiDeleteContext((other << 16) | 1) == LibContextNotFound, "delete a user context of a terminated library context");
     Require(sceNpWebApiDeleteContext(user) == 0, "delete the user context");
     Require(sceNpWebApiDeleteContext(user) == UserContextNotFound, "user context deleted twice");
@@ -139,6 +140,7 @@ void TestRequests() {
     Require(sceNpWebApiCreateRequest(user, "group", "/path", MethodPatch, nullptr, &request) == InvalidArgument, "PATCH with SDK 2.50 or later");
     Require(sceNpWebApiCreateRequest(user + 1, "group", "/path", MethodGet, nullptr, &request) == UserContextNotFound, "request of an unknown user context");
     Require(sceNpWebApiCreateRequest(0, "group", "/path", MethodGet, nullptr, &request) == LibContextNotFound, "request of user context 0");
+    Require(sceNpWebApiCreateRequest(-1, "group", "/path", MethodGet, nullptr, &request) == LibContextNotFound, "request of user context -1");
     Require(request == 0, "a failed request leaves the id alone");
 
     const NpWebApiContentParameter empty{0, nullptr, {}};
@@ -156,6 +158,8 @@ void TestRequests() {
     Require(sceNpWebApiSendRequest(1, nullptr, 0) == LibContextNotFound, "send a request of library context 0");
 
     Require(sceNpWebApiAbortRequest(request + 0x10000) == RequestNotFound, "abort an unknown request");
+    Require(sceNpWebApiAbortRequest(-1) == LibContextNotFound, "abort request -1");
+    Require(sceNpWebApiDeleteRequest(-1) == LibContextNotFound, "delete request -1");
     Require(sceNpWebApiAbortRequest(request) == 0, "abort the request");
     Require(sceNpWebApiAbortRequest(request) == 0, "abort the request twice");
     Require(sceNpWebApiSendRequest(request, body, sizeof(body)) == Aborted, "send an aborted request");
diff --git a/docs/dev/debt/libSceNpWebApi.md b/docs/dev/debt/libSceNpWebApi.md
index d67af49268..af76876d59 100644
--- a/docs/dev/debt/libSceNpWebApi.md
+++ b/docs/dev/debt/libSceNpWebApi.md
@@ -4,5 +4,5 @@
 
 - [sceNpWebApiInitialize, sceNpWebApiTerminate, sceNpWebApiCreateHandle, sceNpWebApiDeleteHandle, sceNpWebApiCreatePushEventFilter, sceNpWebApiDeletePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - signatures, id ranges (library contexts 1 to 0x7fff, handles and filters below 0xf0000000) and errors (`LIB_CONTEXT_NOT_FOUND`, `HANDLE_NOT_FOUND`, `PUSH_EVENT_FILTER_NOT_FOUND`, `INVALID_ARGUMENT` for a missing filter parameter) follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp); they are not checked on a console. The libHttp context and pool size are kept but not used, since no request is ever sent. Limbo (CUSA01664) creates a context, a handle and filters when its game starts.
 - [sceNpWebApiCreateServicePushEventFilter](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - a filter for a PSN service needs the signed-in user, and no user is signed in to PSN, so a valid call returns `SIGNED_IN_USER_NOT_FOUND` after the context and handle checks, as shadPS4 does with its network disabled. `sceNpWebApiDeleteServicePushEventFilter` therefore never finds a filter.
-- [sceNpWebApiCreateContext, sceNpWebApiDeleteContext, sceNpWebApiCreateRequest, sceNpWebApiDeleteRequest, sceNpWebApiAbortRequest, sceNpWebApiSendRequest](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - the online id is not looked up: as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp), a user context belongs to the initial user, so a library context holds at most one. No user is signed in to PSN, so `sceNpWebApiSendRequest` returns `NOT_SIGNED_IN` for a request that is not aborted, as shadPS4 does with its network disabled. Id layouts (`libCtxId << 16 | counter` for user contexts, `userCtxId << 32 | counter` for requests), check order and errors follow shadPS4, including `INVALID_ARGUMENT` for a method after DELETE from SDK 2.50; none is checked on a console. `sceNpWebApiTerminate` also deletes the user contexts and requests; shadPS4 returns after deleting the first user context.
+- [sceNpWebApiCreateContext, sceNpWebApiDeleteContext, sceNpWebApiCreateRequest, sceNpWebApiDeleteRequest, sceNpWebApiAbortRequest, sceNpWebApiSendRequest](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - the online id is not looked up: as in [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/np/np_web_api/np_web_api_internal.cpp), a user context belongs to the initial user, so a library context holds at most one. With no user signed in to PSN, `sceNpWebApiSendRequest` returns `NOT_SIGNED_IN` unless the request is aborted. Id layouts and the delete, abort and not-found results match an offline PS4 Pro probe on firmware 10.71 (#9797); other checks follow shadPS4. That homebrew probe, with a non-retail SDK version, accepted method 99, so `INVALID_ARGUMENT` for a method after DELETE from SDK 2.50 is unverified. `sceNpWebApiTerminate` also deletes user contexts and requests; shadPS4 stops after the first user context.
 - [sceNpWebApiRegisterPushEventCallback, sceNpWebApiUnregisterPushEventCallback, sceNpWebApiRegisterServicePushEventCallback, sceNpWebApiUnregisterServicePushEventCallback](../../../core/libs/prx/libSceNpWebApi/Export.cpp) (libSceNpWebApi, PS4) - registered callbacks are never called, since no push event arrives. A null function is rejected from SDK 1.00 and the filter must exist in the library context from SDK 2.50, as in shadPS4; this is not checked on a console. No service filter can be created, so from SDK 2.50 a service callback returns `SERVICE_PUSH_EVENT_FILTER_NOT_FOUND`. Callback ids come from the counter of handles and filters.

From 57f5e4103e6e0ae81d5ff4ca2f1157b75463fef8 Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 06:09:52 +1300
Subject: [PATCH 155/218] docs(libSceGameUpdate): name the title by its ID in
 the debt entry

---
 docs/dev/debt/libSceGameUpdate.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceGameUpdate.md b/docs/dev/debt/libSceGameUpdate.md
index 88f35c8e6d..75626c8e75 100644
--- a/docs/dev/debt/libSceGameUpdate.md
+++ b/docs/dev/debt/libSceGameUpdate.md
@@ -2,7 +2,7 @@
 
 ### Silent stubs
 
-- [sceGameUpdateCreateRequest, sceGameUpdateCheck](../../../core/libs/prx/libSceGameUpdate/Export.cpp) (libSceGameUpdate) - requests are kept in the module's 8 slots with ids from `0x20000000` (a ninth returns `0x80412806`, an aborted request's Check `0x80412807`), as [prosper](https://github.com/mattias800/prosper) reads the PS5 3.20 `libSceGameUpdate.sprx`. Check never asks a patch service: it always answers no update (`found` and the byte after it cleared, the rest of the result untouched, return 0), which is what the module returns when its service reports `0x80412883`; KytyPS5 also answers no update. What the service returns on an offline console is not measured. The answer only decides whether a title offers a patch. Hot Wheels Infinite Rush (PPSA22408) aborted on the throw in sceGameUpdateCreateRequest at its title screen. Closes when: measured on a PS5
+- [sceGameUpdateCreateRequest, sceGameUpdateCheck](../../../core/libs/prx/libSceGameUpdate/Export.cpp) (libSceGameUpdate) - requests are kept in the module's 8 slots with ids from `0x20000000` (a ninth returns `0x80412806`, an aborted request's Check `0x80412807`), as [prosper](https://github.com/mattias800/prosper) reads the PS5 3.20 `libSceGameUpdate.sprx`. Check never asks a patch service: it always answers no update (`found` and the byte after it cleared, the rest of the result untouched, return 0), which is what the module returns when its service reports `0x80412883`; KytyPS5 also answers no update. What the service returns on an offline console is not measured. The answer only decides whether a title offers a patch. PPSA22408 aborted on the throw in sceGameUpdateCreateRequest at its title screen. Closes when: measured on a PS5
 
 ### Functional
 

From 87e1f002177abc0061f699c9050f3acf889889c1 Mon Sep 17 00:00:00 2001
From: StoneDC <19905433+StoneDC@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:25:57 +0800
Subject: [PATCH 156/218] fix(tools): honor quoted CMake line continuations

---
 tools/check_test_registration.py      |  4 +++-
 tools/tests/test_test_registration.py | 24 ++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/tools/check_test_registration.py b/tools/check_test_registration.py
index d29473a451..518a885bd4 100644
--- a/tools/check_test_registration.py
+++ b/tools/check_test_registration.py
@@ -78,7 +78,9 @@ def commands(content):
                 raise ValueError(f"invalid CTest argument at position {position}")
             argument = token.group(0)
             if argument.startswith('"'):
-                argument = re.sub(r"\\(.)", lambda match: {"n": "\n", "r": "\r", "t": "\t"}.get(match[1], match[1]), argument[1:-1], flags=re.S)
+                argument = re.sub(r"\\(\r?\n|.)",
+                                  lambda match: {"\n": "", "\r\n": "", "n": "\n", "r": "\r", "t": "\t"}.get(match[1], match[1]),
+                                  argument[1:-1], flags=re.S)
             elif token.group("equals") is not None:
                 width = len(token.group("equals")) + 2
                 argument = argument[width:-width].removeprefix("\n")
diff --git a/tools/tests/test_test_registration.py b/tools/tests/test_test_registration.py
index 7a32e30221..a329b64cf2 100644
--- a/tools/tests/test_test_registration.py
+++ b/tools/tests/test_test_registration.py
@@ -15,6 +15,30 @@ import check_test_registration
 
 
 class RegistrationTests(unittest.TestCase):
+    @unittest.skipUnless(shutil.which("cmake"), "CMake is required for the argument oracle")
+    def test_quoted_continuations_follow_cmake(self):
+        for ending, backslashes in (("\n", 1), ("\r\n", 1), ("\n", 2), ("\n", 3), ("\n", 4)):
+            with self.subTest(ending=repr(ending), backslashes=backslashes), tempfile.TemporaryDirectory() as directory:
+                content = 'add_test("real" "tools/tests/test_' + '\\' * backslashes + ending + 'bounds.py")\n'
+                script = Path(directory) / "oracle.cmake"
+                script.write_bytes(('function(add_test)\n'
+                                    'file(WRITE "${CMAKE_CURRENT_LIST_DIR}/argument.txt" "${ARGV1}")\n'
+                                    'endfunction()\n' + content).encode())
+                subprocess.run(["cmake", "-P", str(script)], capture_output=True, text=True, check=True)
+                actual = (Path(directory) / "argument.txt").read_text()
+                expected = "tools/tests/test_" + '\\' * (backslashes // 2) + ("\n" if backslashes % 2 == 0 else "") + "bounds.py"
+                self.assertEqual(actual, expected)
+                self.assertEqual(list(check_test_registration.commands(content)), [("add_test", ["real", actual])])
+                if backslashes == 1:
+                    (Path(directory) / "CMakeLists.txt").write_bytes(content.encode())
+                    self.assertEqual(check_test_registration.run_scripts(Path(directory), ["CMakeLists.txt"]), {actual})
+
+    def test_literal_escaped_newline_and_bracket_continuation_are_preserved(self):
+        quoted = r'add_test("real" "a\nb")' + '\n'
+        bracket = 'add_test("real" [=[a' + '\\' + '\n' + 'b]=])\n'
+        self.assertEqual(list(check_test_registration.commands(quoted)), [("add_test", ["real", "a\nb"])])
+        self.assertEqual(list(check_test_registration.commands(bracket)), [("add_test", ["real", "a\\\nb"])])
+
     def test_bracket_arguments_ignore_only_one_initial_newline(self):
         values = (("path", "path"), ("\npath", "path"), ("\n\npath", "\npath"),
                   ("\n path", " path"), (" \npath", " \npath"), ("\\npath", "\\npath"),

From d15fe22e98e62d4bb86b4f76cd25a21b03868d3d Mon Sep 17 00:00:00 2001
From: Matheus Herberts <163153928+Mherberts@users.noreply.github.com>
Date: Sun, 25 Oct 2026 14:44:13 -0300
Subject: [PATCH 157/218] test(relinker): require the exact section string
 table size

---
 core/relinker/elfpatcher/tests/SectionRangeTests.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/relinker/elfpatcher/tests/SectionRangeTests.cpp b/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
index 0337f3327d..b5ff0514a0 100644
--- a/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
+++ b/core/relinker/elfpatcher/tests/SectionRangeTests.cpp
@@ -1,4 +1,5 @@
 #include <elfpatcher/general/SectionHeaderTableBuilder.hpp>
+#include <elfpatcher/general/ElfConstants.hpp>
 #include <io/ByteWriter.hpp>
 #include <io/BufferUtils.hpp>
 #include <algorithm>
@@ -42,7 +43,7 @@ int main() {
             const auto stringOffset = Io::ReadU64(bytes, alignedTable + 64 + 24);
             const auto stringSize = Io::ReadU64(bytes, alignedTable + 64 + 32);
             const auto stringEnd = stringOffset + stringSize;
-            Require(stringOffset == originalSize && stringSize != 0);
+            Require(stringOffset == originalSize && stringSize == sizeof(Elfpatcher::kShStrTabBlob));
             Require(stringEnd <= alignedTable && alignedTable - stringEnd < 8);
             Require(bytes[stringOffset] == 0 && bytes[stringEnd - 1] == 0);
             Require(std::equal(original.begin() + 64, original.end(), bytes.begin() + 64));

From d003153f53ef0d6e0abf316d623fb21ee2e41856 Mon Sep 17 00:00:00 2001
From: mantavisual <165268599+mantavisual@users.noreply.github.com>
Date: Sun, 25 Oct 2026 19:52:58 +0200
Subject: [PATCH 158/218] fix(libSceLibreSsl): reject null strings in the ASN.1
 accessors as invalid arguments

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceLibreSsl/src/Asn1.cpp   |  6 +++---
 core/libs/prx/libSceLibreSsl/tests/Asn1.cpp | 16 +++++++++++++---
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/core/libs/prx/libSceLibreSsl/src/Asn1.cpp b/core/libs/prx/libSceLibreSsl/src/Asn1.cpp
index 304ad8ad93..409df8adac 100644
--- a/core/libs/prx/libSceLibreSsl/src/Asn1.cpp
+++ b/core/libs/prx/libSceLibreSsl/src/Asn1.cpp
@@ -87,17 +87,17 @@ std::int64_t APS5_VABI ASN1_INTEGER_get_nid_postfix(const Asn1String* value) {
 }
 
 unsigned char* APS5_VABI ASN1_STRING_data_nid_postfix(Asn1String* value) {
-    if (!value) NotImplemented_nid_no_patch(__func__);
+    if (!value) APS5_INVALID_ARG_EX;
     return value->data;
 }
 
 int APS5_VABI ASN1_STRING_length_nid_postfix(const Asn1String* value) {
-    if (!value) NotImplemented_nid_no_patch(__func__);
+    if (!value) APS5_INVALID_ARG_EX;
     return value->length;
 }
 
 int APS5_VABI ASN1_STRING_type_nid_postfix(Asn1String* value) {
-    if (!value) NotImplemented_nid_no_patch(__func__);
+    if (!value) APS5_INVALID_ARG_EX;
     return value->type;
 }
 
diff --git a/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp b/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp
index 354f36a0c9..e99142e9ad 100644
--- a/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp
+++ b/core/libs/prx/libSceLibreSsl/tests/Asn1.cpp
@@ -36,6 +36,16 @@ void RequireThrows(TAction action, const char* message) {
     Require(false, message);
 }
 
+template<typename TAction>
+void RequireInvalidArgument(TAction action, const char* message) {
+    try {
+        action();
+    } catch (const std::invalid_argument&) {
+        return;
+    }
+    Require(false, message);
+}
+
 void CheckConversion(int type, std::span<const unsigned char> input, std::span<const unsigned char> expected, int length = -2) {
     std::vector<unsigned char> storage(input.begin(), input.end());
     storage.push_back(0);
@@ -65,9 +75,9 @@ void Accessors() {
     Require(ASN1_STRING_data_nid_postfix(&value) == nullptr, "null data is preserved");
     Require(ASN1_STRING_length_nid_postfix(&value) == -9, "length is returned without normalization");
     Require(ASN1_STRING_type_nid_postfix(&value) == 0x7fffffff, "type is returned without normalization");
-    RequireThrows([] { ASN1_STRING_data_nid_postfix(nullptr); }, "null data accessor input");
-    RequireThrows([] { ASN1_STRING_length_nid_postfix(nullptr); }, "null length accessor input");
-    RequireThrows([] { ASN1_STRING_type_nid_postfix(nullptr); }, "null type accessor input");
+    RequireInvalidArgument([] { ASN1_STRING_data_nid_postfix(nullptr); }, "null data accessor input");
+    RequireInvalidArgument([] { ASN1_STRING_length_nid_postfix(nullptr); }, "null length accessor input");
+    RequireInvalidArgument([] { ASN1_STRING_type_nid_postfix(nullptr); }, "null type accessor input");
 }
 
 void Integers() {

From 633d8aa836b6bf0453955490471ef5a4ff1e0218 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:49:35 +0200
Subject: [PATCH 159/218] feat(libc): add the narrow Annex K stream functions
 fprintf_s, vfprintf_s, vprintf_s, scanf_s, fscanf_s, vscanf_s, vfscanf_s

---
 core/libs/prx/libc/src/Formatting.cpp | 206 +++++++++++++++++++++++---
 1 file changed, 185 insertions(+), 21 deletions(-)

diff --git a/core/libs/prx/libc/src/Formatting.cpp b/core/libs/prx/libc/src/Formatting.cpp
index f44d577f43..a67a0b877e 100644
--- a/core/libs/prx/libc/src/Formatting.cpp
+++ b/core/libs/prx/libc/src/Formatting.cpp
@@ -125,10 +125,69 @@ int HostVfscanf(std::FILE* stream, const char* format, std::va_list args) {
 }
 #endif
 
-template <typename NextPointer, typename NextCapacity>
-int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer nextPointer, NextCapacity nextCapacity) {
-    if (buffer == nullptr || format == nullptr) return EOF;
-    const char* input = buffer;
+int HostFscanf(std::FILE* stream, const char* format, ...) {
+    std::va_list args;
+    va_start(args, format);
+#ifdef _WIN32
+    const int result = std::vfscanf(stream, format, args);
+#else
+    const int result = HostVfscanf(stream, format, args);
+#endif
+    va_end(args);
+    return result;
+}
+
+class StringSource {
+    const char* const start;
+    const char* position;
+
+public:
+    static constexpr bool Contiguous = true;
+
+    explicit StringSource(const char* text) : start(text), position(text) {}
+
+    int Peek() const { return *position == '\0' ? EOF : static_cast<unsigned char>(*position); }
+    void Skip() { ++position; }
+    void Advance(std::ptrdiff_t count) { position += count; }
+    std::ptrdiff_t Consumed() const { return position - start; }
+    const char* Remaining() const { return position; }
+
+    int Scan(const char* directive, bool suppress, void* target, int* consumed) const {
+        return suppress ? HostSscanf(position, directive, consumed) : HostSscanf(position, directive, target, consumed);
+    }
+};
+
+class StreamSource {
+    std::FILE* const file;
+    std::ptrdiff_t consumed = 0;
+
+public:
+    static constexpr bool Contiguous = false;
+
+    explicit StreamSource(std::FILE* native) : file(native) {}
+
+    int Peek() const {
+        const int next = std::fgetc(file);
+        if (next != EOF) std::ungetc(next, file);
+        return next;
+    }
+
+    void Skip() {
+        std::fgetc(file);
+        ++consumed;
+    }
+
+    void Advance(std::ptrdiff_t count) { consumed += count; }
+    std::ptrdiff_t Consumed() const { return consumed; }
+
+    int Scan(const char* directive, bool suppress, void* target, int* count) const {
+        return suppress ? HostFscanf(file, directive, count) : HostFscanf(file, directive, target, count);
+    }
+};
+
+template <typename TSource, typename NextPointer, typename NextCapacity>
+int ScanSource(TSource source, const char* format, bool secure, NextPointer nextPointer, NextCapacity nextCapacity) {
+    if (format == nullptr) return EOF;
     int assigned = 0;
     bool converted = false;
     const char* cursor = format;
@@ -136,15 +195,15 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
     while (*cursor != '\0') {
         if (std::isspace(static_cast<unsigned char>(*cursor))) {
             while (std::isspace(static_cast<unsigned char>(*cursor))) ++cursor;
-            while (std::isspace(static_cast<unsigned char>(*input))) ++input;
+            while (std::isspace(source.Peek())) source.Skip();
             continue;
         }
         if (*cursor != '%' || cursor[1] == '%') {
             const char expected = *cursor == '%' ? '%' : *cursor;
             cursor += *cursor == '%' ? 2 : 1;
-            if (expected == '%') while (std::isspace(static_cast<unsigned char>(*input))) ++input;
-            if (*input != expected) return finish(!converted && *input == '\0' ? EOF : assigned);
-            ++input;
+            if (expected == '%') while (std::isspace(source.Peek())) source.Skip();
+            if (source.Peek() != static_cast<unsigned char>(expected)) return finish(!converted && source.Peek() == EOF ? EOF : assigned);
+            source.Skip();
             continue;
         }
         ++cursor;
@@ -171,7 +230,7 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
             if (!suppress) {
                 void* target = nextPointer();
                 if (target == nullptr) return EOF;
-                const auto count = input - buffer;
+                const auto count = source.Consumed();
                 if (length == "hh") *static_cast<signed char*>(target) = static_cast<signed char>(count);
                 else if (length == "h") *static_cast<short*>(target) = static_cast<short>(count);
                 else if (length.empty()) *static_cast<int*>(target) = static_cast<int>(count);
@@ -183,7 +242,8 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
             continue;
         }
 #ifndef _WIN32
-        if (IsWideScan(length, conversion)) {
+        if constexpr (TSource::Contiguous) if (IsWideScan(length, conversion)) {
+            const char* const input = source.Remaining();
             const char kind = conversion == 'S' ? 's' : conversion == 'C' ? 'c' : conversion;
             const char* field = input;
             if (kind == 's') {
@@ -229,15 +289,14 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
                 if (kind != 'c') target[text.size()] = u'\0';
                 ++assigned;
             }
-            input = field;
+            source.Advance(field - input);
             converted = true;
             continue;
         }
 #endif
         if (conversion != 'c' && conversion != '[') {
-            const char* probe = input;
-            while (std::isspace(static_cast<unsigned char>(*probe))) ++probe;
-            if (*probe == '\0') return finish(converted ? assigned : EOF);
+            while (std::isspace(source.Peek())) source.Skip();
+            if (source.Peek() == EOF) return finish(converted ? assigned : EOF);
         }
         const bool sized = secure && (conversion == 's' || conversion == 'c' || conversion == '[');
         bool capped = false;
@@ -264,29 +323,50 @@ int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer n
         directive += specifier;
         directive += "%n";
         int consumed = -1;
-        const int matched = suppress ? HostSscanf(input, directive.c_str(), &consumed) : HostSscanf(input, directive.c_str(), target, &consumed);
-        if (consumed < 0 || (!suppress && matched != 1)) return finish(!converted && *input == '\0' ? EOF : assigned);
+        const int matched = source.Scan(directive.c_str(), suppress, target, &consumed);
+        if (consumed < 0 || (!suppress && matched != 1)) return finish(!converted && source.Peek() == EOF ? EOF : assigned);
+        source.Advance(consumed);
         if (capped && conversion != 'c') {
-            const char next = input[consumed];
+            const int next = source.Peek();
             bool overflow = false;
-            if (conversion == 's') overflow = next != '\0' && !std::isspace(static_cast<unsigned char>(next));
-            else if (next != '\0') {
+            if (conversion == 's') overflow = next != EOF && !std::isspace(next);
+            else if (next != EOF) {
                 char probe[2];
+                const char text[2] = {static_cast<char>(next), '\0'};
                 const std::string test = "%1" + specifier;
-                overflow = std::sscanf(input + consumed, test.c_str(), probe) == 1;
+                overflow = std::sscanf(text, test.c_str(), probe) == 1;
             }
             if (overflow) {
                 static_cast<char*>(target)[0] = '\0';
                 return finish(assigned);
             }
         }
-        input += consumed;
         converted = true;
         if (!suppress) ++assigned;
     }
     return finish(assigned);
 }
 
+template <typename NextPointer, typename NextCapacity>
+int ScanGuest(const char* buffer, const char* format, bool secure, NextPointer nextPointer, NextCapacity nextCapacity) {
+    if (buffer == nullptr) return EOF;
+    return ScanSource(StringSource(buffer), format, secure, nextPointer, nextCapacity);
+}
+
+template <typename NextPointer, typename NextCapacity>
+int ScanGuestStream(FileStream* stream, const char* format, NextPointer nextPointer, NextCapacity nextCapacity) {
+    if (stream == nullptr || format == nullptr) return EOF;
+    if (!stream->IsOpen()) { errno = 9; return EOF; }
+    auto* native = GetNativeStream(stream);
+    if (!stream->SwitchToReading()) return EOF;
+#ifndef _WIN32
+    RejectGuestWideScan(format);
+#endif
+    const int result = ScanSource(StreamSource(native), format, true, nextPointer, nextCapacity);
+    stream->SyncStatus();
+    return result;
+}
+
 }
 
 extern "C" {
@@ -577,6 +657,47 @@ int APS5_VABI vsnprintf_s_nid_postfix(char* buffer, size_t size, const char* for
     return FormatSecure(buffer, size, format, args);
 }
 
+static int WriteSecure(FileStream* stream, const char* format, const void* args) {
+    if (stream == nullptr || format == nullptr || args == nullptr) return -1;
+    if (!stream->IsOpen()) { errno = 9; return -1; }
+    auto* native = GetNativeStream(stream);
+    std::string text;
+    int count;
+    try {
+        count = LibcDetail::FormatWindows(nullptr, 0, format, args, &text, true);
+    } catch (const LibcDetail::FormatConstraintViolation&) {
+        return -1;
+    }
+    const int result = std::fwrite(text.data(), 1, static_cast<size_t>(count), native) == static_cast<size_t>(count) ? count : -1;
+    stream->SyncStatus();
+    return result;
+}
+
+int APS5_VABI vfprintf_s_nid_postfix(FileStream* stream, const char* format, VaList* args) {
+    return WriteSecure(stream, format, args);
+}
+
+int APS5_VABI vprintf_s_nid_postfix(const char* format, VaList* args) {
+    return WriteSecure(&_Stdout_nid_postfix, format, args);
+}
+
+int APS5_VABI fprintf_s_nid_postfix(FileStream* stream, const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
 #ifdef _WIN32
 
 int APS5_VABI vsscanf_s_nid_postfix(const char* buffer, const char* format, VaList* args) {
@@ -690,4 +811,47 @@ int APS5_VABI scanf_nid_postfix(const char* format, ...) {
     return result;
 }
 
+int APS5_VABI vfscanf_s_nid_postfix(FileStream* stream, const char* format, VaList* args) {
+    LibcDetail::FormatArguments arguments(args);
+    return ScanGuestStream(stream, format, [&] { return arguments.Next<void*>(); }, [&] { return arguments.Next<unsigned int>(); });
+}
+
+int APS5_VABI vscanf_s_nid_postfix(const char* format, VaList* args) {
+    return vfscanf_s_nid_postfix(__stdinp_nid_postfix, format, args);
+}
+
+int APS5_VABI fscanf_s_nid_postfix(FileStream* stream, const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfscanf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
+int APS5_VABI scanf_s_nid_postfix(const char* format, ...) {
+#ifdef _WIN32
+    __builtin_sysv_va_list args;
+    __builtin_sysv_va_start(args, format);
+#else
+    std::va_list args;
+    va_start(args, format);
+#endif
+    const int result = vfscanf_s_nid_postfix(__stdinp_nid_postfix, format, reinterpret_cast<VaList*>(args));
+#ifdef _WIN32
+    __builtin_sysv_va_end(args);
+#else
+    va_end(args);
+#endif
+    return result;
+}
+
 }

From 7c69505d5cdf63a33137aed005628754f5fc1326 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:49:36 +0200
Subject: [PATCH 160/218] feat(libc): add fwprintf_s, wprintf_s, vfwprintf_s
 and vwprintf_s

---
 core/libs/prx/libc/src/FormattingWide.cpp | 33 +++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/core/libs/prx/libc/src/FormattingWide.cpp b/core/libs/prx/libc/src/FormattingWide.cpp
index 67a7fce10f..03591ae318 100644
--- a/core/libs/prx/libc/src/FormattingWide.cpp
+++ b/core/libs/prx/libc/src/FormattingWide.cpp
@@ -361,6 +361,39 @@ int APS5_VABI vwprintf_nid_postfix(const char16_t* format, VaList* args) {
     return vfwprintf_nid_postfix(__stdoutp_nid_postfix, format, args);
 }
 
+int APS5_VABI vfwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, VaList* args) {
+    if (stream == nullptr || format == nullptr || args == nullptr) return -1;
+    if (!stream->IsOpen()) { errno = 9; return -1; }
+    int result = -1;
+    try {
+        const std::u16string text = FormatWide(format, args, true);
+        const std::string bytes = ToUtf8(text);
+        if (text.size() <= static_cast<std::size_t>(INT_MAX) &&
+            std::fwrite(bytes.data(), 1, bytes.size(), GetNativeStream(stream)) == bytes.size()) result = static_cast<int>(text.size());
+    } catch (const std::invalid_argument&) {
+    }
+    stream->SyncStatus();
+    return result;
+}
+
+int APS5_VABI vwprintf_s_nid_postfix(const char16_t* format, VaList* args) {
+    return vfwprintf_s_nid_postfix(__stdoutp_nid_postfix, format, args);
+}
+
+int APS5_VABI fwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfwprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+int APS5_VABI wprintf_s_nid_postfix(const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfwprintf_s_nid_postfix(__stdoutp_nid_postfix, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
 int APS5_VABI fputwc_nid_postfix(char16_t value, FileStream* stream) {
     if (stream == nullptr) { errno = 22; return -1; }
     if (!stream->IsOpen()) { errno = 9; return -1; }

From b360b7144bbfb089586f7b548bf5ac59e90b9ee1 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:49:37 +0200
Subject: [PATCH 161/218] feat(libc): add freopen_s

---
 core/libs/prx/libc/src/FileAndHeap.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/core/libs/prx/libc/src/FileAndHeap.cpp b/core/libs/prx/libc/src/FileAndHeap.cpp
index d50cdfad16..cec8e4084b 100644
--- a/core/libs/prx/libc/src/FileAndHeap.cpp
+++ b/core/libs/prx/libc/src/FileAndHeap.cpp
@@ -465,6 +465,15 @@ int APS5_VABI fopen_s_nid_postfix(FileStream** result, const char* filename, con
     return *result ? 0 : errno;
 }
 
+int APS5_VABI freopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode, FileStream* stream) {
+    constexpr int GuestEinval = 22;
+    if (!result) return GuestEinval;
+    *result = nullptr;
+    if (!filename || !mode || !stream) return GuestEinval;
+    *result = freopen_nid_postfix(filename, mode, stream);
+    return *result ? 0 : errno;
+}
+
 int APS5_VABI fclose_nid_postfix(FileStream* stream) {
     if (stream && !stream->IsOpen()) {
         std::unique_ptr<FileStream> owner(stream->IsDynamic() ? stream : nullptr);

From 37813eabeb1ab36e3dd0a7b8a67a6b3846d2093e Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:54:03 +0200
Subject: [PATCH 162/218] test(libc): cover the Annex K stream printf and scanf
 functions

---
 core/libs/prx/libc/include/Api.hpp     |  12 ++
 core/libs/tests/GuestStdioVariadic.cpp | 146 +++++++++++++++++++++++++
 2 files changed, 158 insertions(+)

diff --git a/core/libs/prx/libc/include/Api.hpp b/core/libs/prx/libc/include/Api.hpp
index d25dbadc88..0dc968d0d2 100644
--- a/core/libs/prx/libc/include/Api.hpp
+++ b/core/libs/prx/libc/include/Api.hpp
@@ -219,6 +219,7 @@ int APS5_VABI strerror_r_nid_postfix(int error, char* buffer, std::size_t length
 void APS5_VABI perror_nid_postfix(const char* prefix);
 FileStream* APS5_VABI fdopen_nid_postfix(int descriptor, const char* mode);
 FileStream* APS5_VABI freopen_nid_postfix(const char* filename, const char* mode, FileStream* stream);
+int APS5_VABI freopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode, FileStream* stream);
 FileStream* APS5_VABI fopen_nid_postfix(const char* filename, const char* mode);
 int APS5_VABI fopen_s_nid_postfix(FileStream** result, const char* filename, const char* mode);
 int APS5_VABI fclose_nid_postfix(FileStream* stream);
@@ -355,6 +356,13 @@ int APS5_VABI puts_nid_postfix(const char* s);
 int APS5_VABI vfscanf_nid_postfix(FileStream* stream, const char* format, VaList* args);
 int APS5_VABI vscanf_nid_postfix(const char* format, VaList* args);
 int APS5_VABI scanf_nid_postfix(const char* format, ...);
+int APS5_VABI vfprintf_s_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI vprintf_s_nid_postfix(const char* format, VaList* args);
+int APS5_VABI fprintf_s_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI vfscanf_s_nid_postfix(FileStream* stream, const char* format, VaList* args);
+int APS5_VABI vscanf_s_nid_postfix(const char* format, VaList* args);
+int APS5_VABI fscanf_s_nid_postfix(FileStream* stream, const char* format, ...);
+int APS5_VABI scanf_s_nid_postfix(const char* format, ...);
 int APS5_VABI vswprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, VaList* args);
 int APS5_VABI swprintf_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
 int APS5_VABI snwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const char16_t* format, ...);
@@ -364,6 +372,10 @@ int APS5_VABI vsnwprintf_s_nid_postfix(char16_t* buffer, std::size_t size, const
 int APS5_VABI wprintf_nid_postfix(const char16_t* format, ...);
 int APS5_VABI vfwprintf_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
 int APS5_VABI fwprintf_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI vfwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, VaList* args);
+int APS5_VABI vwprintf_s_nid_postfix(const char16_t* format, VaList* args);
+int APS5_VABI fwprintf_s_nid_postfix(FileStream* stream, const char16_t* format, ...);
+int APS5_VABI wprintf_s_nid_postfix(const char16_t* format, ...);
 int APS5_VABI vwprintf_nid_postfix(const char16_t* format, VaList* args);
 int APS5_VABI fputwc_nid_postfix(char16_t value, FileStream* stream);
 int APS5_VABI fputws_nid_postfix(const char16_t* str, FileStream* stream);
diff --git a/core/libs/tests/GuestStdioVariadic.cpp b/core/libs/tests/GuestStdioVariadic.cpp
index 0fa24de842..ba641b06f3 100644
--- a/core/libs/tests/GuestStdioVariadic.cpp
+++ b/core/libs/tests/GuestStdioVariadic.cpp
@@ -41,6 +41,59 @@ static int APS5_VABI ScanInput(const char* format, ...) {
     return result;
 }
 
+static int APS5_VABI PrintSecure(FileStream* stream, const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI PrintSecureOutput(const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vprintf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI ScanSecureStream(FileStream* stream, const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfscanf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI ScanSecureInput(const char* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vscanf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI PrintWideSecure(FileStream* stream, const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vfwprintf_s_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static int APS5_VABI PrintWideSecureOutput(const char16_t* format, ...) {
+    APS5_VA_BEGIN(format);
+    const int result = vwprintf_s_nid_postfix(format, reinterpret_cast<VaList*>(args));
+    APS5_VA_END();
+    return result;
+}
+
+static FileStream* SeededStream(const char* text) {
+    auto* stream = new FileStream(std::tmpfile(), true);
+    Require(std::fputs(text, stream->GetHandle()) >= 0, "seed a stream");
+    std::rewind(stream->GetHandle());
+    return stream;
+}
+
+static int NextByte(FileStream* stream) {
+    return std::fgetc(stream->GetHandle());
+}
+
 static int APS5_VABI PrintWide(FileStream* stream, const char16_t* format, ...) {
     APS5_VA_BEGIN(format);
     const int result = vfwprintf_nid_postfix(stream, format, reinterpret_cast<VaList*>(args));
@@ -131,6 +184,99 @@ int main() {
     Require(Contents(written) == "7:\xc3\xa9t\xc3\xa9|  2.2", "the stream holds the formatted text");
     written.Close();
 
+    FileStream securePlain(std::tmpfile());
+    FileStream secureChecked(std::tmpfile());
+    FileStream secureList(std::tmpfile());
+    Require(fprintf_nid_postfix(&securePlain, "%d|%s|%5.2f|%c|%ls", 42, "ab", 3.14159, 'z', u"é") == 16, "fprintf reference");
+    Require(fprintf_s_nid_postfix(&secureChecked, "%d|%s|%5.2f|%c|%ls", 42, "ab", 3.14159, 'z', u"é") == 16, "fprintf_s count");
+    Require(PrintSecure(&secureList, "%d|%s|%5.2f|%c|%ls", 42, "ab", 3.14159, 'z', u"é") == 16, "vfprintf_s count");
+    const std::string expectedText = "42|ab| 3.14|z|\xc3\xa9";
+    Require(Contents(securePlain) == expectedText, "fprintf reference bytes");
+    Require(Contents(secureChecked) == expectedText, "fprintf_s writes the bytes fprintf writes");
+    Require(Contents(secureList) == expectedText, "vfprintf_s writes the bytes fprintf writes");
+    securePlain.Close();
+    secureChecked.Close();
+    secureList.Close();
+
+    FileStream violations(std::tmpfile());
+    signed char marker = -7;
+    char sibling[16];
+    Require(snprintf_s_nid_postfix(sibling, sizeof(sibling), "ab%hhn", &marker) == -1, "snprintf_s rejects %n");
+    Require(fprintf_s_nid_postfix(&violations, "ab%hhn", &marker) == -1 && marker == -7, "fprintf_s rejects %n like snprintf_s");
+    Require(PrintSecure(&violations, "ab%n", &number) == -1, "vfprintf_s rejects %n");
+    Require(snprintf_s_nid_postfix(sibling, sizeof(sibling), "%s", static_cast<const char*>(nullptr)) == -1, "snprintf_s rejects a null %s");
+    Require(fprintf_s_nid_postfix(&violations, "x%s", static_cast<const char*>(nullptr)) == -1, "fprintf_s rejects a null %s");
+    Require(fprintf_s_nid_postfix(&violations, static_cast<const char*>(nullptr)) == -1, "fprintf_s rejects a null format");
+    Require(PrintSecure(&violations, static_cast<const char*>(nullptr)) == -1, "vfprintf_s rejects a null format");
+    Require(fprintf_s_nid_postfix(nullptr, "x") == -1, "fprintf_s rejects a null stream");
+    Require(PrintSecure(nullptr, "x") == -1, "vfprintf_s rejects a null stream");
+    Require(Contents(violations).empty(), "a rejected call writes nothing");
+    Require(fprintf_s_nid_postfix(&violations, "%s", "") == 0, "fprintf_s of an empty string");
+    violations.Close();
+    Require(PrintSecureOutput("vprintf_s: %d\n", 42) == 14, "vprintf_s counts the bytes written to standard output");
+    Require(PrintSecureOutput("%n", &number) == -1 && PrintSecureOutput(static_cast<const char*>(nullptr)) == -1, "vprintf_s violations");
+
+    FileStream wideChecked(std::tmpfile());
+    FileStream wideList(std::tmpfile());
+    int widePosition = -5;
+    Require(fwprintf_s_nid_postfix(&wideChecked, u"%05d:%ls|", 42, u"été") == 10, "fwprintf_s counts wide characters");
+    Require(PrintWideSecure(&wideList, u"%05d:%ls|", 42, u"été") == 10, "vfwprintf_s counts wide characters");
+    Require(Contents(wideChecked) == "00042:\xc3\xa9t\xc3\xa9|" && Contents(wideList) == Contents(wideChecked), "wide secure output bytes");
+    Require(fwprintf_s_nid_postfix(&wideChecked, u"a%n", &widePosition) == -1 && widePosition == -5, "fwprintf_s rejects %n");
+    Require(PrintWideSecure(&wideChecked, u"a%ls", static_cast<const char16_t*>(nullptr)) == -1, "vfwprintf_s rejects a null %ls");
+    Require(fwprintf_s_nid_postfix(&wideChecked, static_cast<const char16_t*>(nullptr)) == -1, "fwprintf_s rejects a null format");
+    Require(fwprintf_s_nid_postfix(nullptr, u"x") == -1 && PrintWideSecure(nullptr, u"x") == -1, "wide secure forms reject a null stream");
+    wideChecked.Close();
+    wideList.Close();
+    Require(wprintf_s_nid_postfix(u"wprintf_s %d\n", 5) == 12, "wprintf_s counts wide characters");
+    Require(PrintWideSecureOutput(u"vwprintf_s %d\n", 6) == 13, "vwprintf_s counts wide characters");
+    Require(wprintf_s_nid_postfix(u"%n", &widePosition) == -1 && PrintWideSecureOutput(static_cast<const char16_t*>(nullptr)) == -1, "wide standard output violations");
+
+    FileStream* sizedInput = SeededStream("17 hello Q 9 12abc key=val abcdef 4.5");
+    char sizedWord[6]{};
+    char sizedChar = 0;
+    Require(fscanf_s_nid_postfix(sizedInput, "%d %s %c", &number, sizedWord, 6u, &sizedChar, 1u) == 3, "fscanf_s assigns the sized conversions");
+    Require(number == 17 && std::strcmp(sizedWord, "hello") == 0 && sizedChar == 'Q', "fscanf_s values");
+    Require(ScanSecureStream(sizedInput, "%d", &number) == 1 && number == 9, "vfscanf_s continues from the stream position");
+    Require(fscanf_s_nid_postfix(sizedInput, "%d", &number) == 1 && number == 12 && NextByte(sizedInput) == 'a', "fscanf_s leaves the character that ended the number");
+    char key[4]{};
+    char value[8]{};
+    Require(fscanf_s_nid_postfix(sizedInput, "bc %3[a-z]=%7s", key, 4u, value, 8u) == 2, "fscanf_s with a set and a string");
+    Require(std::strcmp(key, "key") == 0 && std::strcmp(value, "val") == 0 && NextByte(sizedInput) == ' ', "fscanf_s set and string values");
+    char tooSmall[4] = {'x', 'x', 'x', 'x'};
+    char siblingSmall[4] = {'x', 'x', 'x', 'x'};
+    Require(sscanf_s_nid_postfix("abcdef", "%s", siblingSmall, 4u) == 0 && siblingSmall[0] == '\0', "sscanf_s reference for an undersized buffer");
+    Require(fscanf_s_nid_postfix(sizedInput, "%s", tooSmall, 4u) == 0 && tooSmall[0] == '\0', "fscanf_s rejects an undersized buffer like sscanf_s");
+    sizedInput->Close();
+    delete sizedInput;
+
+    FileStream* tailInput = SeededStream("x 3.5 7");
+    int count = 0;
+    Require(ScanSecureStream(tailInput, "%d", &number) == 0, "vfscanf_s matching failure");
+    Require(fscanf_s_nid_postfix(tailInput, " x %*f%n %d", &count, &number) == 1 && count == 5 && number == 7, "fscanf_s suppression and %n");
+    Require(fscanf_s_nid_postfix(tailInput, "%d", &number) == EOF, "fscanf_s at end of file");
+    tailInput->Close();
+    delete tailInput;
+
+    FileStream* nullInput = SeededStream("5 6");
+    Require(fscanf_s_nid_postfix(nullInput, "%d", static_cast<int*>(nullptr)) == EOF, "fscanf_s null destination");
+    Require(fscanf_s_nid_postfix(nullInput, static_cast<const char*>(nullptr)) == EOF, "fscanf_s null format");
+    Require(fscanf_s_nid_postfix(nullptr, "%d", &number) == EOF && ScanSecureStream(nullptr, "%d", &number) == EOF, "fscanf_s null stream");
+    nullInput->Close();
+    delete nullInput;
+
+    FileStream* const savedInput = __stdinp_nid_postfix;
+    FileStream* redirected = SeededStream("21 word 3 more");
+    __stdinp_nid_postfix = redirected;
+    char redirectedWord[8]{};
+    int redirectedNumber = 0;
+    Require(scanf_s_nid_postfix("%d %7s", &number, redirectedWord, 8u) == 2 && number == 21 && std::strcmp(redirectedWord, "word") == 0, "scanf_s reads the guest standard input");
+    Require(ScanSecureInput("%d %4s", &redirectedNumber, redirectedWord, 5u) == 2 && redirectedNumber == 3 && std::strcmp(redirectedWord, "more") == 0, "vscanf_s reads the guest standard input");
+    Require(scanf_s_nid_postfix("%d", &number) == EOF, "scanf_s at end of input");
+    __stdinp_nid_postfix = savedInput;
+    redirected->Close();
+    delete redirected;
+
     std::int32_t a = 0, b = 0;
     Require(ScanWide(u"  31 -4", u"%d%d", &a, &b) == 2 && a == 31 && b == -4, "vswscanf");
     Require(ScanWide(u"", u"%d", &a) == EOF, "vswscanf on empty input");

From fa7d4bd1d04f17674faf01c880f62bf2be01d28f Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:54:05 +0200
Subject: [PATCH 163/218] test(libc): cover freopen_s

---
 core/libs/prx/libc/src/FileAndHeap.cpp |  2 +-
 core/libs/tests/GuestFopenErrors.cpp   | 27 ++++++++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libc/src/FileAndHeap.cpp b/core/libs/prx/libc/src/FileAndHeap.cpp
index cec8e4084b..51550e1dac 100644
--- a/core/libs/prx/libc/src/FileAndHeap.cpp
+++ b/core/libs/prx/libc/src/FileAndHeap.cpp
@@ -469,7 +469,7 @@ int APS5_VABI freopen_s_nid_postfix(FileStream** result, const char* filename, c
     constexpr int GuestEinval = 22;
     if (!result) return GuestEinval;
     *result = nullptr;
-    if (!filename || !mode || !stream) return GuestEinval;
+    if (!mode || !stream) return GuestEinval;
     *result = freopen_nid_postfix(filename, mode, stream);
     return *result ? 0 : errno;
 }
diff --git a/core/libs/tests/GuestFopenErrors.cpp b/core/libs/tests/GuestFopenErrors.cpp
index 7cfd9c96b6..1643eef3fc 100644
--- a/core/libs/tests/GuestFopenErrors.cpp
+++ b/core/libs/tests/GuestFopenErrors.cpp
@@ -22,6 +22,7 @@ void Require(bool value, int line) {
 constexpr int GuestEnoent = 2;
 constexpr int GuestEisdir = 21;
 constexpr int GuestEinval = 22;
+constexpr int GuestEnotsup = 45;
 constexpr int GuestEloop = 62;
 constexpr int GuestEnametoolong = 63;
 
@@ -88,6 +89,31 @@ void CheckedOpen() {
     Check(fopen_s_nid_postfix(&stream, "plain.txt", "r") == 0 && stream != nullptr && fclose_nid_postfix(stream) == 0);
 }
 
+void CheckedReopen() {
+    FileStream* const sentinel = reinterpret_cast<FileStream*>(1);
+    FileStream* result = sentinel;
+    FileStream* stream = fopen_nid_postfix("plain.txt", "r");
+    Check(stream != nullptr);
+    Check(freopen_s_nid_postfix(nullptr, "plain.txt", "r", stream) == GuestEinval);
+    Check(freopen_s_nid_postfix(&result, nullptr, "r", stream) == GuestEnotsup && result == nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "plain.txt", nullptr, stream) == GuestEinval && result == nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "plain.txt", "r", nullptr) == GuestEinval && result == nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "plain.txt", "z", stream) == GuestEinval && result == nullptr);
+    Check(freopen_s_nid_postfix(&result, "reopened.txt", "w", stream) == 0 && result == stream);
+    Check(fclose_nid_postfix(stream) == 0 && std::filesystem::exists("reopened.txt"));
+    stream = fopen_nid_postfix("plain.txt", "r");
+    Check(stream != nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "loop", "r", stream) == GuestEloop && result == nullptr);
+    stream = fopen_nid_postfix("plain.txt", "r");
+    Check(stream != nullptr);
+    result = sentinel;
+    Check(freopen_s_nid_postfix(&result, "missing.txt", "r", stream) == GuestEnoent && result == nullptr);
+}
+
 }
 
 int main() {
@@ -95,6 +121,7 @@ int main() {
     Open();
     Reopen();
     CheckedOpen();
+    CheckedReopen();
     std::error_code error;
     std::filesystem::current_path(std::filesystem::temp_directory_path(), error);
     std::filesystem::remove_all(root, error);

From 3aa53715ce371c75e3fb400b514eb46287cb1020 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 00:54:06 +0200
Subject: [PATCH 164/218] docs(debt): record the unmeasured Annex K stream
 function results

---
 docs/dev/debt/libc.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index aa59ca4095..1f0e95b5cf 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -175,3 +175,6 @@
 - [num_get<char>::id, time_get<char>::id and the num_get<char> vtable](../../../core/libs/prx/libc/src/LocaleSupport.cpp) (libc) are data objects, as the public SDK's libSceLibcInternal table declares them and as the other facet ids and the `num_put` and `codecvt` vtables are kept: the ids start at zero and the vtable is 17 zeroed slots, the 136-byte size of `KfcTPbeaOqg` in the console's libSceLibcInternal, whose relocations fill the offset-to-top and typeinfo entries, the two destructors, `locale::facet::_Incref` and `_Decref`, and the eleven `do_get` of Dinkumware's crt.vc12 `xlocnum`, so a guest resolves the symbols and reads data, and a facet call through the vtable faults. libSceAmpr exported the three as throwing functions, which a data consumer reads as code; its qualified imports fall back to libc.
 - [printf family conversions](../../../core/libs/prx/libc/include/WindowsFormatting.hpp) (libc) - Windows `FormatWindows` follows the title `libc.prx` `_Printf` measured from PPSA13934, PPSA07923, PPSA05916 and PPSA04158: `%q`, `%D`, `%O` and `%U` are unknown conversions; an unknown character is printed with its leading `%`, and width, `-` and discarded length modifiers behave as measured (`%5y` is `   %y`, `%hhz` is `%z`). `%%` takes a width. A trailing `%` reads past the format's NUL and is not reproduced; it throws. `#`, precision and a `0` without a width are ignored, as a payload process on a PS5 (firmware 13.60) printed `%#k` and `%.2k` as `%k`; `+`, space, `'` and `0` with a width on an unknown conversion are unverified and throw. On Linux a format with an unknown conversion also goes to this formatter
 - [child process registry](../../../core/libs/prx/libc/src/Process.cpp) (libc) - `RegisterChildProcess_nid_no_patch` and `WaitChildProcess_nid_no_patch` track the native handles of children created by `posix_spawn` ([libSceLibcInternal](../../../core/libs/prx/libSceLibcInternal/Spawn.cpp)) so libkernel can reap them on Windows, where the host has no `waitpid`. The registry lives in libc because libSceLibcInternal imports libc but not libkernel. `RegisterChildProcess_nid_no_patch` stores the process ID and handle; only reaped handles are closed, and a process that exits without waiting leaks them. Registration without a live child is not validated, and a duplicate process ID is accepted. The decoder maps recognized structured-exception codes to guest signals, keeping the guest `exit` byte layout for anything else. These exports are internal glue for libkernel, not console ABI: their behavior is unverified against any PS5 library and a title importing their NIDs directly is not expected.
+- [fprintf_s, vfprintf_s, vprintf_s, fwprintf_s, wprintf_s, vfwprintf_s and vwprintf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) follow C11 K.3.5.3.1, K.3.5.3.10 and K.3.9.1.1 with the constraints of `snprintf_s` and `swprintf_s`: a null stream, format or argument list, any `%n`, and a null `%s`, `%ls` or `%S` argument return -1 and write nothing, because the output is formatted completely before it is written. A violation only returns: the constraint handler is not invoked, `errno` is untouched, and the value is the one the narrow `snprintf_s` returns on this branch, not a result measured for a stream function on a PS5. A closed stream sets `EBADF` (9) as `fprintf` does. `vprintf_s` and `vwprintf_s` write to the guest standard output stream, and the wide forms count characters while the narrow ones count bytes, as their unchecked siblings do
+- [scanf_s, fscanf_s, vscanf_s and vfscanf_s](../../../core/libs/prx/libc/src/Formatting.cpp) (libc) run the scanner of `sscanf_s` over the stream, taking the size of `%s`, `%c` and `%[` as `unsigned int` after the pointer, so everything listed for `sscanf_s` applies, including the count of items converted before an undersized destination, whose first element is set to zero. Each directive is read from the stream with the host `fscanf`, with one character of look-ahead pushed back, so the stream stops after the last character a conversion used. A null stream, null format or null destination returns `EOF`, a closed stream also sets `EBADF`, and the constraint handler is not invoked. The 16-bit wide conversions (`%ls`, `%lc`, `%l[`, `%S`, `%C`) throw on Linux, as in `fscanf`. None of the stream forms were measured on a PS5, and the size type follows `sscanf_s` rather than `rsize_t`
+- [freopen_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) follows C11 K.3.5.2.2 through `freopen`: a null result, mode or stream returns `EINVAL` (22) with `*result` set to null when it exists, and a null name is passed to `freopen`, which reports mode-only reopening as unsupported (`ENOTSUP`, 45) with `*result` null, and the constraint handler is not invoked, as in `fopen_s`. A successful reopen stores the stream in `*result` and returns 0, and a failed one stores null and returns the errno `freopen` left, closing the stream as `freopen` does. The console's return values are unverified

From e0932f82ce91529db16d390a839c75ff3dc09392 Mon Sep 17 00:00:00 2001
From: AlxcBTW <187763517+AlxcBTW@users.noreply.github.com>
Date: Thu, 22 Oct 2026 01:36:24 +0200
Subject: [PATCH 165/218] test(libc): check that the Annex K stream functions
 set EBADF on a closed stream

---
 core/libs/tests/GuestStdioVariadic.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/core/libs/tests/GuestStdioVariadic.cpp b/core/libs/tests/GuestStdioVariadic.cpp
index ba641b06f3..8a0f65449d 100644
--- a/core/libs/tests/GuestStdioVariadic.cpp
+++ b/core/libs/tests/GuestStdioVariadic.cpp
@@ -1,6 +1,7 @@
 #include "prx/libc/include/Api.hpp"
 #include "prx/libc/include/FileStream.hpp"
 #include "prx/libc/include/general/VabiMacros.hpp"
+#include <cerrno>
 #include <cstdarg>
 #include <cstdint>
 #include <cstdio>
@@ -213,6 +214,8 @@ int main() {
     Require(Contents(violations).empty(), "a rejected call writes nothing");
     Require(fprintf_s_nid_postfix(&violations, "%s", "") == 0, "fprintf_s of an empty string");
     violations.Close();
+    errno = 0;
+    Require(fprintf_s_nid_postfix(&violations, "x") == -1 && errno == 9, "fprintf_s on a closed stream sets EBADF");
     Require(PrintSecureOutput("vprintf_s: %d\n", 42) == 14, "vprintf_s counts the bytes written to standard output");
     Require(PrintSecureOutput("%n", &number) == -1 && PrintSecureOutput(static_cast<const char*>(nullptr)) == -1, "vprintf_s violations");
 
@@ -228,6 +231,8 @@ int main() {
     Require(fwprintf_s_nid_postfix(nullptr, u"x") == -1 && PrintWideSecure(nullptr, u"x") == -1, "wide secure forms reject a null stream");
     wideChecked.Close();
     wideList.Close();
+    errno = 0;
+    Require(fwprintf_s_nid_postfix(&wideList, u"x") == -1 && errno == 9, "fwprintf_s on a closed stream sets EBADF");
     Require(wprintf_s_nid_postfix(u"wprintf_s %d\n", 5) == 12, "wprintf_s counts wide characters");
     Require(PrintWideSecureOutput(u"vwprintf_s %d\n", 6) == 13, "vwprintf_s counts wide characters");
     Require(wprintf_s_nid_postfix(u"%n", &widePosition) == -1 && PrintWideSecureOutput(static_cast<const char16_t*>(nullptr)) == -1, "wide standard output violations");
@@ -248,6 +253,8 @@ int main() {
     Require(sscanf_s_nid_postfix("abcdef", "%s", siblingSmall, 4u) == 0 && siblingSmall[0] == '\0', "sscanf_s reference for an undersized buffer");
     Require(fscanf_s_nid_postfix(sizedInput, "%s", tooSmall, 4u) == 0 && tooSmall[0] == '\0', "fscanf_s rejects an undersized buffer like sscanf_s");
     sizedInput->Close();
+    errno = 0;
+    Require(fscanf_s_nid_postfix(sizedInput, "%d", &number) == EOF && errno == 9, "fscanf_s on a closed stream sets EBADF");
     delete sizedInput;
 
     FileStream* tailInput = SeededStream("x 3.5 7");

From d1a277b7d8a4f0182aec47201496406b122b148d Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Thu, 22 Oct 2026 06:07:44 +0100
Subject: [PATCH 166/218] feat(libc): implement sequential bitwise fetch
 helpers

---
 core/libs/CMakeLists.txt                     |  26 ++++
 core/libs/prx/libc/src/DinkumwareAtomics.cpp |  13 ++
 core/libs/tests/GuestDinkumwareFetch.cpp     | 133 +++++++++++++++++++
 docs/dev/debt/libc.md                        |   1 +
 4 files changed, 173 insertions(+)
 create mode 100644 core/libs/tests/GuestDinkumwareFetch.cpp

diff --git a/core/libs/CMakeLists.txt b/core/libs/CMakeLists.txt
index 3558a24246..207186c227 100644
--- a/core/libs/CMakeLists.txt
+++ b/core/libs/CMakeLists.txt
@@ -278,6 +278,32 @@ if(BUILD_TESTING)
     add_test(NAME nid_buffer_validation COMMAND nid_buffer_validation_tests)
     set_tests_properties(nid_buffer_validation PROPERTIES TIMEOUT 10)
 
+    add_test_executable(guest_dinkumware_fetch_tests ${CMAKE_CURRENT_SOURCE_DIR}/tests/GuestDinkumwareFetch.cpp
+        ${CMAKE_CURRENT_SOURCE_DIR}/nid/src/NidCompute.cpp ${CMAKE_CURRENT_SOURCE_DIR}/nid/src/Sha1.cpp)
+    target_include_directories(guest_dinkumware_fetch_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_SOURCE_DIR}/nid/include)
+    target_link_libraries(guest_dinkumware_fetch_tests PRIVATE ${CMAKE_DL_LIBS})
+    configure_windows_unwind(guest_dinkumware_fetch_tests)
+    if(MINGW)
+        target_link_libraries(guest_dinkumware_fetch_tests PRIVATE libc)
+    endif()
+    add_custom_target(guest_dinkumware_fetch_libraries DEPENDS ${LIBC_PATCHED})
+    add_dependencies(guest_dinkumware_fetch_tests guest_dinkumware_fetch_libraries)
+    foreach(operation IN ITEMS and or xor)
+        foreach(width IN ITEMS 1 2 4)
+            add_test(NAME guest_dinkumware_fetch_${operation}_${width} COMMAND guest_dinkumware_fetch_tests
+                $<TARGET_FILE_DIR:libc> unpatched ${operation} ${width})
+            add_test(NAME guest_dinkumware_fetch_${operation}_${width}_patched COMMAND guest_dinkumware_fetch_tests
+                ${PATCHED_DIR} patched ${operation} ${width})
+            set_tests_properties(guest_dinkumware_fetch_${operation}_${width}
+                guest_dinkumware_fetch_${operation}_${width}_patched PROPERTIES TIMEOUT 20)
+            if(WIN32)
+                set_tests_properties(guest_dinkumware_fetch_${operation}_${width} PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+                set_tests_properties(guest_dinkumware_fetch_${operation}_${width}_patched PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:${PATCHED_DIR}")
+            endif()
+        endforeach()
+    endforeach()
     add_test_executable(pe_import_first_tests allocator/tests/PeImportFirstTests.cpp allocator/PeImportFirst.cpp)
     target_include_directories(pe_import_first_tests PRIVATE ${CMAKE_CURRENT_SOURCE_DIR})
     target_compile_features(pe_import_first_tests PRIVATE cxx_std_20)
diff --git a/core/libs/prx/libc/src/DinkumwareAtomics.cpp b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
index 13af94ddea..d6f48c7aa7 100644
--- a/core/libs/prx/libc/src/DinkumwareAtomics.cpp
+++ b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
@@ -63,6 +63,19 @@ int LockedCompareExchange(volatile unsigned char* flag, std::size_t size, volati
 
 extern "C" {
 
+std::uint8_t APS5_VABI _Fetch_and_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI _Fetch_and_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI _Fetch_and_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_and(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI _Fetch_or_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI _Fetch_or_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI _Fetch_or_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_or(target, value, __ATOMIC_SEQ_CST); }
+
+std::uint8_t APS5_VABI _Fetch_xor_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint16_t APS5_VABI _Fetch_xor_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+std::uint32_t APS5_VABI _Fetch_xor_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
+
+
 void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { Store(target, value); }
 void APS5_VABI _Atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { Store(target, value); }
 void APS5_VABI _Atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { Store(target, value); }
diff --git a/core/libs/tests/GuestDinkumwareFetch.cpp b/core/libs/tests/GuestDinkumwareFetch.cpp
new file mode 100644
index 0000000000..81a8d10c1b
--- /dev/null
+++ b/core/libs/tests/GuestDinkumwareFetch.cpp
@@ -0,0 +1,133 @@
+#include "prx/libc/include/general/VabiMacros.hpp"
+#include <nid/NidCompute.hpp>
+#include <array>
+#include <barrier>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <limits>
+#include <string>
+#include <thread>
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <dlfcn.h>
+#endif
+
+static void Require(bool value, const char* message) {
+    if (value) return;
+    std::fprintf(stderr, "%s\n", message);
+    std::exit(1);
+}
+
+template<typename TValue>
+using Fetch = TValue (APS5_VABI*)(volatile TValue*, TValue);
+
+template<typename TValue>
+static TValue Expected(TValue before, TValue operand, const std::string& operation) {
+    if (operation == "and") return before & operand;
+    if (operation == "or") return before | operand;
+    return before ^ operand;
+}
+
+template<typename TValue>
+static void Check(Fetch<TValue> fetch, const std::string& operation) {
+    constexpr TValue maximum = std::numeric_limits<TValue>::max();
+    std::array<TValue, 3> guarded{maximum, 0, maximum};
+    const auto one = [&](TValue before, TValue operand) {
+        guarded[1] = before;
+        Require(fetch(&guarded[1], operand) == before, "fetch must return the original value");
+        Require(guarded[1] == Expected(before, operand, operation), "bitwise result");
+        Require(guarded[0] == maximum && guarded[2] == maximum, "neighboring storage changed");
+    };
+    if constexpr (sizeof(TValue) == 1) {
+        for (unsigned before = 0; before < 256; ++before)
+            for (unsigned operand = 0; operand < 256; ++operand)
+                one(static_cast<TValue>(before), static_cast<TValue>(operand));
+    } else {
+        constexpr std::array<TValue, 6> values{0, 1, maximum, static_cast<TValue>(maximum >> 1), static_cast<TValue>(TValue{1} << (sizeof(TValue) * 8 - 1)), static_cast<TValue>(0xA55AA55A)};
+        for (TValue before : values) for (TValue operand : values) one(before, operand);
+        std::uint32_t random = 0x31415926;
+        for (unsigned i = 0; i < 4096; ++i) {
+            random = random * 1664525u + 1013904223u;
+            const TValue before = static_cast<TValue>(random);
+            random = random * 1664525u + 1013904223u;
+            one(before, static_cast<TValue>(random));
+        }
+    }
+    guarded[1] = operation == "and" ? maximum : 0;
+    std::array<std::thread, 4> workers;
+    std::barrier start(4);
+    for (unsigned index = 0; index < workers.size(); ++index) {
+        workers[index] = std::thread([&, index] {
+            const TValue bit = static_cast<TValue>(TValue{1} << index);
+            const TValue operand = operation == "and" ? static_cast<TValue>(~bit) : bit;
+            start.arrive_and_wait();
+            for (unsigned iteration = 0; iteration < 1025; ++iteration) {
+                const TValue previous = fetch(&guarded[1], operand);
+                const bool expected = operation == "and" ? iteration == 0 : operation == "or" ? iteration != 0 : iteration % 2 != 0;
+                Require(((previous & bit) != 0) == expected, "concurrent original-bit history");
+            }
+        });
+    }
+    for (auto& worker : workers) worker.join();
+    Require(guarded[1] == (operation == "and" ? static_cast<TValue>(maximum & ~TValue{15}) : TValue{15}), "concurrent updates lost");
+    Require(guarded[0] == maximum && guarded[2] == maximum, "concurrent neighboring storage changed");
+    std::array<TValue, 2> flags{};
+    std::array<TValue, 2> observed{};
+    std::barrier phase(3);
+    const auto litmus = [&](unsigned index) {
+        for (unsigned i = 0; i < 512; ++i) {
+            phase.arrive_and_wait();
+            fetch(&flags[index], operation == "and" ? TValue{0} : TValue{1});
+            observed[index] = fetch(&flags[1 - index], operation == "and" ? maximum : TValue{0});
+            phase.arrive_and_wait();
+        }
+    };
+    std::thread first(litmus, 0), second(litmus, 1);
+    for (unsigned i = 0; i < 512; ++i) {
+        flags.fill(operation == "and" ? maximum : TValue{0});
+        phase.arrive_and_wait();
+        phase.arrive_and_wait();
+        const TValue initial = operation == "and" ? maximum : TValue{0};
+        Require(observed[0] != initial || observed[1] != initial, "forbidden sequentially consistent outcome");
+    }
+    first.join();
+    second.join();
+}
+
+int main(int argc, char** argv) {
+    Require(argc == 5, "library directory, patched or unpatched, operation, width");
+    const auto path = std::filesystem::absolute(argv[1]) / "libc.prx";
+    const std::string operation = argv[3];
+    const int width = std::atoi(argv[4]);
+    Require(operation == "and" || operation == "or" || operation == "xor", "operation");
+    Require(width == 1 || width == 2 || width == 4, "width");
+    const std::string name = "_Fetch_" + operation + "_seq_cst_" + std::to_string(width);
+    const std::string symbol = std::string(argv[2]) == "patched" ? Nid::ComputeNid(name, "") : name + "_nid_postfix";
+#ifdef _WIN32
+    SetErrorMode(SEM_FAILCRITICALERRORS | SEM_NOGPFAULTERRORBOX);
+    const auto startup = GetModuleHandleW(L"libc.prx");
+    const auto library = LoadLibraryExW(path.c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
+    Require(library != nullptr, "load libc");
+    std::array<wchar_t, 32768> loaded{};
+    const auto length = GetModuleFileNameW(library, loaded.data(), static_cast<DWORD>(loaded.size()));
+    Require(length != 0 && length < loaded.size(), "loaded libc path");
+    Require(std::filesystem::equivalent(path, std::filesystem::path(loaded.data())), "wrong libc loaded");
+    if (startup) Require(startup == library, "startup libc differs from selected libc");
+    std::printf("Selected libc: %ls (startup module %s)\n", loaded.data(), startup ? "same" : "not imported");
+    const auto function = reinterpret_cast<void*>(GetProcAddress(library, symbol.c_str()));
+#else
+    const auto library = dlopen(path.c_str(), RTLD_NOW | RTLD_LOCAL);
+    if (!library) std::fprintf(stderr, "%s\n", dlerror());
+    Require(library != nullptr, "load libc");
+    const auto function = dlsym(library, symbol.c_str());
+#endif
+    if (!function) std::fprintf(stderr, "Missing %s (%s)\n", name.c_str(), symbol.c_str());
+    Require(function != nullptr, "cannot exercise missing helper");
+    if (width == 1) Check(reinterpret_cast<Fetch<std::uint8_t>>(function), operation);
+    if (width == 2) Check(reinterpret_cast<Fetch<std::uint16_t>>(function), operation);
+    if (width == 4) Check(reinterpret_cast<Fetch<std::uint32_t>>(function), operation);
+    std::printf("%s: value, original result, bounds, concurrency and ordering checks passed\n", name.c_str());
+}
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index aa59ca4095..be6d04f57d 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -33,6 +33,7 @@
 - [acosl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's `libc.prx`): results can differ from the console's in the last bit, and on Linux glibc sets `errno` to `EDOM` for `acosl` outside [-1, 1] where msun only raises the floating-point exception. `long double` is the x87 80-bit format, as Sony's `frexpl` uses it (`fldt 0x8(%rsp)`, result in `st(0)`)
 - [atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl](../../../core/libs/prx/libc/src/Math.cpp) (libc) - computed by the host's math library, as `acosl` is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's `log10l(1000)` is not exactly 3), and on Linux glibc sets `errno` to `EDOM` or `ERANGE` where msun only raises the floating-point exception. `ldexpl` and `truncl` are exact operations and give the console's result; `logb` and `remainder` give the console's value too, but on Linux glibc sets `errno` (`ERANGE` for `logb(0)`, `EDOM` for `remainder` by zero or of an infinity) where msun only raises the floating-point exception
 - [Dinkumware atomics](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) - every operation is sequentially consistent whatever memory order it is given, which is never weaker than the console. Matching the `libc.prx` bundled with PPSA08427 (that binary run side by side on every order from 0 to 7), `_Atomic_load_8` returns 0 for a release, acq_rel or invalid order and the 8-byte exchange and fetch operations return 0 without touching memory for an order above `memory_order_seq_cst`; the generic `_Atomic_copy`, `_Atomic_exchange` and `_Atomic_compare_exchange_*` lock the byte flag passed first, as the console does
+- [_Fetch_{and,or,xor}_seq_cst_{1,2,4}](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) follow the two-argument unsigned 8-, 16- and 32-bit helpers in Dinkumware [VC12 xatomic.h](https://github.com/ganboing/crt.vc12/blob/f1d47126bf13d1c9dccaa6c53b72217fd0474968/src/xatomic.h), using sequentially consistent atomic read-modify-write operations and returning the original value. The firmware 3.20 export inventory supplies the names and NIDs; the reference defines inline namespace helpers, so the equivalence to the console exports and their calling convention are inferred, not console-measured. A live, suitably aligned object is required as in the reference; invalid-pointer and misalignment fault behavior on the console is unverified. Windows tests cover raw and patched exports, values, neighboring storage and concurrent updates; a finite ordering litmus cannot prove the memory model.
 - [std_execute_once](../../../core/libs/prx/libc/Export.cpp) (libc) - assumed to be the plain-named twin of `std::_Execute_once` (`_ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1_`, the callee of Dinkumware `call_once`): it delegates there and gets the [thread.once.callonce] semantics already verified for that symbol (one invocation per flag, concurrent callers block until it completes, and a failing or throwing invocation leaves the flag unready so the next caller runs it). The name equivalence is not confirmed on a title, and the callback convention (called with (null, arg, null), non-zero return meaning success) is the twin's, unverified for this symbol
 - [__atomic_load, __atomic_store, __atomic_exchange and __atomic_compare_exchange](../../../core/libs/prx/libc/src/AtomicBuiltins.cpp) (libc) - the generic, size-parameterised libatomic entry points are a single `ud2` in the `libc.prx` bundled with PPSA08427 (disassembly), so the console traps on any call; these throw instead
 - [Sized __atomic calls](../../../core/libs/prx/libc/src/DinkumwareAtomics.cpp) (libc) - the 36 `__atomic_load_N`, `__atomic_store_N`, `__atomic_exchange_N`, `__atomic_compare_exchange_N` and `__atomic_fetch_{add,sub,and,or,xor}_N` calls (N = 1, 2, 4, 8) are sequentially consistent whatever order they are given. The `libc.prx` bundled with PPSA08427, run side by side on random values and on every order from -1 to 7, switches on the order but always uses a locked instruction or CAS loop, except that a store with an order other than `memory_order_seq_cst` is a plain store, so these are never weaker than the console. Unlike `_Atomic_load_8` and the 8-byte `_Atomic_*` exchange and fetch calls above, the console accepts every order here, including release, acq_rel and invalid ones, and these do the same

From b2446bd03772cd8ca082e0e052f156ad15b816ca Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Thu, 22 Oct 2026 07:18:24 +0100
Subject: [PATCH 167/218] style(libc): remove extra blank line after fetch
 helpers

---
 core/libs/prx/libc/src/DinkumwareAtomics.cpp | 1 -
 1 file changed, 1 deletion(-)

diff --git a/core/libs/prx/libc/src/DinkumwareAtomics.cpp b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
index d6f48c7aa7..fc480d7c02 100644
--- a/core/libs/prx/libc/src/DinkumwareAtomics.cpp
+++ b/core/libs/prx/libc/src/DinkumwareAtomics.cpp
@@ -75,7 +75,6 @@ std::uint8_t APS5_VABI _Fetch_xor_seq_cst_1_nid_postfix(volatile std::uint8_t* t
 std::uint16_t APS5_VABI _Fetch_xor_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
 std::uint32_t APS5_VABI _Fetch_xor_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value) { return __atomic_fetch_xor(target, value, __ATOMIC_SEQ_CST); }
 
-
 void APS5_VABI _Atomic_store_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int) { Store(target, value); }
 void APS5_VABI _Atomic_store_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int) { Store(target, value); }
 void APS5_VABI _Atomic_store_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value, int) { Store(target, value); }

From 3191597d51063a8a43a78eb7d76910c3b648d1b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A0=20Franch?= <adriadam10@gmail.com>
Date: Sun, 25 Oct 2026 19:16:24 +0100
Subject: [PATCH 168/218] fix(libc): declare fetch seq_cst helpers in the
 public header

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/include/Api.hpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/core/libs/prx/libc/include/Api.hpp b/core/libs/prx/libc/include/Api.hpp
index d25dbadc88..5d8535991c 100644
--- a/core/libs/prx/libc/include/Api.hpp
+++ b/core/libs/prx/libc/include/Api.hpp
@@ -163,6 +163,15 @@ int APS5_VABI _Atomic_compare_exchange_strong_8_nid_postfix(volatile std::uint64
 int APS5_VABI _Atomic_compare_exchange_weak_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t* expected, std::uint8_t desired, int, int);
 int APS5_VABI _Atomic_compare_exchange_weak_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t* expected, std::uint16_t desired, int, int);
 int APS5_VABI _Atomic_compare_exchange_weak_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t* expected, std::uint64_t desired, int, int);
+std::uint8_t APS5_VABI _Fetch_and_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value);
+std::uint16_t APS5_VABI _Fetch_and_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value);
+std::uint32_t APS5_VABI _Fetch_and_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value);
+std::uint8_t APS5_VABI _Fetch_or_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value);
+std::uint16_t APS5_VABI _Fetch_or_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value);
+std::uint32_t APS5_VABI _Fetch_or_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value);
+std::uint8_t APS5_VABI _Fetch_xor_seq_cst_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value);
+std::uint16_t APS5_VABI _Fetch_xor_seq_cst_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value);
+std::uint32_t APS5_VABI _Fetch_xor_seq_cst_4_nid_postfix(volatile std::uint32_t* target, std::uint32_t value);
 std::uint8_t APS5_VABI _Atomic_fetch_add_1_nid_postfix(volatile std::uint8_t* target, std::uint8_t value, int);
 std::uint16_t APS5_VABI _Atomic_fetch_add_2_nid_postfix(volatile std::uint16_t* target, std::uint16_t value, int);
 std::uint64_t APS5_VABI _Atomic_fetch_add_8_nid_postfix(volatile std::uint64_t* target, std::uint64_t value, int order);

From b9d00c5d808c4de8dd8e8425d5a9d1a962baef54 Mon Sep 17 00:00:00 2001
From: Shahul Mubeen A <174251444+shahulmubeen-a@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:09:56 +0530
Subject: [PATCH 169/218] fix(shader): write 1D storage images through 2D-array
 stores at slice 0

An image_store with DIM 2D_ARRAY through a 1D T# had no runtime image
mode, so the dispatch stopped with "image descriptor is incompatible
with the static runtime image interface". #2348 added a 1D mode for
DIM 2D stores only.

Write-only 2D-array storage images now get the same 1D mode as the 2D
case. On RDNA2 (gfx1036, hardware oracle) such a store writes texel x
and ignores y when the slice is 0, and writes nothing for any other
slice, with DEPTH 0 or 3, so the store is skipped unless the slice is 0.

New execution test agc_driver_image_store_line_through_plane_array.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../ImageStoreLineThroughPlaneArray.cpp       | 185 ++++++++++++++++++
 .../Optimization/src/ResourceMaterializer.cpp |   2 +-
 .../SpirvBackend/src/SpirvImageEmitter.cpp    |   3 +
 docs/dev/debt/shader.md                       |   2 +-
 4 files changed, 190 insertions(+), 2 deletions(-)
 create mode 100644 core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp

diff --git a/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp b/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp
new file mode 100644
index 0000000000..26d3e4d1ff
--- /dev/null
+++ b/core/libs/prx/libSceAgcDriver/tests/execution/ImageStoreLineThroughPlaneArray.cpp
@@ -0,0 +1,185 @@
+#include "prx/libSceAgcDriver/Execution/include/VulkanDevice.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Draw.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/Texture.hpp"
+#include "prx/libSceAgcDriver/Graphics/include/TextureTiling.hpp"
+#include "prx/libc/include/GuestAllocations.hpp"
+#include "Recompiler.hpp"
+#include "VulkanTestDevice.hpp"
+#ifdef _WIN32
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <windows.h>
+#endif
+#include <algorithm>
+#include <array>
+#include <cstdint>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <iostream>
+#include <span>
+#include <string>
+#include <vector>
+
+namespace {
+
+using AgcDriver::Graphics::Require;
+using ShaderRecompiler::ShaderStage;
+
+constexpr std::uint32_t Threads = 32;
+constexpr std::uint32_t Width = 32;
+constexpr std::uint32_t Type1D = 8;
+constexpr std::uint32_t IdentitySwizzle = 0xfacu;
+constexpr std::size_t TexelBytes = 4096;
+constexpr std::size_t BlockBytes = 65536;
+
+alignas(256) std::array<std::uint32_t, Threads * 4> Input{};
+
+alignas(256) constexpr std::array<std::uint32_t, 17> StoreCode{
+    0x34020084, 0xe0381000, 0x80001401, 0xbf8c3f70, 0x7e3c0300, 0x7e3e0281, 0x7e400280, 0xf0201f28, 0x0001141e,
+    0x7e3e0280, 0x7e4002c1, 0xf0201528, 0x0001141e, 0x7e400281, 0xf0201528, 0x0001141e, 0xbf810000,
+};
+
+class GuestBlock {
+public:
+    GuestBlock() {
+#ifdef _WIN32
+        block = static_cast<std::uint8_t*>(VirtualAlloc(nullptr, BlockBytes, MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE));
+#else
+        block = static_cast<std::uint8_t*>(std::aligned_alloc(BlockBytes, BlockBytes));
+#endif
+        Require(block != nullptr, "image store line through plane array: cannot allocate the guest block");
+        GuestAllocations::Mutation().Add(block, BlockBytes, true, true, true);
+    }
+
+    ~GuestBlock() {
+        GuestAllocations::Mutation().Remove(block);
+#ifdef _WIN32
+        VirtualFree(block, 0, MEM_RELEASE);
+#else
+        std::free(block);
+#endif
+    }
+
+    GuestBlock(const GuestBlock&) = delete;
+    GuestBlock& operator=(const GuestBlock&) = delete;
+
+    std::uint8_t* Data() { return block; }
+
+private:
+    std::uint8_t* block = nullptr;
+};
+
+struct Format {
+    const char* name;
+    std::uint32_t format;
+    std::uint32_t components;
+};
+
+constexpr std::array<Format, 2> Formats{{
+    {"32_SINT", 21u, 1u},
+    {"32_32_32_32_SINT", 76u, 4u},
+}};
+
+std::string Hex(std::uint32_t value) {
+    char text[16];
+    std::snprintf(text, sizeof(text), "0x%08x", value);
+    return text;
+}
+
+std::uint32_t Value(std::uint32_t tid, std::uint32_t index) {
+    return (tid * 4u + index + 1u) * 0x9e3779b1u;
+}
+
+std::uint64_t TexelOffset(const Format& format, std::uint32_t x) {
+    const auto mip = AgcDriver::Graphics::ComputeMipLayout(AgcDriver::Graphics::TextureTileMode::kLinear, format.format, Width, 1u, 1u).at(0);
+    return mip.tiledOffset + static_cast<std::uint64_t>(x) * format.components * 4u;
+}
+
+std::vector<std::uint8_t> Initial() {
+    std::vector<std::uint8_t> bytes(TexelBytes);
+    for (std::size_t index = 0; index < bytes.size(); ++index) bytes[index] = static_cast<std::uint8_t>(0x80u + 37u * index + 11u * (index >> 4u));
+    return bytes;
+}
+
+std::array<std::uint32_t, 4> BufferDescriptor(const void* data, std::uint32_t bytes) {
+    const auto address = reinterpret_cast<std::uintptr_t>(data);
+    return {static_cast<std::uint32_t>(address), static_cast<std::uint32_t>((address >> 32u) & 0xffffu), bytes, 0x31016facu};
+}
+
+std::array<std::uint32_t, 8> TextureDescriptor(const void* data, std::uint32_t format) {
+    const auto address = static_cast<std::uint64_t>(reinterpret_cast<std::uintptr_t>(data));
+    return {
+        static_cast<std::uint32_t>(address >> 8u),
+        static_cast<std::uint32_t>((address >> 40u) & 0xffu) | (format << 20u) | (((Width - 1u) & 3u) << 30u),
+        (Width - 1u) >> 2u,
+        IdentitySwizzle | (Type1D << 28u),
+        0u,
+        0u,
+        0u,
+        0u,
+    };
+}
+
+void Dispatch(AgcDriver::VulkanDevice& device, std::uint8_t* texels, std::span<const std::uint32_t> code, std::uint32_t format) {
+    for (std::uint32_t tid = 0; tid < Threads; ++tid) {
+        for (std::uint32_t index = 0; index < 4u; ++index) Input[tid * 4u + index] = Value(tid, index);
+    }
+    const auto initial = Initial();
+    std::copy(initial.begin(), initial.end(), texels);
+    std::vector<std::uint32_t> userData(16, 0u);
+    const auto buffer = BufferDescriptor(Input.data(), static_cast<std::uint32_t>(Input.size() * 4u));
+    const auto texture = TextureDescriptor(texels, format);
+    std::copy(buffer.begin(), buffer.end(), userData.begin());
+    std::copy(texture.begin(), texture.end(), userData.begin() + 4);
+    const std::array<ShaderRecompiler::MemoryRegion, 1> memory{{{reinterpret_cast<std::uintptr_t>(code.data()), std::as_bytes(code)}}};
+    const ShaderRecompiler::ShaderComputeStageInfo compute{{Threads, 1, 1}, 0u, {false, false, false}, false, 1};
+    ShaderRecompiler::RecompileRequest request{
+        {ShaderStage::Compute, reinterpret_cast<std::uintptr_t>(code.data()), code, 0, {}},
+        {32, 0, userData, compute, std::nullopt, std::nullopt, memory},
+        device.Target(),
+        {0, 0, 0, 128}
+    };
+    request.useCache = false;
+    const auto result = ShaderRecompiler::Recompile(request);
+    device.Dispatch(result, 1, 1, 1, {}, reinterpret_cast<std::uintptr_t>(code.data()));
+    device.WaitIdle();
+    AgcDriver::Graphics::StorageTexture::FlushPending(reinterpret_cast<std::uintptr_t>(texels), TexelBytes, nullptr, "test");
+    device.WaitIdle();
+}
+
+void CheckTexels(const std::uint8_t* texels, const Format& format) {
+    const auto initial = Initial();
+    for (std::uint32_t x = 0; x < Width; ++x) {
+        const auto offset = TexelOffset(format, x);
+        for (std::uint32_t component = 0; component < format.components; ++component) {
+            std::uint32_t actual = 0;
+            std::memcpy(&actual, texels + offset + component * 4u, 4u);
+            const auto wanted = Value(x, component);
+            Require(actual == wanted, std::string("image_store 2d_array through a 1D ") + format.name + " T#: texel " + std::to_string(x) + " component " + std::to_string(component) + " is " + Hex(actual) + ", expected the y = 1, slice = 0 store " + Hex(wanted) + " and the stores to slices 0xffffffff and 1 dropped");
+        }
+    }
+    const auto end = TexelOffset(format, Width);
+    Require(std::equal(texels + end, texels + TexelBytes, initial.begin() + static_cast<std::ptrdiff_t>(end)), std::string("image_store 2d_array through a 1D ") + format.name + " T#: bytes past the texture changed");
+}
+
+}
+
+int main() {
+    try {
+        const auto device = OpenVulkanTestDevice();
+        if (!device) return VulkanTestSkipped;
+        GuestBlock block;
+        auto* texels = block.Data();
+        for (const auto& format : Formats) {
+            Dispatch(*device, texels, StoreCode, format.format);
+            CheckTexels(texels, format);
+        }
+        std::puts("image store line through plane array tests passed");
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}
diff --git a/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp b/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
index 89ee86f9d6..0c2dd56d6a 100644
--- a/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
+++ b/core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp
@@ -1929,7 +1929,7 @@ std::vector<ImageResource> ResourceMaterializer::RuntimeImageModes(const ImageRe
             line.dimension = RdnaImageDimension::Dim1D;
             modes.push_back(line);
         }
-        if (image.dimension == RdnaImageDimension::Dim2D && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage && !depth && packed == IrBufferFormat::Invalid && image.byElements == 0u) {
+        if ((image.dimension == RdnaImageDimension::Dim2D || image.dimension == RdnaImageDimension::Dim2DArray) && storage && image.written && !image.read && !image.atomic && image.mipMode != ImageMipMode::DynamicStorage && !depth && packed == IrBufferFormat::Invalid && image.byElements == 0u) {
             auto line = mode;
             line.dimension = RdnaImageDimension::Dim1D;
             modes.push_back(line);
diff --git a/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp b/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
index 601bed36a2..cd5552084d 100644
--- a/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
+++ b/core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp
@@ -1133,6 +1133,9 @@ void EmitWriteOp(SpirvValueEmitContext& ctx, const ImageEmitAccess& access) {
     auto& state = ctx.state;
     const bool uintImage = access.image.numericClass == IrTextureNumericClass::Uint;
     auto condition = ctx.Arg(access.inst, 3);
+    if (access.mem.imageDimension == RdnaImageDimension::Dim2DArray && access.image.dimension == RdnaImageDimension::Dim1D) {
+        condition = Binary(state, spv::OpLogicalAnd, TypeBool(state), condition, Binary(state, spv::OpIEqual, TypeBool(state), AddressU32(ctx, access, 2u), ConstantU32(state, 0u)));
+    }
     if (VolumeSliceAddress(access) || ArraySliceAddress(access)) {
         if (access.image.mipMode == ImageMipMode::DynamicStorage) ctx.Fail(access.inst, "stores a 2D-array address to a 3D image or a 3D address to a 2D-array image with dynamic mips, which is not implemented");
         const auto image = state.module.AllocateId();
diff --git a/docs/dev/debt/shader.md b/docs/dev/debt/shader.md
index 6c372caccf..5dd225a349 100644
--- a/docs/dev/debt/shader.md
+++ b/docs/dev/debt/shader.md
@@ -67,7 +67,7 @@
 - [MIMG `tfe` and `lwe`](../../../core/shader/recompiler/RdnaDecoder/src/RdnaImageOpDecoder.cpp) never write the status VGPR after the data. On hardware it is written only when a texel fetch hits an unmapped page of a partially resident texture, or, for `lwe` on sample/gather, when the LOD is below the T# `MIN_LOD_WARN`; texture memory is always resident here, the LOD warning (texture-streaming feedback, like the T# `MIN_LOD_WARN` itself) is never reported, and `lwe` on `image_get_lod` throws.
 - [Packed horizontal gathers](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_gather4h_pck`, MIMG opcode 98): the four window texels are read raw and concatenated into a little-endian bitstream, with DMASK bit i writing stream word i to the next destination register; measured on RDNA2 (gfx1031) at every edge: the anchor is floor(x-0.5) with elements at -1, 0, +1 and +2 clamped horizontally into the width, the row is floor(y), negative rows clamp to row 0, rows at or past the height return zeros, sampler addressing modes do not affect the window, and formats wider than 32 bits per texel write zeros in every register. The emitter fetches each window texel at LOD 0 and packs its bits like `image_load_pck`, so the sampler's filter, addressing and LOD state are not used; formats whose bits are not recoverable from the view and D16 data throw. The anchor and row multiply the normalized coordinate by the image size without contraction. The stream rule was measured for R8_UNORM, RG8_UNORM and RGBA8; only RGBA8 has an execution test. `image_gather8h_pck` (opcode 99) never returns texel data on this hardware - across dmasks 0x1 to 0xFF including the upper nibble, RGBA8, RGBA16 and RGBA32 formats, 1D, 2D and 3D descriptors and normalized and unnormalized sampling it only zero-fills popcount(dmask) registers (sentinel-prefilled destinations) - so it decodes but throws at translation; its eight-texel semantics remain unmeasured.
 - [MIMG BY2/BY4 loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_load[_mip]_by2/by4`, opcodes 0x42, 0x43, 0x4a and 0x4b) were measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md) for 2D images with identity swizzle. They read N texels (BY2: 2, BY4: 4) from `x & ~(N - 1)` on row y, texel by texel and component by component within each texel, with each texel converted like `image_load`. Every register is zero when the mip level is past the last level, `x + N - 1` is outside the level's width (unaligned x, unsigned), or y is outside its height. Data only comes back when the N texels fit in one dword: R8 and R16 (DMASK 0x3) or RG8 (0xf) for BY2, and R8 (0xf) for BY4. With 32-bit texels (R32, RG32, RG16, RGBA8) the hardware returns zeros. Other formats, masks, dimensions, swizzles, D16/A16 and indirect descriptors throw. The stores (0x52, 0x53, 0x5a and 0x5b) decode but throw at translation. Measured on hardware, they write from the unaligned x up to the end of its dword, which is not implemented.
-- [2D stores to 1D storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp): an `image_store` with DIM 2D through a 1D T# writes texel x and ignores y, as measured on RDNA2 (gfx1035) for y from 0 to 4 and 0xffffffff, single- and four-component formats and a 1x1 8_8_8_8_UNORM T#: the T# type decides the addressing, DIM only how many address VGPRs are read. Storage loads, atomics and `image_store_mip` through such a pair still throw
+- [2D stores to 1D storage images](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp): an `image_store` with DIM 2D through a 1D T# writes texel x and ignores y, as measured on RDNA2 (gfx1035) for y from 0 to 4 and 0xffffffff, single- and four-component formats and a 1x1 8_8_8_8_UNORM T#: the T# type decides the addressing, DIM only how many address VGPRs are read. An `image_store` with DIM 2D_ARRAY through a 1D T# writes texel x, ignoring y, only when the slice is 0, and is dropped for any other slice: measured on RDNA2 (gfx1036) with the [hardware oracle](../HW_ORACLE.md) through the AMD Windows driver's comgr and HIP runtime (wave32, IEEE off, DX10 clamp on, denormals preserved, round to nearest even) on a 64-texel linear 32_UINT T# with DEPTH 0 and 3, for x of 0, 5 and 63, y of 0, 1, 3 and 0xffffffff and slices 0, 1, 2, 5 and 0xffffffff; the PS5's gfx1013 is not measured. Storage loads, atomics and `image_store_mip` through such a pair still throw
 - [MIMG PCK2/PCK4 loads](../../../core/shader/recompiler/SpirvBackend/src/SpirvImageEmitter.cpp) (`image_load[_mip]_pck2/pck4`, opcodes 0x70, 0x71, 0x73 and 0x74) were measured on RDNA2 (gfx1035) with the [hardware oracle](../HW_ORACLE.md) for 2D images with identity swizzle. With data mask 0x1, they write one dword: the raw bits of the N texels (PCK2: 2, PCK4: 4) from `x & ~(N - 1)` on row y, concatenated (element k at bit `k * texel bits`) and zero-extended. The dword is zero when the mip level is past the last level, `x + N - 1` is outside the level's width (unaligned x, unsigned), or y is outside its height. Data only comes back when N texels fit in 32 bits: R8, R16 or RG8 for PCK2, R8 for PCK4. Wider texels (R32, RG16, RGBA8) and masks other than 0x1 write zeros on hardware. Those masks throw at decode, and formats outside UNORM/UINT/SINT R8, R16 and RG8 throw. #1314's earlier measurement saw only zeros because it used masks 0x3 and 0xf. The stores (0x76, 0x77, 0x79 and 0x7a) decode but throw at translation. They are not measured, and opcode 0x76 on 32_32_32_32_FLOAT hung the GPU (#1314).
 - [`image_get_resinfo` through DIM 1D on a cube, 2D-array or 3D T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follows thuanquang's measurement on RDNA2 (RX 6700 XT, gfx1031, #7550), not the PS5's gfx1013: width, height and the level count come from the T#, and the third component is the 3D T#'s depth, or 0 for a cube or 2D array, as for every DIM without layers (1D, 2D, 2D MSAA). Such a query on a 1D-array T# still reads it as its first layer, whose height is not measured. On a 2D MSAA or 2D MSAA-array T# it throws: gfx1031 was measured only with one fragment, which the driver cannot bind, and the level component for 2, 4 or 8 fragments is not measured.
 - [3D image accesses bound to a 2D or 2D-array T#](../../../core/shader/recompiler/Optimization/src/ResourceMaterializer.cpp) follow CouchRiv's [hardware oracle](../HW_ORACLE.md) measurement on RDNA2 (gfx1036, #2023) and adriadam10's (gfx1035, #2140), not the PS5's gfx1013. On a 2D T#, `image_sample_lz` ignores r and reads the (u,v) texel, `image_load` and `image_load_mip` read the (x,y) texel when z is 0 and return zero otherwise, and `image_get_resinfo` returns (width, height, 1, levels). On a 2D-array T#, these accesses behave like dim 2D-array: r or z is the layer, and `image_get_resinfo` returns the layer count as its third component. Every other access of such an image, including samples with an LOD, bias, derivatives, offset or comparison, gathers, `image_get_lod` and stores, keeps throwing because it is not measured.

From 19db55c64b3bed78d62fbccc74b726dcdea7d11f Mon Sep 17 00:00:00 2001
From: Kovalev Vladislav <veosett@yandex.ru>
Date: Thu, 22 Oct 2026 17:01:09 +0600
Subject: [PATCH 170/218] fix(tools): strip save-temps flags from syntax checks

---
 tools/check_compile.py            |  3 +-
 tools/tests/test_check_compile.py | 47 +++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/tools/check_compile.py b/tools/check_compile.py
index 24500ab954..24daf7321a 100644
--- a/tools/check_compile.py
+++ b/tools/check_compile.py
@@ -11,7 +11,8 @@ from contextlib import nullcontext
 from pathlib import Path
 
 CPP = (".cpp", ".cc", ".cxx", ".c")
-DROP = ("-c", "-MD", "-MMD", "-MP", "-fsyntax-only", "-fno-syntax-only")
+DROP = ("-c", "-MD", "-MMD", "-MP", "-fsyntax-only", "-fno-syntax-only", "-save-temps", "--save-temps",
+        "-save-temps=cwd", "-save-temps=obj", "--save-temps=cwd", "--save-temps=obj")
 DROP_WITH_VALUE = ("-o", "-MT", "-MF", "-MQ", "-MJ")
 PREPROCESSING = ("-E", "--preprocess", "-M", "--dependencies", "-MM", "--user-dependencies",
                  "-MG", "--print-missing-file-dependencies", "-P", "--no-line-commands",
diff --git a/tools/tests/test_check_compile.py b/tools/tests/test_check_compile.py
index 6bbbbf5570..1490024f4e 100644
--- a/tools/tests/test_check_compile.py
+++ b/tools/tests/test_check_compile.py
@@ -79,6 +79,53 @@ class CheckCompileTests(unittest.TestCase):
                     for path, content in outputs.items():
                         self.assertEqual(path.read_bytes(), content)
 
+    def test_saved_temporaries_do_not_rewrite_files_or_hide_compiler_errors(self):
+        compiler = shutil.which("gcc") or shutil.which("clang")
+        if compiler is None:
+            self.skipTest("needs a C compiler")
+        source = self.source("unit.c")
+        for option, field in (("-save-temps", "arguments"), ("--save-temps", "command"),
+                              ("-save-temps=cwd", "arguments"), ("-save-temps=obj", "command")):
+            with self.subTest(option=option, field=field):
+                source.write_text("#ifndef REQUIRED\n#error missing definition\n#endif\nint value;\n", encoding="utf-8")
+                arguments = [compiler, "-Werror", "-DREQUIRED", option, "-c", str(source),
+                             "-o", str(self.build / "unit.o")]
+                original = subprocess.run(arguments, cwd=self.build, capture_output=True, text=True)
+                self.assertEqual(original.returncode, 0, original.stderr)
+                for name in ("a-unit", "a-unit.i"):
+                    (self.build / name).write_bytes(b"previous build output")
+                command = (subprocess.list2cmdline(arguments) if os.name == "nt" else
+                           " ".join(shlex.quote(argument) for argument in arguments))
+                self.manifest([{"directory": str(self.build), "file": str(source),
+                                field: arguments if field == "arguments" else command}])
+                preserved = {path: path.read_bytes() for path in self.build.iterdir()}
+                result = self.tool("unit.c")
+                self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+                self.assertIn("1 translation units compile", result.stdout)
+                for path, content in preserved.items():
+                    self.assertEqual(path.read_bytes(), content, str(path))
+                self.assertEqual(set(self.build.iterdir()), set(preserved))
+                source.write_text("#error syntax_check_must_fail\n", encoding="utf-8")
+                result = self.tool("unit.c")
+                self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+                self.assertIn("syntax_check_must_fail", result.stderr)
+                for path, content in preserved.items():
+                    self.assertEqual(path.read_bytes(), content, str(path))
+                self.assertEqual(set(self.build.iterdir()), set(preserved))
+
+    def test_unknown_saved_temporary_mode_is_still_rejected_by_the_compiler(self):
+        compiler = shutil.which("gcc") or shutil.which("clang")
+        if compiler is None:
+            self.skipTest("needs a C compiler")
+        source = self.source("unit.c")
+        self.manifest([{"directory": str(self.build), "file": str(source),
+                        "arguments": [compiler, "-save-temps=invalid", "-c", str(source),
+                                      "-o", str(self.build / "unit.o")]}])
+        result = self.tool("unit.c")
+        self.assertEqual(result.returncode, 1, result.stdout + result.stderr)
+        self.assertIn("save-temps", result.stderr)
+        self.assertFalse((self.build / "unit.o").exists())
+
     def test_ninja_response_file_is_expanded_before_syntax_rewriting(self):
         compiler = shutil.which("clang") or shutil.which("gcc")
         if compiler is None or shutil.which("ninja") is None:

From 560a06febef29b61faeaf9b8f9b9da98742bc5e2 Mon Sep 17 00:00:00 2001
From: Kovalev Vladislav <veosett@yandex.ru>
Date: Thu, 22 Oct 2026 17:22:21 +0600
Subject: [PATCH 171/218] test(tools): respect compiler handling of unknown
 save modes

---
 tools/tests/test_check_compile.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tools/tests/test_check_compile.py b/tools/tests/test_check_compile.py
index 1490024f4e..938d6f18f0 100644
--- a/tools/tests/test_check_compile.py
+++ b/tools/tests/test_check_compile.py
@@ -113,11 +113,16 @@ class CheckCompileTests(unittest.TestCase):
                     self.assertEqual(path.read_bytes(), content, str(path))
                 self.assertEqual(set(self.build.iterdir()), set(preserved))
 
-    def test_unknown_saved_temporary_mode_is_still_rejected_by_the_compiler(self):
+    def test_rejected_saved_temporary_mode_is_not_hidden(self):
         compiler = shutil.which("gcc") or shutil.which("clang")
         if compiler is None:
             self.skipTest("needs a C compiler")
         source = self.source("unit.c")
+        original = subprocess.run([compiler, "-save-temps=invalid", "-fsyntax-only", str(source)],
+                                  cwd=self.build, capture_output=True, text=True)
+        if original.returncode == 0:
+            self.skipTest("compiler accepts unknown saved-temporary modes with -fsyntax-only")
+        self.assertIn("save-temps", original.stderr)
         self.manifest([{"directory": str(self.build), "file": str(source),
                         "arguments": [compiler, "-save-temps=invalid", "-c", str(source),
                                       "-o", str(self.build / "unit.o")]}])

From 9fc0a99dac6eac4c58d238198fb173bfe051c7e3 Mon Sep 17 00:00:00 2001
From: Kovalev Vladislav <veosett@yandex.ru>
Date: Thu, 22 Oct 2026 17:34:43 +0600
Subject: [PATCH 172/218] test(tools): split syntax check suites within CI time
 limit

---
 CMakeLists.txt                    |  4 +-
 tools/tests/test_check_compile.py | 85 ++++++++++++++++---------------
 2 files changed, 47 insertions(+), 42 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 11039135be..92c27d56c0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -281,7 +281,9 @@ if(BUILD_TESTING)
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile_preprocessor.py)
         set_tests_properties(check_compile_preprocessor PROPERTIES TIMEOUT 20)
         add_test(NAME check_compile COMMAND ${Python3_EXECUTABLE}
-            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile.py)
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile.py CheckCompileTests)
+        add_test(NAME check_compile_outputs COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_check_compile.py CheckCompileOutputTests)
         add_test(NAME performance_compare COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/tools/tests/test_performance_compare.py)
         set_tests_properties(performance_compare PROPERTIES TIMEOUT 20)
diff --git a/tools/tests/test_check_compile.py b/tools/tests/test_check_compile.py
index 938d6f18f0..7427fb43f4 100644
--- a/tools/tests/test_check_compile.py
+++ b/tools/tests/test_check_compile.py
@@ -15,7 +15,49 @@ import check_compile
 TOOL = Path(__file__).resolve().parents[1] / "check_compile.py"
 
 
-class CheckCompileTests(unittest.TestCase):
+class CheckCompileFixture(unittest.TestCase):
+    def setUp(self):
+        holder = tempfile.TemporaryDirectory()
+        self.addCleanup(holder.cleanup)
+        self.root = Path(holder.name).resolve()
+        subprocess.run(["git", "init", "-q", str(self.root)], check=True)
+        subprocess.run(["git", "-C", str(self.root), "config", "user.email", "tests@example.com"], check=True)
+        subprocess.run(["git", "-C", str(self.root), "config", "user.name", "tests"], check=True)
+        self.build = self.root / "build"
+        self.build.mkdir()
+
+    def tool(self, *arguments, env=None):
+        environment = dict(os.environ)
+        environment.update(env or {})
+        return subprocess.run([sys.executable, "-I", str(TOOL), *arguments], cwd=self.root,
+                              capture_output=True, text=True, encoding="utf-8", env=environment)
+
+    def source(self, relative, text="int x;\n"):
+        path = self.root / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text, encoding="utf-8")
+        return path
+
+    def compiler(self, body, name="compiler.py"):
+        script = self.root / name
+        script.write_text(body, encoding="utf-8")
+        return script
+
+    def entry(self, relative, command):
+        return {"directory": str(self.build), "command": command, "file": str(self.root / relative)}
+
+    def manifest(self, entries):
+        (self.build / "compile_commands.json").write_text(json.dumps(entries), encoding="utf-8")
+
+    def failing(self, relative, message=None):
+        source = self.source(relative)
+        message = message if message is not None else f"{relative}:1:1: error: no\n"
+        script = self.compiler("import sys\nsys.stderr.write(%r)\nsys.exit(1)\n" % message)
+        self.manifest([self.entry(relative, f'"{sys.executable}" "{script}" "{source}"')])
+        return source
+
+
+class CheckCompileOutputTests(CheckCompileFixture):
     def test_unexpanded_response_files_cannot_rewrite_build_outputs(self):
         compiler = shutil.which("clang")
         if compiler is None:
@@ -201,46 +243,7 @@ class CheckCompileTests(unittest.TestCase):
                 self.assertEqual(fragment.read_bytes(), b"previous compilation fragment")
 
 
-    def setUp(self):
-        holder = tempfile.TemporaryDirectory()
-        self.addCleanup(holder.cleanup)
-        self.root = Path(holder.name).resolve()
-        subprocess.run(["git", "init", "-q", str(self.root)], check=True)
-        subprocess.run(["git", "-C", str(self.root), "config", "user.email", "tests@example.com"], check=True)
-        subprocess.run(["git", "-C", str(self.root), "config", "user.name", "tests"], check=True)
-        self.build = self.root / "build"
-        self.build.mkdir()
-
-    def tool(self, *arguments, env=None):
-        environment = dict(os.environ)
-        environment.update(env or {})
-        return subprocess.run([sys.executable, "-I", str(TOOL), *arguments], cwd=self.root,
-                              capture_output=True, text=True, encoding="utf-8", env=environment)
-
-    def source(self, relative, text="int x;\n"):
-        path = self.root / relative
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text, encoding="utf-8")
-        return path
-
-    def compiler(self, body, name="compiler.py"):
-        script = self.root / name
-        script.write_text(body, encoding="utf-8")
-        return script
-
-    def entry(self, relative, command):
-        return {"directory": str(self.build), "command": command, "file": str(self.root / relative)}
-
-    def manifest(self, entries):
-        (self.build / "compile_commands.json").write_text(json.dumps(entries), encoding="utf-8")
-
-    def failing(self, relative, message=None):
-        source = self.source(relative)
-        message = message if message is not None else f"{relative}:1:1: error: no\n"
-        script = self.compiler("import sys\nsys.stderr.write(%r)\nsys.exit(1)\n" % message)
-        self.manifest([self.entry(relative, f'"{sys.executable}" "{script}" "{source}"')])
-        return source
-
+class CheckCompileTests(CheckCompileFixture):
     def test_a_translation_unit_that_does_not_compile_fails_with_the_compiler_output(self):
         self.failing("unit.cpp")
         result = self.tool("unit.cpp")

From 88140fb881b9f2e82fc8552eeeae425b29f2b16d Mon Sep 17 00:00:00 2001
From: Kovalev Vladislav <veosett@yandex.ru>
Date: Fri, 23 Oct 2026 12:18:01 +0600
Subject: [PATCH 173/218] test(tools): preserve Clang saved temporary fixtures

---
 tools/tests/test_check_compile.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/tests/test_check_compile.py b/tools/tests/test_check_compile.py
index 7427fb43f4..d1963387b3 100644
--- a/tools/tests/test_check_compile.py
+++ b/tools/tests/test_check_compile.py
@@ -134,7 +134,7 @@ class CheckCompileOutputTests(CheckCompileFixture):
                              "-o", str(self.build / "unit.o")]
                 original = subprocess.run(arguments, cwd=self.build, capture_output=True, text=True)
                 self.assertEqual(original.returncode, 0, original.stderr)
-                for name in ("a-unit", "a-unit.i"):
+                for name in ("a-unit", "a-unit.i", "unit.i"):
                     (self.build / name).write_bytes(b"previous build output")
                 command = (subprocess.list2cmdline(arguments) if os.name == "nt" else
                            " ".join(shlex.quote(argument) for argument in arguments))

From 35c38ce8d59c1d62401f6cf6408d0229ba2e57b1 Mon Sep 17 00:00:00 2001
From: Disaster <Disvster.wav@gmail.com>
Date: Sun, 25 Oct 2026 22:34:46 +0300
Subject: [PATCH 174/218] fix(libc): match measured _Exp and _FExp special
 values

---
 .../libs/prx/libc/src/DinkumwareInternals.cpp | 273 ++++++++++------
 core/libs/tests/GuestDinkumwareInternals.cpp  | 301 ++++++++++--------
 docs/dev/debt/libc.md                         |   2 +-
 3 files changed, 348 insertions(+), 228 deletions(-)

diff --git a/core/libs/prx/libc/src/DinkumwareInternals.cpp b/core/libs/prx/libc/src/DinkumwareInternals.cpp
index c701c41046..dc45984759 100644
--- a/core/libs/prx/libc/src/DinkumwareInternals.cpp
+++ b/core/libs/prx/libc/src/DinkumwareInternals.cpp
@@ -79,36 +79,6 @@ TInteger ParsedInteger(const char* text, char** end, int base, int* error, TInte
 
 constexpr short Denormal = -2, Finite = -1, Zero = 0, Infinite = 1, NotANumber = 2;
 
-short ClassifyDouble(double value) {
-    switch (std::fpclassify(value)) {
-    case FP_NAN:
-        return NotANumber;
-    case FP_INFINITE:
-        return Infinite;
-    case FP_ZERO:
-        return Zero;
-    case FP_SUBNORMAL:
-        return Denormal;
-    default:
-        return Finite;
-    }
-}
-
-short ClassifyFloat(float value) {
-    switch (std::fpclassify(value)) {
-    case FP_NAN:
-        return NotANumber;
-    case FP_INFINITE:
-        return Infinite;
-    case FP_ZERO:
-        return Zero;
-    case FP_SUBNORMAL:
-        return Denormal;
-    default:
-        return Finite;
-    }
-}
-
 void RaiseLibcError(int exceptions) {
     if ((exceptions & (FE_OVERFLOW | FE_UNDERFLOW)) != 0) exceptions |= FE_INEXACT;
     std::feraiseexcept(exceptions);
@@ -117,34 +87,55 @@ void RaiseLibcError(int exceptions) {
     errno = range ? ERANGE : EDOM;
 }
 
-short ScaleDouble(double& value, long exponent) {
-    const short kind = ClassifyDouble(value);
-    if (kind == NotANumber) return kind;
-    if (kind == Infinite) {
-        RaiseLibcError(FE_OVERFLOW);
+template<typename TFloat>
+short ClassifyValue(TFloat value) {
+    switch (std::fpclassify(value)) {
+    case FP_NAN:
+        return NotANumber;
+    case FP_INFINITE:
         return Infinite;
+    case FP_ZERO:
+        return Zero;
+    case FP_SUBNORMAL:
+        return Denormal;
+    default:
+        return Finite;
     }
-    if (kind == Zero) return Zero;
-    value = std::scalbn(value, static_cast<int>(exponent));
-    const short result = ClassifyDouble(value);
-    if (result == Infinite) RaiseLibcError(FE_OVERFLOW);
-    if (result == Zero || result == Denormal) RaiseLibcError(FE_UNDERFLOW);
-    return result;
 }
 
-short ScaleFloat(float& value, long exponent) {
-    const short kind = ClassifyFloat(value);
-    if (kind == NotANumber) return kind;
+template<typename TFloat>
+short ScaleProduct(TFloat& value, TFloat factor, TFloat multiplier, long exponent) {
+    std::fexcept_t saved;
+    std::fegetexceptflag(&saved, FE_ALL_EXCEPT);
+    const int savedErrno = errno;
+    TFloat result = factor * multiplier;
+    if (!std::isfinite(result) || result == static_cast<TFloat>(0)) {
+        int factorExponent = 0;
+        int multiplierExponent = 0;
+        const TFloat factorMantissa = std::frexp(factor, &factorExponent);
+        const TFloat multiplierMantissa = std::frexp(multiplier, &multiplierExponent);
+        const long long combinedExponent = static_cast<long long>(factorExponent) + multiplierExponent + exponent;
+        result = std::scalbn(factorMantissa * multiplierMantissa, static_cast<int>(combinedExponent));
+    } else {
+        result = std::scalbn(result, static_cast<int>(exponent));
+    }
+    value = result;
+    const short kind = ClassifyValue(result);
+    const int raised = std::fetestexcept(FE_ALL_EXCEPT) & ~static_cast<int>(saved) & FE_ALL_EXCEPT;
+    std::fesetexceptflag(&saved, FE_ALL_EXCEPT);
+    errno = savedErrno;
     if (kind == Infinite) {
         RaiseLibcError(FE_OVERFLOW);
         return Infinite;
     }
-    if (kind == Zero) return Zero;
-    value = std::scalbn(value, static_cast<int>(exponent));
-    const short result = ClassifyFloat(value);
-    if (result == Infinite) RaiseLibcError(FE_OVERFLOW);
-    if (result == Zero || result == Denormal) RaiseLibcError(FE_UNDERFLOW);
-    return result;
+    if (kind == Zero) {
+        RaiseLibcError(FE_UNDERFLOW);
+        return Zero;
+    }
+    if (kind == Denormal) return Finite;
+    if (kind == NotANumber) return NotANumber;
+    if ((raised & FE_INEXACT) != 0) std::feraiseexcept(FE_INEXACT);
+    return Finite;
 }
 
 }
@@ -207,6 +198,9 @@ long long APS5_VABI _Stoll_nid_postfix(const char* text, char** end, int base) {
 
 short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset) {
     if (value == nullptr) throw std::invalid_argument("_Exp: null value");
+    std::fexcept_t entryFlags;
+    std::fegetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+    const int entryErrno = errno;
     const double x = *value;
     constexpr double HugeExp = 1842.0;
     constexpr double Eps = std::numeric_limits<double>::epsilon();
@@ -218,21 +212,59 @@ short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset) {
     constexpr double Q0 = 30.01511290683317;
     constexpr double Q1 = 3362.72154416553028;
     constexpr double Q2 = 30265.40189360949691;
-    if (std::isnan(x)) {
-        *value = x;
-        return NotANumber;
-    }
-    if (std::isnan(y)) {
-        *value = y;
-        return NotANumber;
-    }
-    if (y == 0.0) {
-        *value = 0.0;
+    constexpr double E = 0x1.5bf0a8b145769p+1;
+    const short xKind = ClassifyValue(x);
+    const short yKind = ClassifyValue(y);
+    if (xKind == NotANumber) return NotANumber;
+    if (yKind == NotANumber) return NotANumber;
+    if (xKind == Infinite) {
+        if (x > 0.0) {
+            if (yKind == Zero) {
+                *value = std::numeric_limits<double>::quiet_NaN();
+                RaiseLibcError(FE_INVALID);
+                return NotANumber;
+            }
+            if (yKind == Infinite) {
+                *value = y;
+            } else {
+                *value = std::copysign(std::numeric_limits<double>::infinity(), y);
+            }
+            return Infinite;
+        }
+        if (yKind == Infinite) {
+            *value = std::numeric_limits<double>::quiet_NaN();
+            RaiseLibcError(FE_INVALID);
+            return NotANumber;
+        }
+        *value = std::copysign(0.0, y);
         return Zero;
     }
+    if (yKind == Zero) {
+        *value = y;
+        return Zero;
+    }
+    if (yKind == Infinite) {
+        *value = y;
+        return Infinite;
+    }
+    if (xKind == Zero) {
+        if (offset == 0) {
+            *value = y;
+            return Finite;
+        }
+        const short result = ScaleProduct(*value, 1.0, y, offset);
+        if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+            std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+            errno = entryErrno;
+        }
+        return result;
+    }
+    if (offset == 0 && x == 1.0 && y == 1.0) {
+        *value = E;
+        return Finite;
+    }
     if (x < -HugeExp) {
         *value = std::copysign(0.0, y);
-        RaiseLibcError(FE_UNDERFLOW);
         return Zero;
     }
     if (x > HugeExp) {
@@ -240,54 +272,95 @@ short APS5_VABI _Exp_nid_postfix(double* value, double y, short offset) {
         RaiseLibcError(FE_OVERFLOW);
         return Infinite;
     }
-    if (std::isinf(y)) {
-        *value = y;
-        return Infinite;
-    }
     double g = x * InverseLn2;
-    short exponent = static_cast<short>(g + (g < 0.0 ? -0.5 : 0.5));
+    long exponent = static_cast<long>(g + (g < 0.0 ? -0.5 : 0.5));
     g = static_cast<double>(exponent);
     g = (x - g * Ln2High) - g * Ln2Low;
-    double result;
+    double factor;
     if (-Eps < g && g < Eps) {
-        result = y;
+        factor = 1.0;
     } else {
         const double z = g * g;
         const double w = (Q0 * z + Q1) * z + Q2;
         g *= (z + P1) * z + P2;
-        result = (w + g) / (w - g) * 2.0 * y;
+        factor = (w + g) / (w - g) * 2.0;
         --exponent;
     }
-    *value = result;
-    return ScaleDouble(*value, static_cast<long>(exponent) + offset);
+    const short result = ScaleProduct(*value, factor, y, exponent + offset);
+    if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+        std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+        errno = entryErrno;
+    }
+    return result;
 }
 
 short APS5_VABI _FExp_nid_postfix(float* value, float y, short offset) {
     if (value == nullptr) throw std::invalid_argument("_FExp: null value");
+    std::fexcept_t entryFlags;
+    std::fegetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+    const int entryErrno = errno;
     const float x = *value;
     constexpr float HugeExp = 229.0f;
     constexpr float Eps = std::numeric_limits<float>::epsilon();
-    constexpr float InverseLn2 = 1.4426950408889634073599246810018921f;
-    constexpr float Ln2High = 22713.0f / 32768.0f;
-    constexpr float Ln2Low = 1.4286068203094172321214581765680755e-6f;
-    constexpr float P1 = 60.09114349f;
-    constexpr float Q0 = 12.01517514f;
-    constexpr float Q1 = 120.18228722f;
-    if (std::isnan(x)) {
-        *value = x;
-        return NotANumber;
-    }
-    if (std::isnan(y)) {
-        *value = y;
-        return NotANumber;
-    }
-    if (y == 0.0f) {
-        *value = 0.0f;
+    constexpr float InverseLn2 = 1.4426950216f;
+    constexpr float Ln2High = 0.69287109375f;
+    constexpr float Ln2Low = 0.00027608682f;
+    constexpr float Q = 0.09997485578f;
+    constexpr float P0 = 0.5f;
+    constexpr float P1 = 0.0083208261f;
+    constexpr float E = 0x1.5bf0a8p+1f;
+    const short xKind = ClassifyValue(x);
+    const short yKind = ClassifyValue(y);
+    if (xKind == NotANumber) return NotANumber;
+    if (yKind == NotANumber) return NotANumber;
+    if (xKind == Infinite) {
+        if (x > 0.0f) {
+            if (yKind == Zero) {
+                *value = std::numeric_limits<float>::quiet_NaN();
+                RaiseLibcError(FE_INVALID);
+                return NotANumber;
+            }
+            if (yKind == Infinite) {
+                *value = y;
+            } else {
+                *value = std::copysign(std::numeric_limits<float>::infinity(), y);
+            }
+            return Infinite;
+        }
+        if (yKind == Infinite) {
+            *value = std::numeric_limits<float>::quiet_NaN();
+            RaiseLibcError(FE_INVALID);
+            return NotANumber;
+        }
+        *value = std::copysign(0.0f, y);
         return Zero;
     }
+    if (yKind == Zero) {
+        *value = y;
+        return Zero;
+    }
+    if (yKind == Infinite) {
+        *value = y;
+        return Infinite;
+    }
+    if (xKind == Zero) {
+        if (offset == 0) {
+            *value = y;
+            return Finite;
+        }
+        const short result = ScaleProduct(*value, 1.0f, y, offset);
+        if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+            std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+            errno = entryErrno;
+        }
+        return result;
+    }
+    if (offset == 0 && x == 1.0f && y == 1.0f) {
+        *value = E;
+        return Finite;
+    }
     if (x < -HugeExp) {
         *value = std::copysign(0.0f, y);
-        RaiseLibcError(FE_UNDERFLOW);
         return Zero;
     }
     if (x > HugeExp) {
@@ -295,26 +368,26 @@ short APS5_VABI _FExp_nid_postfix(float* value, float y, short offset) {
         RaiseLibcError(FE_OVERFLOW);
         return Infinite;
     }
-    if (std::isinf(y)) {
-        *value = y;
-        return Infinite;
-    }
     float g = x * InverseLn2;
-    short exponent = static_cast<short>(g + (g < 0.0f ? -0.5f : 0.5f));
+    long exponent = static_cast<long>(g + (g < 0.0f ? -0.5f : 0.5f));
     g = static_cast<float>(exponent);
     g = (x - g * Ln2High) - g * Ln2Low;
-    float result;
+    float factor;
     if (-Eps < g && g < Eps) {
-        result = y;
+        factor = 1.0f;
     } else {
         const float z = g * g;
-        const float w = Q0 * z + Q1;
-        g *= z + P1;
-        result = (w + g) / (w - g) * 2.0f * y;
+        const float w = Q * z + 1.0f;
+        g *= P0 + P1 * z;
+        factor = (w + g) / (w - g) * 2.0f;
         --exponent;
     }
-    *value = result;
-    return ScaleFloat(*value, static_cast<long>(exponent) + offset);
+    const short result = ScaleProduct(*value, factor, y, exponent + offset);
+    if (result == Finite && std::fpclassify(*value) == FP_SUBNORMAL) {
+        std::fesetexceptflag(&entryFlags, FE_ALL_EXCEPT);
+        errno = entryErrno;
+    }
+    return result;
 }
 
 double APS5_VABI _Sin_nid_postfix(double x, unsigned int quadrant) {
diff --git a/core/libs/tests/GuestDinkumwareInternals.cpp b/core/libs/tests/GuestDinkumwareInternals.cpp
index 63d2e41aa6..c1be3d457e 100644
--- a/core/libs/tests/GuestDinkumwareInternals.cpp
+++ b/core/libs/tests/GuestDinkumwareInternals.cpp
@@ -8,11 +8,18 @@
 #include <cstdlib>
 #include <cstring>
 #include <initializer_list>
+#include <limits>
 
 namespace {
 
 constexpr int RangeError = 34;
 constexpr int InvalidArgument = 22;
+constexpr short Denormal = -2;
+constexpr short Finite = -1;
+constexpr short Zero = 0;
+constexpr short Infinite = 1;
+constexpr short NotANumber = 2;
+constexpr int FloatingExceptions = FE_INVALID | FE_DIVBYZERO | FE_OVERFLOW | FE_UNDERFLOW | FE_INEXACT;
 
 void Require(bool condition, const char* message) {
     if (!condition) {
@@ -29,6 +36,24 @@ void CheckStod(const char* text, std::int64_t pten, double expected, long consum
     Require(same && end - text == consumed && *__error_nid_postfix() == error, message);
 }
 
+void CheckExp(double x, double y, short offset, double expected, short expectedKind, int expectedErrno, int expectedFlags, const char* message) {
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    double result = x;
+    const short kind = _Exp_nid_postfix(&result, y, offset);
+    const bool same = std::isnan(expected) ? std::isnan(result) : result == expected && std::signbit(result) == std::signbit(expected);
+    Require(kind == expectedKind && same && errno == expectedErrno && (std::fetestexcept(FE_ALL_EXCEPT) & FloatingExceptions) == expectedFlags, message);
+}
+
+void CheckFExp(float x, float y, short offset, float expected, short expectedKind, int expectedErrno, int expectedFlags, const char* message) {
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    float result = x;
+    const short kind = _FExp_nid_postfix(&result, y, offset);
+    const bool same = std::isnan(expected) ? std::isnan(result) : result == expected && std::signbit(result) == std::signbit(expected);
+    Require(kind == expectedKind && same && errno == expectedErrno && (std::fetestexcept(FE_ALL_EXCEPT) & FloatingExceptions) == expectedFlags, message);
+}
+
 void TestStod() {
     CheckStod("1.5", 0, 1.5, 3, 0, "unscaled decimal");
     CheckStod("1.5", 1, 15.0, 3, 0, "decimal scaled up");
@@ -185,157 +210,179 @@ void TestIntegerErrors() {
 }
 
 void TestDoubleHelpers() {
-    const double e = std::exp(1.0);
+    const double e = 0x1.5bf0a8b145769p+1;
+    CheckExp(1.0, 1.0, 0, e, Finite, 0, 0, "_Exp e");
+    CheckExp(0.0, 1.0, 0, 1.0, Finite, 0, 0, "_Exp zero exponent");
+    CheckExp(0.0, 5.0, 0, 5.0, Finite, 0, 0, "_Exp multiplier at zero exponent");
+    CheckExp(1.0, -0.0, 0, -0.0, Zero, 0, 0, "_Exp keeps a negative zero multiplier");
+    CheckExp(1.0, 0.0, 0, 0.0, Zero, 0, 0, "_Exp zero multiplier");
+    CheckExp(-1.0, -0.0, 0, -0.0, Zero, 0, 0, "_Exp negative zero multiplier");
+    CheckExp(INFINITY, -0.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp positive infinity with zero multiplier is invalid");
+    CheckExp(INFINITY, 0.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp positive infinity with positive zero is invalid");
+    CheckExp(INFINITY, 1.0, 0, INFINITY, Infinite, 0, 0, "_Exp positive infinity");
+    CheckExp(INFINITY, -1.0, 0, -INFINITY, Infinite, 0, 0, "_Exp positive infinity preserves the multiplier sign");
+    CheckExp(INFINITY, INFINITY, 0, INFINITY, Infinite, 0, 0, "_Exp positive infinity with infinite multiplier");
+    CheckExp(INFINITY, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_Exp positive infinity with negative infinite multiplier");
+    CheckExp(-INFINITY, 1.0, 0, 0.0, Zero, 0, 0, "_Exp negative infinity");
+    CheckExp(-INFINITY, -1.0, 0, -0.0, Zero, 0, 0, "_Exp negative infinity preserves the multiplier sign");
+    CheckExp(-INFINITY, 0.0, 0, 0.0, Zero, 0, 0, "_Exp negative infinity with positive zero");
+    CheckExp(-INFINITY, -0.0, 0, -0.0, Zero, 0, 0, "_Exp negative infinity with negative zero");
+    CheckExp(-INFINITY, INFINITY, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp negative infinity with infinite multiplier is invalid");
+    CheckExp(-INFINITY, -INFINITY, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_Exp negative infinity with negative infinite multiplier is invalid");
+    CheckExp(0.0, INFINITY, 0, INFINITY, Infinite, 0, 0, "_Exp zero exponent with infinite multiplier");
+    CheckExp(0.0, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_Exp zero exponent with negative infinite multiplier");
+    CheckExp(1.0, INFINITY, 0, INFINITY, Infinite, 0, 0, "_Exp finite exponent with infinite multiplier");
+    CheckExp(1.0, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_Exp finite exponent with negative infinite multiplier");
+    CheckExp(1.0, std::numeric_limits<double>::quiet_NaN(), 0, 1.0, NotANumber, 0, 0, "_Exp NaN multiplier leaves the exponent");
+    CheckExp(INFINITY, std::numeric_limits<double>::quiet_NaN(), 0, INFINITY, NotANumber, 0, 0, "_Exp NaN multiplier leaves an infinite exponent");
+    CheckExp(std::numeric_limits<double>::quiet_NaN(), 0.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, 0, 0, "_Exp NaN exponent with zero multiplier");
+    CheckExp(std::numeric_limits<double>::quiet_NaN(), 1.0, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, 0, 0, "_Exp NaN exponent");
+    CheckExp(std::numeric_limits<double>::quiet_NaN(), INFINITY, 0, std::numeric_limits<double>::quiet_NaN(), NotANumber, 0, 0, "_Exp NaN exponent with infinite multiplier");
+    CheckExp(1843.0, 1.0, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp positive cutoff");
+    CheckExp(1843.0, -1.0, 0, -INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp positive cutoff preserves the multiplier sign");
+    CheckExp(1843.0, 1.0, -2660, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp positive cutoff ignores a compensating offset");
+    CheckExp(-1843.0, 1.0, 0, 0.0, Zero, 0, 0, "_Exp negative cutoff");
+    CheckExp(-1843.0, -1.0, 0, -0.0, Zero, 0, 0, "_Exp negative cutoff preserves the multiplier sign");
+    CheckExp(-1843.0, 1.0, 2660, 0.0, Zero, 0, 0, "_Exp negative cutoff ignores a compensating offset");
+    CheckExp(1843.0, 0.0, 0, 0.0, Zero, 0, 0, "_Exp positive cutoff with zero multiplier");
+    CheckExp(1843.0, std::numeric_limits<double>::quiet_NaN(), 0, 1843.0, NotANumber, 0, 0, "_Exp positive cutoff with NaN multiplier");
+    CheckExp(0.0, 1.0, -1074, std::numeric_limits<double>::denorm_min(), Finite, 0, 0, "_Exp exact minimum subnormal");
+    CheckExp(0.0, 1.0, -1075, 0.0, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_Exp scaled underflow");
+    CheckExp(0.0, -1.0, -1075, -0.0, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_Exp scaled underflow preserves the multiplier sign");
+    CheckExp(0.0, 1.0, 100, std::scalbn(1.0, 100), Finite, 0, 0, "_Exp scaled finite result");
+    CheckExp(0.0, 1.0, 2000, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp scaled overflow");
+    CheckExp(1842.0, 1.0, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_Exp inside the positive cutoff overflows");
+    CheckExp(-1842.0, 1.0, 0, 0.0, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_Exp inside the negative cutoff underflows");
+
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
     double result = 1.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == -1 && std::fabs(result - e) <= e * 1e-14, "_Exp e");
-    result = 0.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == -1 && result == 1.0, "_Exp zero exponent");
+    Require(_Exp_nid_postfix(&result, 3.0, 0) == Finite && std::fabs(result - 3.0 * e) <= 3.0 * e * 1e-14, "_Exp multiplier");
     result = 1.0;
-    Require(_Exp_nid_postfix(&result, 3.0, 0) == -1 && std::fabs(result - 3.0 * e) <= 3.0 * e * 1e-14, "_Exp multiplier");
+    Require(_Exp_nid_postfix(&result, -2.0, 0) == Finite && std::fabs(result + 2.0 * e) <= 2.0 * e * 1e-14, "_Exp negative multiplier");
     result = 1.0;
-    Require(_Exp_nid_postfix(&result, -2.0, 0) == -1 && std::fabs(result + 2.0 * e) <= 2.0 * e * 1e-14, "_Exp negative multiplier");
-    result = 0.0;
-    Require(_Exp_nid_postfix(&result, 5.0, 0) == -1 && result == 5.0, "_Exp multiplier at zero exponent");
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 10) == -1 && std::fabs(result - e * 1024.0) <= e * 1024.0 * 1e-14, "_Exp scale");
+    Require(_Exp_nid_postfix(&result, 1.0, 10) == Finite && std::fabs(result - e * 1024.0) <= e * 1024.0 * 1e-14, "_Exp scale");
     for (int i = -200; i <= 200; ++i) {
         const double x = static_cast<double>(i) / 16.0;
         result = x;
-        Require(_Exp_nid_postfix(&result, 1.0, 0) == -1 && std::fabs(result - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-14, "_Exp finite sweep");
+        Require(_Exp_nid_postfix(&result, 1.0, 0) == Finite && std::fabs(result - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-13, "_Exp finite sweep");
     }
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, 0.0, 0) == 0 && result == 0.0, "_Exp zero multiplier");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = NAN;
-    Require(_Exp_nid_postfix(&result, 0.0, 0) == 2 && std::isnan(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp NaN zero multiplier");
-    result = NAN;
-    Require(_Exp_nid_postfix(&result, 0.0, 17) == 2 && std::isnan(result), "_Exp scaled NaN zero multiplier");
-    result = 1843.0;
-    Require(_Exp_nid_postfix(&result, 0.0, 0) == 0 && result == 0.0, "_Exp overflow exponent with zero multiplier");
-    result = INFINITY;
-    Require(_Exp_nid_postfix(&result, 0.0, -17) == 0 && result == 0.0 && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp infinite exponent with zero multiplier");
-    result = -INFINITY;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == 0 && result == 0.0, "_Exp negative infinity");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = 1843.0;
-    Require(_Exp_nid_postfix(&result, -1.0, 0) == 1 && std::isinf(result) && std::signbit(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_Exp overflow preserves multiplier sign");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = -1843.0;
-    Require(_Exp_nid_postfix(&result, -1.0, 0) == 0 && result == 0.0 && std::signbit(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_Exp underflow preserves multiplier sign");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = -1843.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == 0 && result == 0.0 && !std::signbit(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_Exp negative cutoff reports underflow");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::max(), 0) == 1 && std::isinf(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_Exp finite multiplier overflow");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::denorm_min(), 0) == -2 && std::fpclassify(result) == FP_SUBNORMAL && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_Exp subnormal result classification");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = INFINITY;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == 1 && std::isinf(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_Exp positive infinity");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = NAN;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == 2 && std::isnan(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp NaN exponent");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, NAN, 0) == 2 && std::isnan(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp NaN multiplier");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, INFINITY, 0) == 1 && std::isinf(result) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp infinite multiplier");
-    result = 1000.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == 1 && std::isinf(result), "_Exp overflow");
-    result = -1000.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 0) == 0 && result == 0.0, "_Exp underflow");
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, 1.0, -2000) == 0 && result == 0.0, "_Exp scaled underflow");
-    result = 1.0;
-    Require(_Exp_nid_postfix(&result, 1.0, 2000) == 1 && std::isinf(result), "_Exp scaled overflow");
 
-    const float ef = std::exp(1.0f);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::denorm_min(), 0) == Finite && std::fpclassify(result) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp subnormal result classification");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -740.0;
+    Require(_Exp_nid_postfix(&result, 1.0, 0) == Finite && std::fpclassify(result) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_Exp negative exponent subnormal result");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 1.0;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::max(), 0) == Infinite && std::isinf(result) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_INEXACT)) == (FE_OVERFLOW | FE_INEXACT), "_Exp finite multiplier overflow");
+
+    const double largeExpected = std::scalbn(std::exp(710.0 - 1024.0 * std::log(2.0)) * 1e-100, 1024);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = 710.0;
+    Require(_Exp_nid_postfix(&result, 1e-100, 0) == Finite && std::isfinite(result) && std::fabs(result - largeExpected) <= largeExpected * 1e-13 && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_Exp large exponent stays finite");
+    const double smallExpected = std::scalbn(std::exp(-710.0 + 1024.0 * std::log(2.0)) * 1e300, -1024);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -710.0;
+    Require(_Exp_nid_postfix(&result, 1e300, 0) == Finite && std::isfinite(result) && std::fabs(result - smallExpected) <= smallExpected * 1e-13 && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_Exp small exponent stays finite");
+    const double multiplierExpected = std::exp(-0.5) * std::numeric_limits<double>::max();
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    result = -0.5;
+    Require(_Exp_nid_postfix(&result, std::numeric_limits<double>::max(), 0) == Finite && std::isfinite(result) && std::fabs(result - multiplierExpected) <= multiplierExpected * 1e-13 && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_Exp large multiplier stays finite");
+
+    const float ef = 0x1.5bf0a8p+1f;
+    CheckFExp(1.0f, 1.0f, 0, ef, Finite, 0, 0, "_FExp e");
+    CheckFExp(0.0f, 1.0f, 0, 1.0f, Finite, 0, 0, "_FExp zero exponent");
+    CheckFExp(0.0f, 5.0f, 0, 5.0f, Finite, 0, 0, "_FExp multiplier at zero exponent");
+    CheckFExp(1.0f, -0.0f, 0, -0.0f, Zero, 0, 0, "_FExp keeps a negative zero multiplier");
+    CheckFExp(1.0f, 0.0f, 0, 0.0f, Zero, 0, 0, "_FExp zero multiplier");
+    CheckFExp(-1.0f, -0.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative zero multiplier");
+    CheckFExp(INFINITY, -0.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp positive infinity with zero multiplier is invalid");
+    CheckFExp(INFINITY, 0.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp positive infinity with positive zero is invalid");
+    CheckFExp(INFINITY, 1.0f, 0, INFINITY, Infinite, 0, 0, "_FExp positive infinity");
+    CheckFExp(INFINITY, -1.0f, 0, -INFINITY, Infinite, 0, 0, "_FExp positive infinity preserves the multiplier sign");
+    CheckFExp(INFINITY, INFINITY, 0, INFINITY, Infinite, 0, 0, "_FExp positive infinity with infinite multiplier");
+    CheckFExp(INFINITY, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_FExp positive infinity with negative infinite multiplier");
+    CheckFExp(-INFINITY, 1.0f, 0, 0.0f, Zero, 0, 0, "_FExp negative infinity");
+    CheckFExp(-INFINITY, -1.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative infinity preserves the multiplier sign");
+    CheckFExp(-INFINITY, 0.0f, 0, 0.0f, Zero, 0, 0, "_FExp negative infinity with positive zero");
+    CheckFExp(-INFINITY, -0.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative infinity with negative zero");
+    CheckFExp(-INFINITY, INFINITY, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp negative infinity with infinite multiplier is invalid");
+    CheckFExp(-INFINITY, -INFINITY, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, EDOM, FE_INVALID, "_FExp negative infinity with negative infinite multiplier is invalid");
+    CheckFExp(0.0f, INFINITY, 0, INFINITY, Infinite, 0, 0, "_FExp zero exponent with infinite multiplier");
+    CheckFExp(0.0f, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_FExp zero exponent with negative infinite multiplier");
+    CheckFExp(1.0f, INFINITY, 0, INFINITY, Infinite, 0, 0, "_FExp finite exponent with infinite multiplier");
+    CheckFExp(1.0f, -INFINITY, 0, -INFINITY, Infinite, 0, 0, "_FExp finite exponent with negative infinite multiplier");
+    CheckFExp(1.0f, std::numeric_limits<float>::quiet_NaN(), 0, 1.0f, NotANumber, 0, 0, "_FExp NaN multiplier leaves the exponent");
+    CheckFExp(INFINITY, std::numeric_limits<float>::quiet_NaN(), 0, INFINITY, NotANumber, 0, 0, "_FExp NaN multiplier leaves an infinite exponent");
+    CheckFExp(std::numeric_limits<float>::quiet_NaN(), 0.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, 0, 0, "_FExp NaN exponent with zero multiplier");
+    CheckFExp(std::numeric_limits<float>::quiet_NaN(), 1.0f, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, 0, 0, "_FExp NaN exponent");
+    CheckFExp(std::numeric_limits<float>::quiet_NaN(), INFINITY, 0, std::numeric_limits<float>::quiet_NaN(), NotANumber, 0, 0, "_FExp NaN exponent with infinite multiplier");
+    CheckFExp(230.0f, 1.0f, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp positive cutoff");
+    CheckFExp(230.0f, -1.0f, 0, -INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp positive cutoff preserves the multiplier sign");
+    CheckFExp(230.0f, 1.0f, -332, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp positive cutoff ignores the offset");
+    CheckFExp(-230.0f, 1.0f, 0, 0.0f, Zero, 0, 0, "_FExp negative cutoff");
+    CheckFExp(-230.0f, -1.0f, 0, -0.0f, Zero, 0, 0, "_FExp negative cutoff preserves the multiplier sign");
+    CheckFExp(-230.0f, 1.0f, 332, 0.0f, Zero, 0, 0, "_FExp negative cutoff ignores the offset");
+    CheckFExp(230.0f, 0.0f, 0, 0.0f, Zero, 0, 0, "_FExp positive cutoff with zero multiplier");
+    CheckFExp(230.0f, std::numeric_limits<float>::quiet_NaN(), 0, 230.0f, NotANumber, 0, 0, "_FExp positive cutoff with NaN multiplier");
+    CheckFExp(0.0f, 1.0f, -149, std::numeric_limits<float>::denorm_min(), Finite, 0, 0, "_FExp exact minimum subnormal");
+    CheckFExp(0.0f, 1.0f, -150, 0.0f, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_FExp scaled underflow");
+    CheckFExp(0.0f, -1.0f, -150, -0.0f, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_FExp scaled underflow preserves the multiplier sign");
+    CheckFExp(0.0f, 1.0f, 100, std::scalbn(1.0f, 100), Finite, 0, 0, "_FExp scaled finite result");
+    CheckFExp(0.0f, 1.0f, 200, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp scaled overflow");
+    CheckFExp(229.0f, 1.0f, 0, INFINITY, Infinite, ERANGE, FE_OVERFLOW | FE_INEXACT, "_FExp inside the positive cutoff overflows");
+    CheckFExp(-229.0f, 1.0f, 0, 0.0f, Zero, ERANGE, FE_UNDERFLOW | FE_INEXACT, "_FExp inside the negative cutoff underflows");
+
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
     float resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == -1 && std::fabs(resultf - ef) <= ef * 1e-6f, "_FExp e");
-    resultf = 0.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == -1 && resultf == 1.0f, "_FExp zero exponent");
+    Require(_FExp_nid_postfix(&resultf, 3.0f, 0) == Finite && std::fabs(resultf - 3.0f * ef) <= 3.0f * ef * 1e-6f, "_FExp multiplier");
     resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, 3.0f, 0) == -1 && std::fabs(resultf - 3.0f * ef) <= 3.0f * ef * 1e-6f, "_FExp multiplier");
+    Require(_FExp_nid_postfix(&resultf, -2.0f, 0) == Finite && std::fabs(resultf + 2.0f * ef) <= 2.0f * ef * 1e-6f, "_FExp negative multiplier");
     resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, -2.0f, 0) == -1 && std::fabs(resultf + 2.0f * ef) <= 2.0f * ef * 1e-6f, "_FExp negative multiplier");
-    resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 10) == -1 && std::fabs(resultf - ef * 1024.0f) <= ef * 1024.0f * 1e-6f, "_FExp scale");
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 10) == Finite && std::fabs(resultf - ef * 1024.0f) <= ef * 1024.0f * 1e-6f, "_FExp scale");
     for (int i = -120; i <= 120; ++i) {
         const float x = static_cast<float>(i) / 16.0f;
         resultf = x;
-        Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == -1 && std::fabs(resultf - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-6f, "_FExp finite sweep");
+        Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == Finite && std::fabs(resultf - std::exp(x)) <= std::fabs(std::exp(x)) * 1e-6f, "_FExp finite sweep");
     }
-    resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, 0.0f, 0) == 0 && resultf == 0.0f, "_FExp zero multiplier");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = NAN;
-    Require(_FExp_nid_postfix(&resultf, 0.0f, 0) == 2 && std::isnan(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp NaN zero multiplier");
-    resultf = NAN;
-    Require(_FExp_nid_postfix(&resultf, 0.0f, 17) == 2 && std::isnan(resultf), "_FExp scaled NaN zero multiplier");
-    resultf = 230.0f;
-    Require(_FExp_nid_postfix(&resultf, 0.0f, 0) == 0 && resultf == 0.0f, "_FExp overflow exponent with zero multiplier");
-    resultf = INFINITY;
-    Require(_FExp_nid_postfix(&resultf, 0.0f, -17) == 0 && resultf == 0.0f && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp infinite exponent with zero multiplier");
-    resultf = -INFINITY;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 0 && resultf == 0.0f, "_FExp negative infinity");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = 230.0f;
-    Require(_FExp_nid_postfix(&resultf, -1.0f, 0) == 1 && std::isinf(resultf) && std::signbit(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_FExp overflow preserves multiplier sign");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = -230.0f;
-    Require(_FExp_nid_postfix(&resultf, -1.0f, 0) == 0 && resultf == 0.0f && std::signbit(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_FExp underflow preserves multiplier sign");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = -230.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 0 && resultf == 0.0f && !std::signbit(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_FExp negative cutoff reports underflow");
+
     errno = 0;
     std::feclearexcept(FE_ALL_EXCEPT);
     resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::max(), 0) == 1 && std::isinf(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_FExp finite multiplier overflow");
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::denorm_min(), 0) == Finite && std::fpclassify(resultf) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp subnormal result classification");
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -100.0f;
+    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == Finite && std::fpclassify(resultf) == FP_SUBNORMAL && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp negative exponent subnormal result");
     errno = 0;
     std::feclearexcept(FE_ALL_EXCEPT);
     resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::denorm_min(), 0) == -2 && std::fpclassify(resultf) == FP_SUBNORMAL && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_UNDERFLOW | FE_INEXACT)) == (FE_UNDERFLOW | FE_INEXACT), "_FExp subnormal result classification");
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::max(), 0) == Infinite && std::isinf(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_INEXACT)) == (FE_OVERFLOW | FE_INEXACT), "_FExp finite multiplier overflow");
+
+    const float largeExpectedf = static_cast<float>(std::exp(100.0) * 1e-35);
     errno = 0;
     std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = INFINITY;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 1 && std::isinf(resultf) && errno == ERANGE && (std::fetestexcept(FE_ALL_EXCEPT) & FE_OVERFLOW) != 0, "_FExp positive infinity");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = NAN;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 2 && std::isnan(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp NaN exponent");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, NAN, 0) == 2 && std::isnan(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp NaN multiplier");
-    errno = 0;
-    std::feclearexcept(FE_ALL_EXCEPT);
-    resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, INFINITY, 0) == 1 && std::isinf(resultf) && errno == 0 && std::fetestexcept(FE_ALL_EXCEPT) == 0, "_FExp infinite multiplier");
     resultf = 100.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 1 && std::isinf(resultf), "_FExp overflow");
-    resultf = -120.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 0) == 0 && resultf == 0.0f, "_FExp underflow");
-    resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, -200) == 0 && resultf == 0.0f, "_FExp scaled underflow");
-    resultf = 1.0f;
-    Require(_FExp_nid_postfix(&resultf, 1.0f, 200) == 1 && std::isinf(resultf), "_FExp scaled overflow");
+    Require(_FExp_nid_postfix(&resultf, 1e-35f, 0) == Finite && std::isfinite(resultf) && std::fabs(resultf - largeExpectedf) <= largeExpectedf * 1e-6f && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_FExp large exponent stays finite");
+    const float smallExpectedf = static_cast<float>(std::exp(-100.0) * 1e30);
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -100.0f;
+    Require(_FExp_nid_postfix(&resultf, 1e30f, 0) == Finite && std::isfinite(resultf) && std::fabs(resultf - smallExpectedf) <= smallExpectedf * 1e-6f && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_FExp small exponent stays finite");
+    const float multiplierExpectedf = static_cast<float>(std::exp(-0.5) * std::numeric_limits<float>::max());
+    errno = 0;
+    std::feclearexcept(FE_ALL_EXCEPT);
+    resultf = -0.5f;
+    Require(_FExp_nid_postfix(&resultf, std::numeric_limits<float>::max(), 0) == Finite && std::isfinite(resultf) && std::fabs(resultf - multiplierExpectedf) <= multiplierExpectedf * 1e-6f && errno == 0 && (std::fetestexcept(FE_ALL_EXCEPT) & (FE_OVERFLOW | FE_UNDERFLOW)) == 0, "_FExp large multiplier stays finite");
 }
 
 void TestDispatch() {
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index cb7d5c983c..1baa7f55c4 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -162,7 +162,7 @@
 - [std::_Throw_Cpp_error](../../../core/libs/prx/libc/src/exception/StandardExceptions.cpp) (libc) follows Dinkumware `thread0.cpp` ([VC12](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/thread0.cpp), [STL](https://github.com/microsoft/STL/blob/da52dc0f/stl/src/thread0.cpp)), without console verification. Codes outside 0..6 throw `std::out_of_range`, the deleting destructor throws, and STREAMS errnos absent from FreeBSD 11.4 [`errno.h`](https://github.com/freebsd/freebsd-src/blob/releng/11.4/sys/sys/errno.h) (`ENODATA`, `ENOSR`, `ENOSTR`, `ETIME`) are omitted. Codes 0..6 throw a 32-byte [VC12 `system_error`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/system_error) with FreeBSD errnos (16, 22, 3, 12, 1, 11, 35), a static `generic_category` (not `_Generic_object`), and unverified 40-byte [GuestLocale::String](../../../core/libs/prx/libc/include/GuestLocale.hpp) messages from [`syserror.cpp`](https://github.com/ganboing/crt.vc12/blob/f1d47126/src/syserror.cpp)
 - [Call tracing](../../../core/libs/prx/libc/src/specifics/x86_64/CallTrace.cpp) (`--trace-imports`, `APS5_TRACE_CALLS`) is missing on macOS and records only the entry of a call, not its arguments or result. One process-wide ring keeps the last 65536 calls, so a busy thread pushes the others out; the reporting thread's own calls are listed only while they are still in that ring. Calls are counted per traced target; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and `xmm0` to `xmm7`; wider vector arguments survive only while the recording code avoids AVX, which is untested. Linux has no crash report, so it prints the trace only on `SIGABRT` (guest or host `abort()`), not on `SIGSEGV`; a caller in a module loaded after the last traced import prints without a module name, and a thread aborting while another writes the report waits for it at most 2 seconds
 - [_Dtest](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows Dinkumware double classification matching _FDtest: finite values return -1, subnormals -2, zeros 0, infinities 1, and NaNs 2.
-- [_Exp and _FExp](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libc) compute `y * exp(x) * 2^offset` following the public Dinkumware CRT contracts. The implementation classifies NaN operands first so they propagate, then applies the zero-multiplier shortcut before the exponent range checks: `y == 0` returns zero even for an infinite exponent. The multiplier sign is preserved on both range cutoffs; the negative cutoff raises underflow and returns a signed zero, and the overflow cutoff raises overflow. Scaling preserves range errors for an intermediate overflow and returns the denormal classification for a subnormal final result. The exact console results, the precedence for NaN and infinite special values, range-error thresholds, directed-rounding behavior and floating-point exception behavior are not verified.
+- [_Exp and _FExp](../../../core/libs/prx/libc/src/DinkumwareInternals.cpp) (libc) follow PRAGMATA PPSA02530's bundled `libc.prx` (static disassembly): both operands are classified first and only finite/denormal pairs take the finite path. The strict x-only cutoffs at ±229/±1842 store `0.0*y` without an error below and `y*inf` with overflow above, so an offset does not compensate them. A zero multiplier keeps its sign, a NaN multiplier leaves `*px` unchanged, `+inf` with zero or `-inf` with infinity is invalid, and finite multipliers with `+inf`/`-inf` return signed infinity/zero without flags. Inside the cutoffs subnormals are `Finite` without flags, a zero from scaling raises underflow, and the negative cutoff itself raises nothing. `_FExp` uses the measured `c1`, `c2`, `invln2`, `Q` and `P`; `_Exp` finite constants, exact finite bits, signaling NaNs, directed rounding and flush-to-zero modes remain unverified.
 - [exp2f](../../../core/libs/prx/libc/src/Math.cpp) (libc) is FreeBSD msun's [`s_exp2f.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_exp2f.c), with `huge` and `twom100` read at run time and `x + redux` rounded to float, as msun's `volatile` reads and `STRICT_ASSIGN` do. As in the `libc.prx` that titles ship, `errno` is set to `ERANGE` only in msun's overflow (`x >= 128`) and underflow (`x <= -150`) branches, so a subnormal result leaves it unchanged. Floating-point exceptions are not compared. It gives the same bits and `errno` as the `exp2f` of the `libc.prx` bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.
 - [app0.zar](../../../core/libs/prx/libc/src/AppArchive.cpp) (libc) - a [ZArchive](https://github.com/Exzap/ZArchive) beside `app0/` is a read-only layer under it: a path missing from `app0/` is looked up in the archive, case-insensitively. It is not a console format; titles ship their files in a PFS image instead. Resolving an archive-only path through any call other than the archive-aware libkernel ones throws, so `fopen`, `stat`, `access`, `opendir` and the rest do not read the archive yet, and `opendir` of a directory that exists in both places, `app0/` itself included, and `fdopen` of an archived descriptor throw instead of missing its entries or reading the null device. A damaged compressed block throws instead of returning `EIO`
 - [fopen_s](../../../core/libs/prx/libc/src/FileAndHeap.cpp) (libc) - returns the errno of the failed open, as C11 K.3.5.2.1 leaves the nonzero value open and Microsoft's CRT returns errno; the console's Dinkumware `fopen_s` is not verified

From d045fb7229380ef1c427d33e3ed923341bcf6810 Mon Sep 17 00:00:00 2001
From: thepoppfish <147332153+thepoppfish@users.noreply.github.com>
Date: Sun, 25 Oct 2026 08:06:00 +0200
Subject: [PATCH 175/218] fix(tools): skip database access for empty NID
 lookups

---
 tools/nid_names.py            |  2 +-
 tools/tests/test_nid_names.py | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/tools/nid_names.py b/tools/nid_names.py
index a7d1841005..e46bac30e0 100644
--- a/tools/nid_names.py
+++ b/tools/nid_names.py
@@ -225,7 +225,7 @@ def main(argv=None):
 
     db_path = Path(args.db) if args.db else DEFAULT_CACHE
     try:
-        db = load_db(db_path)
+        db = {} if requested_nids and not args.nid else load_db(db_path)
         if requested_nids:
             unknowns = {nid: "<cli>" for nid in (args.nid or [])}
         else:
diff --git a/tools/tests/test_nid_names.py b/tools/tests/test_nid_names.py
index f14b4be874..bb7e2f4702 100644
--- a/tools/tests/test_nid_names.py
+++ b/tools/tests/test_nid_names.py
@@ -30,6 +30,21 @@ class DatabaseCacheTests(unittest.TestCase):
                         else:
                             self.assertEqual(result.stdout.split(), ["NAME", "NID"])
 
+    def test_empty_nid_filters_do_not_open_database(self):
+        with tempfile.TemporaryDirectory() as directory:
+            for option in ("--nid", "--ni"):
+                for json_output in (False, True):
+                    with self.subTest(option=option, json_output=json_output):
+                        result = subprocess.run(
+                            [sys.executable, str(Path(nid_names.__file__)), option, "--db", directory,
+                             *(["--json"] if json_output else [])], capture_output=True, text=True, timeout=5)
+                        self.assertEqual(result.returncode, 0, result.stderr)
+                        self.assertEqual(result.stderr, "")
+                        if json_output:
+                            self.assertEqual(json.loads(result.stdout), {"db_entries": 0, "rows": []})
+                        else:
+                            self.assertIn("0 unknowns, 0 suggestions (0 already implemented)", result.stdout)
+
     def test_environment_variable_selects_the_database_and_help_names_it(self):
         script = str(Path(nid_names.__file__))
         helped = subprocess.run([sys.executable, script, "--help"], capture_output=True, text=True, timeout=60)

From 1257830a26fc19057f082974e8b37cbba31e94fa Mon Sep 17 00:00:00 2001
From: camezaro-intc <carlos.a.meza.r.1293@gmail.com>
Date: Sun, 25 Oct 2026 14:56:34 -0600
Subject: [PATCH 176/218] feat(libkernel_sys): forward
 sceKernelLoadStartModuleForSysmodule to sceKernelLoadStartModule

---
 core/libs/prx/libkernel_sys/Export.Discovery.cpp |  4 ----
 core/libs/prx/libkernel_sys/Export.cpp           |  4 ++++
 core/libs/prx/libkernel_sys/include/Api.hpp      |  2 +-
 core/libs/tests/GuestKernelSysModuleInternal.cpp | 12 ++++++++++++
 docs/dev/debt/libkernel_sys.md                   |  2 +-
 5 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.Discovery.cpp b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
index 73945eb7ce..cfa93d259d 100644
--- a/core/libs/prx/libkernel_sys/Export.Discovery.cpp
+++ b/core/libs/prx/libkernel_sys/Export.Discovery.cpp
@@ -1503,10 +1503,6 @@ int APS5_VABI sceKernelKernelHeapUsage(void) {
     return 0;
 }
 
-int APS5_VABI sceKernelLoadStartModuleForSysmodule(void) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
-}
 
 int APS5_VABI sceKernelLoadStartModuleInternalForMono(void) {
     NotImplemented_nid_no_patch(__func__);
diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index 4125e11eea..9cee83c6a5 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -351,6 +351,10 @@ int APS5_VABI sceKernelGetModuleListInternal(KernelModule* handles, std::size_t
     return sceKernelGetModuleList(handles, count, actual);
 }
 
+KernelModule APS5_VABI sceKernelLoadStartModuleForSysmodule(const char* moduleFileName, std::size_t args, const void* argp, std::uint32_t flags, const KernelLoadModuleOpt* opt, int* res) {
+    return sceKernelLoadStartModule(moduleFileName, args, argp, flags, opt, res);
+}
+
 int APS5_VABI fstat_nid_postfix(int d, FileStat* sb) {
     return static_cast<int>(_fstat_nid_postfix(d, sb));
 }
diff --git a/core/libs/prx/libkernel_sys/include/Api.hpp b/core/libs/prx/libkernel_sys/include/Api.hpp
index 0504ad157b..af2620e9c7 100644
--- a/core/libs/prx/libkernel_sys/include/Api.hpp
+++ b/core/libs/prx/libkernel_sys/include/Api.hpp
@@ -41,6 +41,7 @@ std::uint16_t APS5_VABI umask_nid_postfix(std::uint16_t mask);
 int APS5_VABI fstatfs_nid_postfix(int d, KernelStatfs* buf);
 int APS5_VABI sceKernelGetModuleInfoInternal(KernelModule handle, ModuleInfoEx* info);
 int APS5_VABI sceKernelGetModuleListInternal(KernelModule* handles, std::size_t count, std::size_t* actual);
+KernelModule APS5_VABI sceKernelLoadStartModuleForSysmodule(const char* moduleFileName, std::size_t args, const void* argp, std::uint32_t flags, const KernelLoadModuleOpt* opt, int* res);
 int APS5_VABI fstat_nid_postfix(int d, FileStat* sb);
 std::int64_t APS5_VABI readlink_nid_postfix(const char* path, char* buffer, std::size_t size);
 std::int64_t APS5_VABI readlinkat_nid_postfix(int fd, const char* path, char* buffer, std::size_t size);
@@ -371,7 +372,6 @@ int APS5_VABI sceKernelIsPs4Process(void);
 int APS5_VABI sceKernelIsTestKit(void);
 int APS5_VABI sceKernelJitGetSharedMemoryInfo(void);
 int APS5_VABI sceKernelKernelHeapUsage(void);
-int APS5_VABI sceKernelLoadStartModuleForSysmodule(void);
 int APS5_VABI sceKernelLoadStartModuleInternalForMono(void);
 int APS5_VABI sceKernelLwfsAllocateBlock(void);
 int APS5_VABI sceKernelLwfsLseek(void);
diff --git a/core/libs/tests/GuestKernelSysModuleInternal.cpp b/core/libs/tests/GuestKernelSysModuleInternal.cpp
index 2674a6ab3d..a51226a5e9 100644
--- a/core/libs/tests/GuestKernelSysModuleInternal.cpp
+++ b/core/libs/tests/GuestKernelSysModuleInternal.cpp
@@ -74,10 +74,22 @@ static void CheckRefusals() {
     Require(sceKernelGetModuleInfoInternal(-1, &unknown) == SCE_KERNEL_ERROR_ESRCH && unknown.name[0] == '\0');
 }
 
+static void CheckLoadStartSysmodule() {
+    int res = -1;
+    Require(sceKernelLoadStartModuleForSysmodule(nullptr, 0, nullptr, 0, nullptr, &res) == static_cast<KernelModule>(SCE_KERNEL_ERROR_EFAULT));
+    Require(res == 0);
+    Require(sceKernelLoadStartModuleForSysmodule(nullptr, 0, nullptr, 0, nullptr, nullptr) == static_cast<KernelModule>(SCE_KERNEL_ERROR_EFAULT));
+    res = -1;
+    Require(sceKernelLoadStartModuleForSysmodule("/system/common/lib/nonexistent_sysmodule.sprx", 0, nullptr, 0, nullptr, &res) ==
+            static_cast<KernelModule>(SCE_KERNEL_ERROR_ENOENT));
+    Require(res == 0);
+}
+
 int main() {
     CheckList();
     CheckEachModule();
     CheckMatchesAddressLookup();
     CheckRefusals();
+    CheckLoadStartSysmodule();
     return 0;
 }
diff --git a/docs/dev/debt/libkernel_sys.md b/docs/dev/debt/libkernel_sys.md
index fd4084515b..de7af56bcd 100644
--- a/docs/dev/debt/libkernel_sys.md
+++ b/docs/dev/debt/libkernel_sys.md
@@ -25,7 +25,7 @@
 - [unlinkat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `rmdir` (with `AT_REMOVEDIR`, 0x800) or `unlink`. Any other relative path is joined to the descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to it, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Removing a directory without `AT_REMOVEDIR` fails with `EPERM`, removing `.` or `..` with `AT_REMOVEDIR` fails with `EINVAL`, and flags other than `AT_REMOVEDIR` fail with `EINVAL`. Console behaviour is unverified
 - [renameat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) passes `AT_FDCWD` (-100) and absolute paths to `rename`. Any other relative path is joined to its descriptor's host directory, found the same way as for `fchdir`, so guest path aliases and case-insensitive name matching do not apply to relative descriptors, and a `..` component is not kept inside the guest root. It returns `EBADF` for a descriptor that is not open and `ENOTDIR` for one that is not a directory. Console behaviour is unverified
 - [fork](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) throws: creating a child process is not supported. PPSA19111 imports it and fails to load without it. Its engine calls `fork` in `Posix_Daemonize`, only with `-daemonize`, and in `Platform_ShellExecute` before `execvp("xdg-open")`, which the main menu's Previews button reaches, so pressing Previews ends in this throw. [setsid](../../../core/libs/prx/libkernel_sys/Export.cpp) fails with `EPERM`, as FreeBSD's does for a process group leader, since the guest is taken to lead its own process group (see `kill`). [umask](../../../core/libs/prx/libkernel_sys/Export.cpp) keeps the guest's mask (initially 022, masked to 07777) and returns the previous one, Linux named shared-memory creation applies it, but ordinary files are still created with the host process's mask
-- [sceKernelGetModuleInfoInternal and sceKernelGetModuleListInternal](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5
+- [sceKernelGetModuleInfoInternal, sceKernelGetModuleListInternal and sceKernelLoadStartModuleForSysmodule](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) answer for every loaded module, system modules included. `sceKernelGetModuleInfoInternal` fills the 0x1A8-byte `SceKernelModuleInfoEx` of a module handle the way `sceKernelGetModuleInfoFromAddr` does for an address, with [shadPS4's checks](https://github.com/shadps4-emu/shadPS4/blob/a808e76/src/core/libraries/kernel/process.cpp#L243-L258) in their order: `EFAULT` for a null pointer, `EINVAL` when `st_size` is not 0x1A8, `ESRCH` for an unknown handle. `sceKernelGetModuleListInternal` returns the same list as `sceKernelGetModuleList`, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd4/kernel/ps4_libkernel.pas#L852-L858) does; fpPS4 marks that as a guess, and neither is checked on a PS5. `sceKernelLoadStartModuleForSysmodule` forwards to `sceKernelLoadStartModule`
 - [chroot](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) follows FreeBSD 11.4's [`sys_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/vfs_syscalls.c#L776-L807) and [`pwd_chroot`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/kern_descrip.c#L3059-L3085) for a root caller: `EFAULT` for a null path, `ENOENT` for an empty or missing one, `ENAMETOOLONG` for a path of 1024 bytes or more or a component over 255, and `ENOTDIR` for a path that is not a directory or passes through a file. A directory that is the guest root (`/`, `/..`, or `.` after `fchdir` to a descriptor of `/`) succeeds and changes nothing, as the root stays the same directory; the guest is taken never to have changed its root, so open directory descriptors do not make it fail with `EPERM` (`kern.chroot_allow_open_directories` 1). Any other directory throws, naming the path: the guest path resolver has a fixed root and mount aliases (`/app0`, `/savedata0`) that do not move with it. On the console a title starts in a sandbox root, where `pwd_chroot` refuses with `EPERM` while a directory is open; whether that holds for titles, and whether a title holds `PRIV_VFS_CHROOT`, are unverified. Porpoise (PPSA99764) weak-imports it and calls it only as `fchdir` to its saved descriptor of `/` then `chroot(".")`, to put its sandbox root back after a jailbreak daemon replaced it ([`put_root_back`](https://github.com/elripalda/Porpoise-Dolphin-Emulator-for-PS5/blob/2ed1ab5a06995aa198f7bccd4da0f90c3fc29d39/src/porpoise_jailbreak.cpp#L303-L331))
 - [fchown](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled: the guest's own owner and group (0) and the unchanged value (-1) are accepted, a descriptor that is not open fails with `EBADF`, and any other owner or group throws, naming it. The check reads the descriptor with `fstat`, ignoring the CRT's invalid-parameter handler on Windows as `DescriptorControl` does. The console's ownership rules are unverified. Morrowind (`mshivam019/morrowind-ps5`) imports it
 - [chown, lchown and fchownat](../../../core/libs/prx/libkernel_sys/Export.cpp) (libkernel_sys) - ownership is not modelled, as for `fchown`: owner and group 0 and the unchanged value (-1) are accepted, and any other owner or group throws, naming it. The path is looked up first, as in FreeBSD 11's `kern_fchownat`, with `stat`, with `lstat` for `lchown`, and with `fstatat` for `fchownat`, so a lookup error is returned before the owner is checked and nothing is changed on the host. `fchownat` flags other than `AT_SYMLINK_NOFOLLOW` (0x200) return `EINVAL`, as in FreeBSD 11. The console's ownership rules are unverified

From 6af140f4a2d1d15f98ec63a4ed64f93fb56802e0 Mon Sep 17 00:00:00 2001
From: Ondra97 <47064087+Ondra97@users.noreply.github.com>
Date: Sun, 25 Oct 2026 22:01:12 +0100
Subject: [PATCH 177/218] test(ult): use canonical exports and require
 allocation coverage

---
 core/libs/tests/UltFinalizeAllocation.cpp | 17 +++--------------
 1 file changed, 3 insertions(+), 14 deletions(-)

diff --git a/core/libs/tests/UltFinalizeAllocation.cpp b/core/libs/tests/UltFinalizeAllocation.cpp
index 575d3da836..c5730d7f4a 100644
--- a/core/libs/tests/UltFinalizeAllocation.cpp
+++ b/core/libs/tests/UltFinalizeAllocation.cpp
@@ -1,23 +1,10 @@
-#include "SceTypes.hpp"
-#include "prx/libSceUlt/SceUltTypes.hpp"
-#include "prx/libc/include/general/VabiMacros.hpp"
+#include "prx/libSceUlt/libSceUlt.hpp"
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <new>
 
-extern "C" {
-int APS5_VABI sceUltInitialize();
-int APS5_VABI sceUltFinalize();
-int APS5_VABI sceUltSemaphoreCreate(void*, const char*, std::uint32_t, void*, const void*, std::uint32_t);
-int APS5_VABI sceUltSemaphoreTryAcquire(void*, std::int32_t);
-int APS5_VABI sceUltSemaphoreRelease(void*, std::int32_t);
-int APS5_VABI sceUltMutexCreate(void*, const char*, void*, const UltMutexOptParam*, std::uint32_t);
-int APS5_VABI sceUltMutexTryLock(void*);
-int APS5_VABI sceUltMutexUnlock(void*);
-}
-
 static int allocationBudget = -1;
 static unsigned allocationAttempts = 0;
 
@@ -79,5 +66,7 @@ int main() {
         Require(sceUltMutexTryLock(&mutex) == ULT_ERROR_STATE, "finalized mutex is still live");
     }
     std::printf("finalization allocation budgets: 8 cases, %u rejections, %u incorrect lifecycles\n", rejectedCases, failures);
+    Require(rejectedCases > 0, "no allocation failure was injected");
+    Require(rejectedCases < 8, "no finalization succeeded without a retry");
     return failures == 0 ? 0 : 1;
 }

From 76dcf6dbc9847afb3558adf16fd1d40a65f58a4c Mon Sep 17 00:00:00 2001
From: hyvvs <hyvvs@proton.me>
Date: Sun, 25 Oct 2026 22:02:20 +0100
Subject: [PATCH 178/218] fix(tools): recognize pr_overlap dependency links

---
 tools/pr_overlap.py                         |  6 +++---
 tools/tests/test_pr_overlap_dependencies.py | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/tools/pr_overlap.py b/tools/pr_overlap.py
index 29008a4d9d..c73c5b0ef5 100644
--- a/tools/pr_overlap.py
+++ b/tools/pr_overlap.py
@@ -46,10 +46,10 @@ def depends_on(body):
     body = re.sub(r"<!--.*?-->", "", body or "", flags=re.S)
     repo = re.escape(globals().get("REPO", "boykopovar/AnyPS5"))
     repo_pattern = rf"(?:{repo}|boykopovar/AnyPS5)"
-    body = re.sub(rf"\[([^\]]*)\]\(https?://github\.com/{repo_pattern}/pull/(\d+)(?:[#/?][^)\s]*)?\)", r"#\2", body, flags=re.IGNORECASE)
-    body = re.sub(rf"\[([^\]]*)\]\(https?://github\.com/(?!{repo_pattern}/)[^/\s]+/[^/\s]+/pull/\d+[^)\s]*\)", "", body, flags=re.IGNORECASE)
+    body = re.sub(rf"\[([^\]]*)\]\(https?://(?:www\.)?github\.com/{repo_pattern}/pull/(\d+)(?:[#/?][^)\s]*)?\)", r"#\2", body, flags=re.IGNORECASE)
+    body = re.sub(rf"\[([^\]]*)\]\(https?://(?:www\.)?github\.com/(?!{repo_pattern}/)[^/\s]+/[^/\s]+/pull/\d+[^)\s]*\)", "", body, flags=re.IGNORECASE)
     body = re.sub(r"\[([^\]]+)\]\([^)]+\)", r"\1", body)
-    body = re.sub(rf"https?://github\.com/{repo_pattern}/pull/(\d+)\b(?:/[^\s]*)?", r"#\1", body, flags=re.IGNORECASE)
+    body = re.sub(rf"https?://(?:www\.)?github\.com/{repo_pattern}/pull/(\d+)\b(?:/[^\s]*)?", r"#\1", body, flags=re.IGNORECASE)
     match = next((match for match in DEPENDS.finditer(body) if match.group(1).strip()), None) or PLAIN_DEPENDS.search(body)
     return {int(n) for n in re.findall(r"#(\d+)", match.group(1))} if match else set()
 
diff --git a/tools/tests/test_pr_overlap_dependencies.py b/tools/tests/test_pr_overlap_dependencies.py
index 9af379f868..fdab9124e6 100644
--- a/tools/tests/test_pr_overlap_dependencies.py
+++ b/tools/tests/test_pr_overlap_dependencies.py
@@ -129,6 +129,22 @@ class DependencyTests(unittest.TestCase):
         self.assertIsNone(pr_overlap.overlaps(prs, 1, 2))
         self.assertIsNone(pr_overlap.overlaps(prs, 2, 1))
 
+    def test_reported_link_round_trips_as_a_dependency(self):
+        with patch.object(pr_overlap, "REPO", "owner/repo", create=True):
+            link = pr_overlap.pull("https://github.com/owner/repo/blob/abc123", 2)
+        self.assertIn("https://www.github.com/owner/repo/pull/2", link)
+        prs = pull_requests(f"Depends on: {link}")
+        self.assertEqual(prs[1]["depends"], {2})
+        for pr in prs.values():
+            pr["added"] = {"shared.cpp"}
+        self.assertIsNone(pr_overlap.overlaps(prs, 1, 2))
+
+    def test_www_github_dependencies_are_supported(self):
+        for reference in ("https://www.github.com/owner/repo/pull/2",
+                          "[PR 2](https://www.github.com/owner/repo/pull/2)"):
+            with self.subTest(reference=reference):
+                self.assertEqual(pull_requests(f"Depends on: {reference}")[1]["depends"], {2})
+
     def test_unrelated_reference_keeps_overlap(self):
         prs = pull_requests("Related to #2.")
         for pr in prs.values():

From 2f3e41252d74eb7f19877ffd9abc7bfe316bdccd Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Mon, 19 Oct 2026 23:03:26 +0300
Subject: [PATCH 179/218] fix(relinker): mask embedded data tables in inter-FDE
 gaps

In PS5 Prospero PRX binaries, compilers place embedded constant data tables (such as the OpenSSL Whirlpool lookup table in ubiservices.prx) in inter-FDE gaps after function code, referenced via RIP-relative LEA instructions.

- In RelativeJumpTables, detect constant data tables in inter-FDE gaps that begin with padding, contain no direct branch targets, and contain undecodable non-code bytes, distinguishing them from valid unannotated code routines and multi-hop gap branches.
- In GuestModuleBuilder and RelinkerPipeline, extract unwind functions from PT_GNU_EH_FRAME as well as PT_SCE_DYNLIBDATA, and mask embedded data tables with 0x90 in scan buffers before SyscallScanner.
- In CodeInstructionCollector, populate table boundaries whenever unwind functions are present to prevent addAddressTakenRoot from adding data table addresses to CFG roots on Windows and macOS.
- Update relinker technical debt documentation and add regression tests.

Fixes #7547
Unblocks: PPSA28155 #7547
---
 .../src/analysis/CodeInstructionCollector.cpp |   2 +-
 .../src/analysis/RelativeJumpTables.cpp       | 110 +++++++++++++++++-
 .../relinker/src/guest/GuestModuleBuilder.cpp |  19 ++-
 .../src/pipeline/RelinkerPipeline.cpp         |   9 +-
 .../relinker/tests/ControlFlowGraphTests.cpp  |  59 ++++++++++
 .../relinker/tests/test_sce_code_extent.py    |  20 +++-
 docs/dev/debt/relinker.md                     |   1 +
 7 files changed, 209 insertions(+), 11 deletions(-)

diff --git a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
index 2e7d216a7f..14fd038f7a 100644
--- a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
+++ b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
@@ -346,7 +346,7 @@ std::set<Domain::VirtualAddress> CodeInstructionCollector::Collect(const std::ve
         addFunction(function.Begin, function.End - function.Begin, false);
         for (const auto target : function.ExtraTargets) addRoot(target);
     }
-    if (sceBase) {
+    if (sceBase || !functions.empty()) {
         const std::vector<std::pair<std::uint64_t, std::uint64_t>> ranges(functions.begin(), functions.end());
         for (const auto& header : codeHeaders) {
             if (header.Type != 1 || (header.Flags & 1) == 0) continue;
diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index 7c99111960..d1130c0011 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -3,6 +3,8 @@
 #include <codegen/CodegenException.hpp>
 #include <algorithm>
 #include <cstring>
+#include <optional>
+#include <set>
 
 namespace Relinker {
 
@@ -67,6 +69,20 @@ std::size_t TablesEnd(std::span<const std::uint8_t> code, std::size_t firstTable
     return table;
 }
 
+bool HasUndecodableBytes(std::span<const std::uint8_t> code, const Codegen::X64InstructionDecoder& decoder) {
+    for (std::size_t position = 0; position < code.size();) {
+        if (OnlyPadding(code, position, code.size(), decoder)) return false;
+        try {
+            const auto info = decoder.DecodeInstruction(code.data() + position, code.size() - position);
+            if (info.Length == 0 || info.Length > code.size() - position) return true;
+            position += info.Length;
+        } catch (const Codegen::CodegenException&) {
+            return true;
+        }
+    }
+    return false;
+}
+
 }
 
 std::size_t FindTrailingRelativeJumpTable(std::span<const std::uint8_t> code, VirtualAddress codeAddress, std::size_t* tableEnd, std::size_t unwindEnd) {
@@ -121,6 +137,62 @@ std::size_t FindTrailingRelativeJumpTable(std::span<const std::uint8_t> code, Vi
 std::vector<RelativeJumpTable> FindRelativeJumpTables(std::span<const std::uint8_t> segment, VirtualAddress segmentVAddr, const std::vector<std::pair<VirtualAddress, VirtualAddress>>& functions) {
     std::vector<RelativeJumpTable> tables;
     const auto segmentEnd = segmentVAddr + segment.size();
+    const Codegen::X64InstructionDecoder decoder;
+    std::set<VirtualAddress> branchTargets;
+    for (const auto& [funcBegin, funcEnd] : functions) {
+        if (funcBegin < segmentVAddr || funcBegin >= segmentEnd || funcEnd <= funcBegin) continue;
+        const auto inspectFuncEnd = std::min(funcEnd, segmentEnd);
+        const auto funcCode = segment.subspan(funcBegin - segmentVAddr, inspectFuncEnd - funcBegin);
+        for (std::size_t pos = 0; pos < funcCode.size();) {
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(funcCode.data() + pos, funcCode.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                break;
+            }
+            if (info.Length == 0 || info.Length > funcCode.size() - pos) break;
+            if (info.HasBranchTarget && !info.HasRipRelativeDisp) {
+                const auto target = static_cast<std::int64_t>(funcBegin + pos + info.Length) + info.BranchDisp;
+                if (target >= static_cast<std::int64_t>(segmentVAddr) && target < static_cast<std::int64_t>(segmentEnd))
+                    branchTargets.insert(static_cast<VirtualAddress>(target));
+            }
+            pos += info.Length;
+        }
+    }
+    std::vector<VirtualAddress> pendingTargets(branchTargets.begin(), branchTargets.end());
+    std::set<VirtualAddress> exploredGaps;
+    while (!pendingTargets.empty()) {
+        const auto current = pendingTargets.back();
+        pendingTargets.pop_back();
+        if (current < segmentVAddr || current >= segmentEnd) continue;
+        bool inKnownFunction = false;
+        for (const auto& [funcBegin, funcEnd] : functions) {
+            if (current >= funcBegin && current < funcEnd) {
+                inKnownFunction = true;
+                break;
+            }
+        }
+        if (inKnownFunction || !exploredGaps.insert(current).second) continue;
+        auto pos = static_cast<std::size_t>(current - segmentVAddr);
+        while (pos < segment.size()) {
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(segment.data() + pos, segment.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                break;
+            }
+            if (info.Length == 0 || info.Length > segment.size() - pos) break;
+            if (info.HasBranchTarget && !info.HasRipRelativeDisp) {
+                const auto target = static_cast<std::int64_t>(segmentVAddr + pos + info.Length) + info.BranchDisp;
+                if (target >= static_cast<std::int64_t>(segmentVAddr) && target < static_cast<std::int64_t>(segmentEnd)) {
+                    const auto targetVAddr = static_cast<VirtualAddress>(target);
+                    if (branchTargets.insert(targetVAddr).second) pendingTargets.push_back(targetVAddr);
+                }
+            }
+            if (info.FlowKind == Codegen::ControlFlowKind::Return || info.FlowKind == Codegen::ControlFlowKind::IndirectJump || info.FlowKind == Codegen::ControlFlowKind::Trap) break;
+            pos += info.Length;
+        }
+    }
     for (std::size_t index = 0; index < functions.size(); ++index) {
         const auto [begin, end] = functions[index];
         if (begin < segmentVAddr || begin >= segmentEnd || end <= begin) continue;
@@ -129,8 +201,44 @@ std::vector<RelativeJumpTable> FindRelativeJumpTables(std::span<const std::uint8
             inspectEnd = std::min(functions[index + 1].first, segmentEnd);
         const auto code = segment.subspan(begin - segmentVAddr, inspectEnd - begin);
         std::size_t tableEnd = code.size();
-        if (const auto tail = FindTrailingRelativeJumpTable(code, begin, &tableEnd, std::min(end, segmentEnd) - begin); tail != 0 && tail < code.size())
+        if (const auto tail = FindTrailingRelativeJumpTable(code, begin, &tableEnd, std::min(end, segmentEnd) - begin); tail != 0 && tail < code.size()) {
             tables.push_back({begin, begin + tail, begin + tableEnd});
+            continue;
+        }
+        if (inspectEnd <= end) continue;
+        const auto funcCode = segment.subspan(begin - segmentVAddr, end - begin);
+        std::optional<VirtualAddress> candidateTable;
+        bool sawIndirectJump = false;
+        for (std::size_t pos = 0; pos < funcCode.size();) {
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(funcCode.data() + pos, funcCode.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                break;
+            }
+            if (info.Length == 0 || info.Length > funcCode.size() - pos) break;
+            if (info.FlowKind == Codegen::ControlFlowKind::IndirectJump) sawIndirectJump = true;
+            const auto next = pos + info.Length;
+            if (info.HasRipRelativeDisp && !info.IsTwoByteOpcode && info.OpcodeOffset < info.Length && info.Length >= 4 && funcCode[pos + info.OpcodeOffset] == 0x8d) {
+                std::int32_t displacement = 0;
+                std::memcpy(&displacement, funcCode.data() + next - 4, sizeof(displacement));
+                const auto target = static_cast<std::int64_t>(begin + next) + displacement;
+                if (target >= static_cast<std::int64_t>(end) && target < static_cast<std::int64_t>(inspectEnd)) {
+                    const auto targetVAddr = static_cast<VirtualAddress>(target);
+                    candidateTable = candidateTable ? std::min(*candidateTable, targetVAddr) : targetVAddr;
+                }
+            }
+            pos = next;
+        }
+        if (sawIndirectJump || !candidateTable) continue;
+        const auto tableVAddr = *candidateTable;
+        const auto paddingCode = segment.subspan(end - segmentVAddr, tableVAddr - end);
+        if (!OnlyPadding(paddingCode, 0, paddingCode.size(), decoder)) continue;
+        const auto it = branchTargets.lower_bound(tableVAddr);
+        if (it != branchTargets.end() && *it < inspectEnd) continue;
+        const auto tableCode = segment.subspan(tableVAddr - segmentVAddr, inspectEnd - tableVAddr);
+        if (!HasUndecodableBytes(tableCode, decoder)) continue;
+        tables.push_back({begin, tableVAddr, inspectEnd});
     }
     return tables;
 }
diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
index 7c2110ae58..0569a3eda2 100644
--- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
+++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
@@ -1,4 +1,5 @@
 #include <relinker/guest/GuestImage.hpp>
+#include <relinker/analysis/RelativeJumpTables.hpp>
 #include <relinker/analysis/SceCodeExtent.hpp>
 #include <relinker/analysis/UnusedNidFilter/EhFrameReader.hpp>
 #include <elfpatcher/general/GuestModuleWriter.hpp>
@@ -395,14 +396,26 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
         }
         if (!image.PatchedRanges.empty()) GamePatch::CheckOverlaps(Io::Utf8Path(image.SourcePath), image.PatchedRanges, {.RelaData = image.Dynamic.RelaData, .RelaPltData = image.Dynamic.RelaPltData});
         const bool sceImage = std::any_of(image.Headers.begin(), image.Headers.end(), [](const Domain::ProgramHeader& header) { return header.Type == 0x61000000; });
-        const auto unwindFunctions = sceImage ? UnusedNidFilter::ReadExceptionFunctions(image.Bytes, image.Headers, {}, {}) : std::vector<UnusedNidFilter::StrictCodeRegion>{};
+        const bool hasEhFrame = sceImage || std::any_of(image.Headers.begin(), image.Headers.end(), [](const Domain::ProgramHeader& header) { return header.Type == 0x6474e550; });
+        const auto unwindFunctions = hasEhFrame ? UnusedNidFilter::ReadExceptionFunctions(image.Bytes, image.Headers, {}, {}) : std::vector<UnusedNidFilter::StrictCodeRegion>{};
+        std::vector<std::pair<VirtualAddress, VirtualAddress>> unwindRanges;
+        for (const auto& function : unwindFunctions) unwindRanges.emplace_back(function.Begin, function.End);
+        std::sort(unwindRanges.begin(), unwindRanges.end());
         for (const auto& header : codeHeaders) {
             std::vector<std::uint8_t> code(image.Bytes.begin() + header.Offset, image.Bytes.begin() + header.Offset + header.FileSize);
             if (sceImage)
                 if (const auto end = FindSceCodeEnd(code, header.MappedAddress, unwindFunctions, image.Got, image.Dynamic.RelaPltData.size()))
                     code.resize(*end - header.MappedAddress);
-            const auto unwindRanges = sceImage ? SceUnwindRanges(code, header.MappedAddress, unwindFunctions) : std::vector<CodeRange>{};
-            for (const auto offset : syscallScanner.ScanCodeSectionForSyscalls(code, header.MappedAddress, code.size(), Io::Utf8Path(image.SourcePath), unwindRanges)) {
+            auto scanCode = code;
+            for (const auto& table : FindRelativeJumpTables(code, header.MappedAddress, unwindRanges)) {
+                if (table.Begin >= header.MappedAddress && table.End >= table.Begin) {
+                    const auto maskEnd = std::min<std::size_t>(table.End - header.MappedAddress, scanCode.size());
+                    const auto maskBegin = std::min<std::size_t>(table.Begin - header.MappedAddress, maskEnd);
+                    std::fill(scanCode.begin() + static_cast<std::ptrdiff_t>(maskBegin), scanCode.begin() + static_cast<std::ptrdiff_t>(maskEnd), std::uint8_t{0x90});
+                }
+            }
+            const auto scanUnwindRanges = hasEhFrame ? SceUnwindRanges(code, header.MappedAddress, unwindFunctions) : std::vector<CodeRange>{};
+            for (const auto offset : syscallScanner.ScanCodeSectionForSyscalls(scanCode, header.MappedAddress, scanCode.size(), Io::Utf8Path(image.SourcePath), scanUnwindRanges)) {
                 if (offset > code.size() || code.size() - offset < 2u)
                     throw Domain::RelinkerException("Syscall trap patch exceeds guest executable segment", header.MappedAddress + offset);
                 if (!image.PatchedRanges.empty()) {
diff --git a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
index d61c99178a..6ca097d65d 100644
--- a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
+++ b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
@@ -393,15 +393,18 @@ RelinkResult RelinkerPipeline::Relink() {
 
     std::vector<std::pair<VirtualAddress, VirtualAddress>> unwindRanges;
     std::vector<std::vector<CodeRange>> segmentUnwindRanges(executableSegments.size());
-    if (std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_SCE_DYNLIBDATA; })) {
+    const bool sceImage = std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_SCE_DYNLIBDATA; });
+    const bool hasEhFrame = sceImage || std::any_of(programHeaders.begin(), programHeaders.end(), [](const ProgramHeader& ph) { return ph.Type == PT_GNU_EH_FRAME; });
+    if (hasEhFrame) {
         const auto functions = UnusedNidFilter::ReadExceptionFunctions(raw, programHeaders, {}, {});
         for (const auto& function : functions) unwindRanges.emplace_back(function.Begin, function.End);
         std::sort(unwindRanges.begin(), unwindRanges.end());
         for (std::size_t index = 0; index < executableSegments.size(); ++index) {
             auto& [segment, segmentVAddr, segmentFileOffset] = executableSegments[index];
             static_cast<void>(segmentFileOffset);
-            if (const auto codeEnd = FindSceCodeEnd(segment, segmentVAddr, functions, gotVAddr, dynJmpRelSize))
-                segment.resize(*codeEnd - segmentVAddr);
+            if (sceImage)
+                if (const auto codeEnd = FindSceCodeEnd(segment, segmentVAddr, functions, gotVAddr, dynJmpRelSize))
+                    segment.resize(*codeEnd - segmentVAddr);
             segmentUnwindRanges[index] = SceUnwindRanges(segment, segmentVAddr, functions);
         }
     }
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 092f5fa398..03311c2cd6 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -364,6 +364,64 @@ void CheckRelativeJumpTables() {
     Require(Relinker::FindRelativeJumpTables(cutShort, TextAddress, {{TextAddress, TextAddress + cutShort.size()}}).empty(), "Table followed by more of its function was accepted");
 }
 
+void CheckEmbeddedDataTables() {
+    constexpr std::size_t tableOffset = 24;
+    Bytes text(48, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + tableOffset);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < tableOffset; ++i) text[i] = 0xcc;
+    text[tableOffset] = 0x0f;
+    text[tableOffset + 1] = 0x78;
+    text[tableOffset + 2] = 0x33;
+    text[tableOffset + 3] = 0x1e;
+
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + text.size(), TextAddress + text.size() + 8}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected one embedded data table");
+    Require(tables[0].Function == TextAddress && tables[0].Begin == TextAddress + tableOffset && tables[0].End == TextAddress + text.size(), "Embedded data table range was incorrect");
+
+    Bytes withBranch = text;
+    withBranch[7] = 0xe8;
+    SetDisplacement(withBranch, 8, 12, TextAddress + tableOffset);
+    withBranch[12] = 0xc3;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsWithBranch{
+        {TextAddress, TextAddress + 13},
+        {TextAddress + withBranch.size(), TextAddress + withBranch.size() + 8}
+    };
+    const auto tablesWithBranch = Relinker::FindRelativeJumpTables(withBranch, TextAddress, functionsWithBranch);
+    Require(tablesWithBranch.empty(), "Branch target was incorrectly recognized as a data table");
+
+    Bytes withValidCode = text;
+    withValidCode[tableOffset] = 0x48;
+    withValidCode[tableOffset + 1] = 0x89;
+    withValidCode[tableOffset + 2] = 0xc0;
+    withValidCode[tableOffset + 3] = 0xc3;
+    for (std::size_t i = tableOffset + 4; i < withValidCode.size(); ++i) withValidCode[i] = 0xcc;
+    const auto tablesWithValidCode = Relinker::FindRelativeJumpTables(withValidCode, TextAddress, functions);
+    Require(tablesWithValidCode.empty(), "Valid unannotated code in gap was incorrectly recognized as a data table");
+
+    Bytes withTransitiveBranch = text;
+    withTransitiveBranch[7] = 0xe8;
+    SetDisplacement(withTransitiveBranch, 8, 12, TextAddress + 16);
+    withTransitiveBranch[12] = 0xc3;
+    for (std::size_t i = 13; i < 16; ++i) withTransitiveBranch[i] = 0xcc;
+    withTransitiveBranch[16] = 0xe9;
+    SetDisplacement(withTransitiveBranch, 17, 21, TextAddress + tableOffset);
+    for (std::size_t i = 21; i < tableOffset; ++i) withTransitiveBranch[i] = 0xcc;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsTransitive{
+        {TextAddress, TextAddress + 13},
+        {TextAddress + withTransitiveBranch.size(), TextAddress + withTransitiveBranch.size() + 8}
+    };
+    const auto tablesTransitive = Relinker::FindRelativeJumpTables(withTransitiveBranch, TextAddress, functionsTransitive);
+    Require(tablesTransitive.empty(), "Transitive branch target was incorrectly recognized as a data table");
+}
+
 }
 
 int main() {
@@ -382,6 +440,7 @@ int main() {
         CheckAddressOverflow();
         CheckHighVirtualAddress();
         CheckRelativeJumpTables();
+        CheckEmbeddedDataTables();
         std::cout << "Control-flow graph tests passed\n";
         return 0;
     } catch (const std::exception& error) {
diff --git a/core/relinker/relinker/tests/test_sce_code_extent.py b/core/relinker/relinker/tests/test_sce_code_extent.py
index 1f58fb585e..4f2d786f68 100644
--- a/core/relinker/relinker/tests/test_sce_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_code_extent.py
@@ -26,17 +26,21 @@ UNSUPPORTED_TLS = bytes.fromhex("64 2d 65 6c 66 2e c3")
 INVALID = bytes.fromhex("41 41 41 41 41 41 66 66 66 66 2e 0f 1f 84 00 00 00 00 00")
 TLS_LOAD = bytes.fromhex("64 48 8b 04 25 00 00 00 00 c3")
 FS_SUBTRACT = bytes.fromhex("64 2d 65 6c 66 2e")
+LATER_FUNCTION = 0x300
 
 
 def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False, data_pointer=False, gap_entry=False,
             plt_at=None, early_function=False, function_tls=False, pointer_target=None, gap_bytes=None, functions=None,
-            tls=False):
-    plt = FUNCTION + FUNCTION_SIZE + gap if plt_at is None else plt_at
+            tls=False, gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False):
+    has_gap_embedded = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable
+    plt = (LATER_FUNCTION + FUNCTION_SIZE + gap if has_gap_embedded else FUNCTION + FUNCTION_SIZE + gap) if plt_at is None else plt_at
     entry = FUNCTION + FUNCTION_SIZE if gap_entry else FUNCTION
     data = plt + 0x20 if plt > FUNCTION else FUNCTION + FUNCTION_SIZE
     if functions is None:
         functions = [(EARLY_FUNCTION, FUNCTION_SIZE)] if early_function else []
         functions.append((FUNCTION, FUNCTION_SIZE))
+        if has_gap_embedded:
+            functions.append((LATER_FUNCTION, FUNCTION_SIZE))
     interpreter = FUNCTION - len(INTERPRETER)
     image = bytearray(0x1000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
@@ -73,7 +77,8 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
 
     for begin, size in functions:
         image[begin:begin + size] = b"\xc3" + b"\x90" * (size - 1)
-    image[FUNCTION + FUNCTION_SIZE:plt] = b"\x90" * gap
+    last_func = LATER_FUNCTION if gap_embedded_data else FUNCTION
+    image[last_func + FUNCTION_SIZE:plt] = b"\x90" * gap
     image[plt:plt + 2] = b"\xff\x35"
     struct.pack_into("<i", image, plt + 2, GOT + plt_push_offset - (plt + 6))
     image[plt + 6:plt + 8] = b"\xff\x25"
@@ -98,6 +103,13 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         image[entry:entry + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
     if function_tls:
         image[FUNCTION:FUNCTION + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
+    if gap_embedded_data:
+        table = FUNCTION + FUNCTION_SIZE + 0x10
+        image[FUNCTION:FUNCTION + 3] = b"\x48\x8d\x05"
+        struct.pack_into("<iB", image, FUNCTION + 3, table - (FUNCTION + 7), 0xC3)
+        image[FUNCTION + FUNCTION_SIZE:table] = b"\xcc" * 0x10
+        image[table:LATER_FUNCTION] = b"\x0f\x78\x33\x1e" * ((LATER_FUNCTION - table) // 4)
+        image[data:data + 0x30] = b"\x90" * 0x30
 
     cie = EH_FRAME
     cie_body = b"\x00\x00\x00\x00\x01zR\x00\x01\x78\x10\x01\x1b\x00\x00\x00"
@@ -215,6 +227,8 @@ def main():
                 fixture(plt_at=PLT_BEFORE_CODE, early_function=True), target=target)
             run(relinker, work, "sce-code-after-plt-" + target, fixture(plt_at=PLT_BEFORE_CODE, function_tls=True),
                 "Unsupported " + ("Windows" if target == "windows" else "macOS") + " guest TLS instruction", target)
+            run(relinker, work, "sce-gap-embedded-data-" + target,
+                fixture(sce_block=True, gap_embedded_data=True), target=target)
         run(relinker, work, "sce-tls-rewrite-over-lea-target", entry_overlap_fixture(),
             "TLS rewrite would overwrite an executable entry point (offset 0x304)")
     print("SCE code extent tests passed")
diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md
index d91f5cd055..78d64511cb 100644
--- a/docs/dev/debt/relinker.md
+++ b/docs/dev/debt/relinker.md
@@ -30,6 +30,7 @@
 - In the same executables and modules, the bytes between unwind functions are 16-byte slots of function tails and padding, and a tail can begin inside an instruction. The [instruction scanner](../../../core/relinker/codegen/src/InstructionScanner.cpp) of the syscall and call-site scans therefore resumes at the next byte when bytes outside every unwind function do not decode, and ends a decoding outside them at the start of the next unwind function. Code without an unwind entry that does not decode from its first byte is skipped by these scans instead of failing the relink; inside an unwind function a decode failure still fails it.
 - Read-only data can also sit between the unwind functions of such images. There, a `syscall`, `sysenter` or `int 0x80` pattern fails the [syscall scan](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) only when a constant syscall number is set before it; the others, and every `sysret`, are skipped and counted in one message. The number is looked for in the decoded instructions and, whatever alignment the decoding took, in the bytes before the pattern: a `mov eax, imm32`, `mov rax, imm32`, `mov rax, imm64` or `xor eax, eax`, optionally followed by `mov al, imm8` or `mov ax, imm16`, then by any number of register moves or zeroings that leave `rax` alone. A real syscall without an unwind entry whose number is set otherwise is not refused and runs on the host: from memory or another register (`mov eax, ecx`), by `push`/`pop` or arithmetic (`or eax, imm32`), or with any other instruction between the load and the pattern.
 - In the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs for such images, a relocation or `lea` target outside every unwind function is followed as code only when its linear decoding, up to the first jump, return or trap, the next unwind function or 256 instructions, holds an `fs:[disp32]` access, or when it is 16-byte aligned, starts less than 256 bytes after an unwind function and ends in a jump, return or trap. Every other such target is taken as data and counted in one message, and the Windows TLS rewrite fails instead of overwriting one. A TLS access of another form, such as `mov rax, fs:[rax]`, or a `gs` instruction in code reached only through such a target is therefore not rewritten or trapped. Other fs and gs instructions do not tell code from data there: string bytes decode as these prefixes, and in two measured titles about 2,500 of about 5,500 such targets decode to one before their first jump.
+- [Embedded data tables and relative jump tables in inter-FDE gaps](../../../core/relinker/relinker/src/analysis/RelativeJumpTables.cpp) - in modules with unwind records (`PT_GNU_EH_FRAME` or `PT_SCE_DYNLIBDATA`), constant data tables referenced by RIP-relative `LEA` containing undecodable bytes and trailing jump tables in inter-FDE gaps are masked with `0x90` in the scan buffer before syscall scanning and excluded from code roots and control-flow analysis in [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp), avoiding illegal opcode rejections on embedded data such as `0F 78` in `ubiservices.prx` (The Rogue Prince of Persia, PPSA28155, #7547). Gaps with direct branch targets (`CALL`, `JMP`, `Jcc`) or valid instructions are preserved as code and undergo strict scanning. Underlying bytes in `image.Bytes` remain unmodified except for syscall traps.
 - In executables and guest modules with a `PT_SCE_DYNLIBDATA` segment, the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs follows code only from the end of `PT_INTERP`, or of the `/libexec/ld-elf.so.1` string that begins the segment when no `PT_INTERP` covers it, as in OpenOrbis modules, to the end of the PLT after the last function of the unwind table, or to the end of that function when the PLT comes before the code, as in the `libSceFios2.prx` and `libc.prx` that CUSA02636 bundles (PLT at 0xc8); the pipeline's scans of executables above stop at this same end, also when the PLT comes before the code. A guest module with PLT relocations and no PLT before or after its unwind functions, or with a PLT that overlaps one, fails as the executable does. Code after that end is not analyzed, such as the `DT_FINI` routine without an unwind entry that follows the last unwind function in both modules and that the Windows and macOS outputs call when the program exits: a TLS access in it is not rewritten, the ELF entry point, `DT_INIT`, `DT_FINI`, a branch or a pointer into it is ignored, and a function symbol or init/fini array entry pointing into it fails the conversion.
 - Under Rosetta (M5, macOS 27.0.1), a VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store or load that faults on an element other than an active first one ends the process (`unexpectedly need to EmulateForward on a synchronous exception`) instead of raising SIGSEGV or SIGBUS, so a masked store into a page the macOS write watch keeps read-only ends the title. `--to-rosetta` moves each masked store to a [stub](../../../core/relinker/codegen/src/x86/MaskedStoreLowering.cpp) that first writes to the first and last byte of every active element with `LOCK OR` of 0, which faults normally and changes nothing; each store then costs up to 16 locked byte writes. A page made read-only again by another thread between those writes and the store still ends the process. A stack-relative displacement that exceeds signed disp32 after the spill frame throws. Masked loads are not converted.
 - A relocation against a dynamic symbol entry that is all zero, like the null symbol, takes the value 0 plus its addend, as the gABI defines for `STN_UNDEF` ([pipeline](../../../core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp)). The Linux output imports such an entry as an unnamed weak symbol, which the host loader resolves to 0; the Windows and macOS outputs write the value into the slot ([relocation builder](../../../core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp)). What the console's loader does with such an entry is not measured. OliSe Player (PPSA01153) has seven of them, and its code calls through those slots only when they are not 0 ([#4437](https://github.com/boykopovar/AnyPS5/issues/4437)).

From dfe24c2e3a6a8848098a39cc2ef2ad2efb4f4b0e Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Tue, 20 Oct 2026 10:16:19 +0300
Subject: [PATCH 180/218] fix(relinker): bound embedded data tables and
 preserve trailing gap code

---
 .../src/analysis/RelativeJumpTables.cpp       | 186 ++++++++++++++++--
 .../relinker/tests/ControlFlowGraphTests.cpp  |  79 ++++++++
 .../relinker/tests/test_sce_code_extent.py    |  21 +-
 .../tests/test_sce_module_code_extent.py      |  54 ++++-
 docs/dev/debt/relinker.md                     |   2 +-
 5 files changed, 318 insertions(+), 24 deletions(-)

diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index d1130c0011..ce6b17e718 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -69,18 +69,179 @@ std::size_t TablesEnd(std::span<const std::uint8_t> code, std::size_t firstTable
     return table;
 }
 
-bool HasUndecodableBytes(std::span<const std::uint8_t> code, const Codegen::X64InstructionDecoder& decoder) {
-    for (std::size_t position = 0; position < code.size();) {
-        if (OnlyPadding(code, position, code.size(), decoder)) return false;
-        try {
-            const auto info = decoder.DecodeInstruction(code.data() + position, code.size() - position);
-            if (info.Length == 0 || info.Length > code.size() - position) return true;
-            position += info.Length;
-        } catch (const Codegen::CodegenException&) {
-            return true;
+bool IsInvalid64BitSingleByteOpcode(std::uint8_t opcode) {
+    switch (opcode) {
+    case 0x06:
+    case 0x07:
+    case 0x0e:
+    case 0x16:
+    case 0x17:
+    case 0x1e:
+    case 0x1f:
+    case 0x27:
+    case 0x2f:
+    case 0x37:
+    case 0x3f:
+    case 0x60:
+    case 0x61:
+    case 0x82:
+    case 0x9a:
+    case 0xce:
+    case 0xd4:
+    case 0xd5:
+    case 0xd6:
+    case 0xea:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool IsForbiddenSyscallInstruction(std::span<const std::uint8_t> code, std::size_t pos, const Codegen::DecodedInstructionInfo& info) {
+    const auto opPos = pos + info.OpcodeOffset;
+    if (opPos + 1 >= pos + info.Length || opPos + 1 >= code.size()) return false;
+    const auto b0 = code[opPos];
+    const auto b1 = code[opPos + 1];
+    return (b0 == 0x0f && (b1 == 0x05 || b1 == 0x34 || b1 == 0x07)) || (b0 == 0xcd && b1 == 0x80);
+}
+
+bool IsValid64BitInstruction(std::span<const std::uint8_t> code, std::size_t pos, const Codegen::DecodedInstructionInfo& info, VirtualAddress baseVAddr, VirtualAddress segmentVAddr, VirtualAddress segmentEnd) {
+    if (info.Length == 0 || info.Length > code.size() - pos) return false;
+    if (!info.IsTwoByteOpcode && IsInvalid64BitSingleByteOpcode(info.Opcode)) return false;
+    if (info.HasBranchTarget && !info.HasRipRelativeDisp) {
+        const auto target = static_cast<std::int64_t>(baseVAddr + pos + info.Length) + info.BranchDisp;
+        if (target < static_cast<std::int64_t>(segmentVAddr) || target >= static_cast<std::int64_t>(segmentEnd)) return false;
+    }
+    return true;
+}
+
+bool EndsControlFlow(const Codegen::DecodedInstructionInfo& info, bool isSyscall) {
+    return info.FlowKind == Codegen::ControlFlowKind::Return
+        || info.FlowKind == Codegen::ControlFlowKind::UnconditionalJump
+        || info.FlowKind == Codegen::ControlFlowKind::IndirectJump
+        || info.FlowKind == Codegen::ControlFlowKind::Trap || isSyscall;
+}
+
+class GapAnalysis {
+    enum class Trailing { Invalid, Padding, Terminator, NonTerminator };
+
+public:
+    GapAnalysis(std::span<const std::uint8_t> code, VirtualAddress baseVAddr, VirtualAddress segmentVAddr, VirtualAddress segmentEnd, const Codegen::X64InstructionDecoder& decoder)
+        : code(code), padding(code.size() + 1), trailing(code.size() + 1), syscalls(code.size() + 1) {
+        padding.back() = true;
+        trailing.back() = Trailing::Padding;
+        for (std::size_t end = code.size(); end != 0;) {
+            const auto pos = --end;
+            const bool bytePadding = code[pos] == 0x00 || code[pos] == 0xcc || code[pos] == 0x90;
+            if (bytePadding && padding[pos + 1]) {
+                padding[pos] = true;
+                trailing[pos] = Trailing::Padding;
+                continue;
+            }
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(code.data() + pos, code.size() - pos);
+            } catch (const Codegen::CodegenException&) {
+                continue;
+            }
+            if (info.Length == 0 || info.Length > code.size() - pos) continue;
+            const bool nop = IsNop(code, pos, info.Length);
+            if (nop && padding[pos + info.Length]) {
+                padding[pos] = true;
+                trailing[pos] = Trailing::Padding;
+                continue;
+            }
+            if (!IsValid64BitInstruction(code, pos, info, baseVAddr, segmentVAddr, segmentEnd)) continue;
+            const auto next = pos + info.Length;
+            const bool isSyscall = IsForbiddenSyscallInstruction(code, pos, info);
+            syscalls[pos] = isSyscall || syscalls[next];
+            if (!padding[next]) {
+                trailing[pos] = trailing[next];
+                continue;
+            }
+            trailing[pos] = nop || code[pos] == 0xcc || code[pos] == 0x00
+                ? Trailing::Padding
+                : (EndsControlFlow(info, isSyscall) ? Trailing::Terminator : Trailing::NonTerminator);
         }
     }
-    return false;
+
+    bool OnlyPadding(std::size_t from) const { return padding[from]; }
+
+    bool DecodesAsTrailingCodeBlock(std::size_t from, bool* outHasSyscall = nullptr) const {
+        if (outHasSyscall != nullptr) *outHasSyscall = false;
+        if (from >= code.size() || code[from] == 0x00 || code[from] == 0xcc || code[from] == 0x90) return false;
+        if (outHasSyscall != nullptr) *outHasSyscall = syscalls[from];
+        return trailing[from] == Trailing::Terminator;
+    }
+
+private:
+    std::span<const std::uint8_t> code;
+    std::vector<bool> padding;
+    std::vector<Trailing> trailing;
+    std::vector<bool> syscalls;
+};
+
+std::size_t FindEmbeddedDataTableEnd(std::span<const std::uint8_t> code, VirtualAddress tableVAddr, VirtualAddress segmentVAddr, VirtualAddress segmentEnd, const Codegen::X64InstructionDecoder& decoder) {
+    const GapAnalysis analysis(code, tableVAddr, segmentVAddr, segmentEnd, decoder);
+    std::optional<std::size_t> firstInvalidPos;
+    for (std::size_t pos = 0; pos < code.size();) {
+        if (analysis.OnlyPadding(pos)) break;
+        Codegen::DecodedInstructionInfo info;
+        try {
+            info = decoder.DecodeInstruction(code.data() + pos, code.size() - pos);
+        } catch (const Codegen::CodegenException&) {
+            firstInvalidPos = pos;
+            break;
+        }
+        if (!IsValid64BitInstruction(code, pos, info, tableVAddr, segmentVAddr, segmentEnd)) {
+            firstInvalidPos = pos;
+            break;
+        }
+        if (IsForbiddenSyscallInstruction(code, pos, info) || info.FlowKind != Codegen::ControlFlowKind::Sequential) return 0;
+        pos += info.Length;
+    }
+    if (!firstInvalidPos) return 0;
+    const bool duplicatedEightByteRow = code.size() >= 16 && std::memcmp(code.data(), code.data() + 8, 8) == 0;
+    if (*firstInvalidPos != 0 && (!duplicatedEightByteRow || *firstInvalidPos > 4)) return 0;
+
+    std::optional<std::size_t> firstDecodeFailure;
+    for (std::size_t pos = 0; pos < code.size();) {
+        if (analysis.OnlyPadding(pos)) break;
+        try {
+            const auto info = decoder.DecodeInstruction(code.data() + pos, code.size() - pos);
+            if (info.Length == 0 || info.Length > code.size() - pos) {
+                firstDecodeFailure = pos;
+                break;
+            }
+            if (IsForbiddenSyscallInstruction(code, pos, info)) return 0;
+            pos += info.Length;
+        } catch (const Codegen::CodegenException&) {
+            firstDecodeFailure = pos;
+            break;
+        }
+    }
+    if (!firstDecodeFailure) return 0;
+
+    for (std::size_t pos = *firstDecodeFailure + 1; pos < code.size();) {
+        if (code[pos] != 0xcc && code[pos] != 0x90 && code[pos] != 0x00) {
+            ++pos;
+            continue;
+        }
+        const auto padStart = pos;
+        bool hasZeroPad = false;
+        while (pos < code.size() && (code[pos] == 0xcc || code[pos] == 0x90 || code[pos] == 0x00)) {
+            if (code[pos] == 0x00) hasZeroPad = true;
+            ++pos;
+        }
+        if (pos < code.size() && analysis.DecodesAsTrailingCodeBlock(pos))
+            return hasZeroPad ? pos : padStart;
+    }
+    for (std::size_t pos = *firstDecodeFailure + 1; pos < code.size(); ++pos) {
+        bool hasSyscall = false;
+        if (analysis.DecodesAsTrailingCodeBlock(pos, &hasSyscall) && hasSyscall)
+            return pos;
+    }
+    return code.size();
 }
 
 }
@@ -237,8 +398,9 @@ std::vector<RelativeJumpTable> FindRelativeJumpTables(std::span<const std::uint8
         const auto it = branchTargets.lower_bound(tableVAddr);
         if (it != branchTargets.end() && *it < inspectEnd) continue;
         const auto tableCode = segment.subspan(tableVAddr - segmentVAddr, inspectEnd - tableVAddr);
-        if (!HasUndecodableBytes(tableCode, decoder)) continue;
-        tables.push_back({begin, tableVAddr, inspectEnd});
+        const auto tableSize = FindEmbeddedDataTableEnd(tableCode, tableVAddr, segmentVAddr, segmentEnd, decoder);
+        if (tableSize == 0) continue;
+        tables.push_back({begin, tableVAddr, tableVAddr + tableSize});
     }
     return tables;
 }
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 03311c2cd6..19401ad15d 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -420,6 +420,85 @@ void CheckEmbeddedDataTables() {
     };
     const auto tablesTransitive = Relinker::FindRelativeJumpTables(withTransitiveBranch, TextAddress, functionsTransitive);
     Require(tablesTransitive.empty(), "Transitive branch target was incorrectly recognized as a data table");
+
+    Bytes withTrailingCode(64, 0x90);
+    withTrailingCode[0] = 0x48;
+    withTrailingCode[1] = 0x8d;
+    withTrailingCode[2] = 0x05;
+    SetDisplacement(withTrailingCode, 3, 7, TextAddress + 16);
+    withTrailingCode[7] = 0xc3;
+    for (std::size_t i = 8; i < 16; ++i) withTrailingCode[i] = 0xcc;
+    withTrailingCode[16] = 0x0f;
+    withTrailingCode[17] = 0x78;
+    withTrailingCode[18] = 0x11;
+    withTrailingCode[19] = 0x22;
+    withTrailingCode[20] = 0x33;
+    withTrailingCode[21] = 0x44;
+    for (std::size_t i = 22; i < 32; ++i) withTrailingCode[i] = 0xcc;
+    withTrailingCode[32] = 0xb8;
+    withTrailingCode[33] = 0x3b;
+    withTrailingCode[34] = 0x00;
+    withTrailingCode[35] = 0x00;
+    withTrailingCode[36] = 0x00;
+    withTrailingCode[37] = 0x0f;
+    withTrailingCode[38] = 0x05;
+    withTrailingCode[39] = 0xc3;
+    for (std::size_t i = 40; i < withTrailingCode.size(); ++i) withTrailingCode[i] = 0x90;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsTrailing{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + withTrailingCode.size(), TextAddress + withTrailingCode.size() + 8}
+    };
+    const auto tablesTrailing = Relinker::FindRelativeJumpTables(withTrailingCode, TextAddress, functionsTrailing);
+    Require(tablesTrailing.size() == 1, "Expected one bounded data table before trailing code");
+    Require(tablesTrailing[0].Begin == TextAddress + 16 && tablesTrailing[0].End <= TextAddress + 32, "Mask overran into trailing code");
+
+    Bytes withCallbackSyscall(48, 0x90);
+    withCallbackSyscall[0] = 0x48;
+    withCallbackSyscall[1] = 0x8d;
+    withCallbackSyscall[2] = 0x05;
+    SetDisplacement(withCallbackSyscall, 3, 7, TextAddress + 16);
+    withCallbackSyscall[7] = 0xc3;
+    for (std::size_t i = 8; i < 16; ++i) withCallbackSyscall[i] = 0xcc;
+    withCallbackSyscall[16] = 0xb8;
+    withCallbackSyscall[17] = 0x3b;
+    withCallbackSyscall[18] = 0x00;
+    withCallbackSyscall[19] = 0x00;
+    withCallbackSyscall[20] = 0x00;
+    withCallbackSyscall[21] = 0x0f;
+    withCallbackSyscall[22] = 0x05;
+    withCallbackSyscall[23] = 0x0f;
+    withCallbackSyscall[24] = 0x78;
+    withCallbackSyscall[25] = 0x11;
+    withCallbackSyscall[26] = 0x22;
+    withCallbackSyscall[27] = 0x33;
+    withCallbackSyscall[28] = 0x44;
+    withCallbackSyscall[29] = 0xc3;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsCallback{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + withCallbackSyscall.size(), TextAddress + withCallbackSyscall.size() + 8}
+    };
+    const auto tablesCallback = Relinker::FindRelativeJumpTables(withCallbackSyscall, TextAddress, functionsCallback);
+    Require(tablesCallback.empty(), "Callback with syscall and undecodable tail was incorrectly recognized as a data table");
+
+    Bytes whirlpoolText(4224, 0x90);
+    whirlpoolText[0] = 0x48;
+    whirlpoolText[1] = 0x8d;
+    whirlpoolText[2] = 0x2d;
+    SetDisplacement(whirlpoolText, 3, 7, TextAddress + 32);
+    whirlpoolText[7] = 0xc3;
+    for (std::size_t i = 8; i < 32; ++i) whirlpoolText[i] = 0xcc;
+    static constexpr std::uint8_t whirlpoolPrefix[]{
+        0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8, 0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8,
+        0x0f, 0x78, 0x33, 0x1e
+    };
+    std::memcpy(whirlpoolText.data() + 32, whirlpoolPrefix, sizeof(whirlpoolPrefix));
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functionsWhirlpool{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + whirlpoolText.size(), TextAddress + whirlpoolText.size() + 8}
+    };
+    const auto tablesWhirlpool = Relinker::FindRelativeJumpTables(whirlpoolText, TextAddress, functionsWhirlpool);
+    Require(tablesWhirlpool.size() == 1, "Expected Whirlpool-style table to be recognized");
+    Require(tablesWhirlpool[0].Begin == TextAddress + 32, "Whirlpool table start was incorrect");
 }
 
 }
diff --git a/core/relinker/relinker/tests/test_sce_code_extent.py b/core/relinker/relinker/tests/test_sce_code_extent.py
index 4f2d786f68..2110d6d987 100644
--- a/core/relinker/relinker/tests/test_sce_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_code_extent.py
@@ -77,7 +77,7 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
 
     for begin, size in functions:
         image[begin:begin + size] = b"\xc3" + b"\x90" * (size - 1)
-    last_func = LATER_FUNCTION if gap_embedded_data else FUNCTION
+    last_func = LATER_FUNCTION if has_gap_embedded else FUNCTION
     image[last_func + FUNCTION_SIZE:plt] = b"\x90" * gap
     image[plt:plt + 2] = b"\xff\x35"
     struct.pack_into("<i", image, plt + 2, GOT + plt_push_offset - (plt + 6))
@@ -103,12 +103,21 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         image[entry:entry + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
     if function_tls:
         image[FUNCTION:FUNCTION + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
-    if gap_embedded_data:
+    if gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable:
         table = FUNCTION + FUNCTION_SIZE + 0x10
         image[FUNCTION:FUNCTION + 3] = b"\x48\x8d\x05"
         struct.pack_into("<iB", image, FUNCTION + 3, table - (FUNCTION + 7), 0xC3)
         image[FUNCTION + FUNCTION_SIZE:table] = b"\xcc" * 0x10
-        image[table:LATER_FUNCTION] = b"\x0f\x78\x33\x1e" * ((LATER_FUNCTION - table) // 4)
+        if gap_data_then_syscall:
+            image[table:table + 6] = b"\x0f\x78\x11\x22\x33\x44"
+            image[table + 6:table + 16] = b"\xcc" * 10
+            image[table + 16:table + 24] = b"\xb8\x3b\x00\x00\x00\x0f\x05\xc3"
+            image[table + 24:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 24))
+        elif gap_callback_syscall_undecodable:
+            image[table:table + 14] = b"\xb8\x3b\x00\x00\x00\x0f\x05\x0f\x78\x11\x22\x33\x44\xc3"
+            image[table + 14:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 14))
+        else:
+            image[table:LATER_FUNCTION] = b"\x0f\x78\x33\x1e" * ((LATER_FUNCTION - table) // 4)
         image[data:data + 0x30] = b"\x90" * 0x30
 
     cie = EH_FRAME
@@ -229,6 +238,12 @@ def main():
                 "Unsupported " + ("Windows" if target == "windows" else "macOS") + " guest TLS instruction", target)
             run(relinker, work, "sce-gap-embedded-data-" + target,
                 fixture(sce_block=True, gap_embedded_data=True), target=target)
+            run(relinker, work, "sysv-gap-embedded-data-" + target,
+                fixture(sce_block=False, gap_embedded_data=True), target=target)
+            run(relinker, work, "gap-data-then-syscall-" + target,
+                fixture(sce_block=False, gap_data_then_syscall=True), "Forbidden syscall instruction", target=target)
+            run(relinker, work, "gap-callback-syscall-" + target,
+                fixture(sce_block=False, gap_callback_syscall_undecodable=True), "Forbidden syscall instruction", target=target)
         run(relinker, work, "sce-tls-rewrite-over-lea-target", entry_overlap_fixture(),
             "TLS rewrite would overwrite an executable entry point (offset 0x304)")
     print("SCE code extent tests passed")
diff --git a/core/relinker/relinker/tests/test_sce_module_code_extent.py b/core/relinker/relinker/tests/test_sce_module_code_extent.py
index 9395a04db3..17a8bc8a00 100644
--- a/core/relinker/relinker/tests/test_sce_module_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_module_code_extent.py
@@ -100,15 +100,30 @@ def unwind_table(text, base, function, size, header, frame):
                      frame - (header + 4), 1, function - header, fde - header)
 
 
-def sce_module():
+def unwind_table_multiple(text, base, functions, header, frame):
+    cie_body = b"\x00\x00\x00\x00\x01zR\x00\x01\x78\x10\x01\x1b\x00\x00\x00"
+    struct.pack_into("<I", text, frame - base, len(cie_body))
+    text[frame - base + 4:frame - base + 4 + len(cie_body)] = cie_body
+    fde = frame + 4 + len(cie_body)
+    struct.pack_into("<BBBBiI", text, header - base, 1, 0x1B, 0x03, 0x3B,
+                     frame - (header + 4), len(functions))
+    for index, (func_addr, func_size) in enumerate(functions):
+        struct.pack_into("<IIiiB3x", text, fde - base, 16, fde + 4 - frame, func_addr - (fde + 8), func_size, 0)
+        struct.pack_into("<ii", text, header - base + 12 + index * 8, func_addr - header, fde - header)
+        fde += 20
+    struct.pack_into("<I", text, fde - base, 0)
+
+
+def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False):
     image = bytearray(0xC00)
     tags = [(0x61000035, 0), (0x61000037, 1), (0x61000039, 0x20), (0x6100003B, 24), (0x6100003F, 24), (0, 0)]
+    has_gap = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable
     headers = [
         (PT_LOAD, 5, 0x400, 0x1000, 0x100, 0x100, 0x100),
         (PT_LOAD, 6, 0x600, 0x2000, 0x400, 0x400, 0x100),
         (PT_DYNAMIC, 6, 0x600, 0x2000, len(tags) * 16, len(tags) * 16, 8),
         (PT_SCE_DYNLIBDATA, 4, 0xA00, 0, 0x200, 0, 0x10),
-        (PT_GNU_EH_FRAME, 4, 0x480, 0x1080, 20, 20, 4),
+        (PT_GNU_EH_FRAME, 4, 0x480, 0x1080, 48 if has_gap else 20, 48 if has_gap else 20, 4),
     ]
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16, 3, 62, 1, 0x1000, 64, 0, 0, 64, 56, len(headers), 64, 0, 0)
@@ -117,21 +132,41 @@ def sce_module():
     for index, tag in enumerate(tags):
         struct.pack_into("<qQ", image, 0x600 + index * 16, *tag)
     text = memoryview(image)[0x400:0x500]
-    text[0:FUNCTION_SIZE] = b"\xc3" + b"\x90" * (FUNCTION_SIZE - 1)
-    text[0x20:0x22] = b"\x0f\x05"
-    unwind_table(text, 0x1000, 0x1000, FUNCTION_SIZE, 0x1080, 0x10A0)
+    if has_gap:
+        text[0:8] = b"\x48\x8d\x05\x19\x00\x00\x00\xc3"
+        table = 0x20
+        if gap_data_then_syscall:
+            text[table:table + 6] = b"\x0f\x78\x11\x22\x33\x44"
+            text[table + 6:table + 16] = b"\xcc" * 10
+            text[table + 16:table + 24] = b"\xb8\x3b\x00\x00\x00\x0f\x05\xc3"
+            text[table + 24:0x40] = b"\x90" * 8
+        elif gap_callback_syscall_undecodable:
+            text[table:table + 14] = b"\xb8\x3b\x00\x00\x00\x0f\x05\x0f\x78\x11\x22\x33\x44\xc3"
+            text[table + 14:0x40] = b"\x90" * 18
+        else:
+            text[table:0x40] = b"\x0f\x78\x33\x1e" * 8
+        text[0x40:0x48] = b"\xc3" + b"\x90" * 7
+        unwind_table_multiple(text, 0x1000, [(0x1000, 8), (0x1040, 8)], 0x1080, 0x10A0)
+    else:
+        text[0:FUNCTION_SIZE] = b"\xc3" + b"\x90" * (FUNCTION_SIZE - 1)
+        text[0x20:0x22] = b"\x0f\x05"
+        unwind_table(text, 0x1000, 0x1000, FUNCTION_SIZE, 0x1080, 0x10A0)
     return image
 
 
-def run_module(relinker, work, name, module, flags):
+def run_module(relinker, work, name, module, flags, expected_error=None):
     case = work / name
     (case / "sce_module").mkdir(parents=True)
     (case / "input.elf").write_bytes(importing_executable([]))
     (case / "sce_module" / "libExample.prx").write_bytes(module)
     result = subprocess.run([str(relinker), *flags, str(case / "input.elf"), str(case / "output.exe")],
                             capture_output=True, text=True, timeout=30)
-    assert result.returncode == 0 and (case / "app0" / "sce_module" / "libExample.prx.guest.prx").exists(), (
-        name, result.stdout, result.stderr)
+    if expected_error is None:
+        assert result.returncode == 0 and (case / "app0" / "sce_module" / "libExample.prx.guest.prx").exists(), (
+            name, result.stdout, result.stderr)
+    else:
+        assert result.returncode == 2 and expected_error in result.stderr, (
+            name, result.returncode, result.stdout, result.stderr)
 
 
 def run(relinker, work, name, image, flags, expected_error=None):
@@ -154,6 +189,9 @@ def main():
         for system, flags in (("linux", []), ("windows", ["--windows"]), ("macos", ["--macos"])):
             run(relinker, work, "sce-loader-path-without-interp-header-" + system, fixture(rodata_address=False, interp_header=False), flags)
             run_module(relinker, work, "sce-module-data-after-code-" + system, sce_module(), flags)
+            run_module(relinker, work, "sce-module-gap-embedded-data-" + system, sce_module(gap_embedded_data=True), flags)
+            run_module(relinker, work, "sce-module-gap-data-then-syscall-" + system, sce_module(gap_data_then_syscall=True), flags, "Forbidden syscall instruction")
+            run_module(relinker, work, "sce-module-gap-callback-syscall-" + system, sce_module(gap_callback_syscall_undecodable=True), flags, "Forbidden syscall instruction")
     print("SCE module code extent tests passed")
 
 
diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md
index 78d64511cb..c8669dbfc5 100644
--- a/docs/dev/debt/relinker.md
+++ b/docs/dev/debt/relinker.md
@@ -30,7 +30,7 @@
 - In the same executables and modules, the bytes between unwind functions are 16-byte slots of function tails and padding, and a tail can begin inside an instruction. The [instruction scanner](../../../core/relinker/codegen/src/InstructionScanner.cpp) of the syscall and call-site scans therefore resumes at the next byte when bytes outside every unwind function do not decode, and ends a decoding outside them at the start of the next unwind function. Code without an unwind entry that does not decode from its first byte is skipped by these scans instead of failing the relink; inside an unwind function a decode failure still fails it.
 - Read-only data can also sit between the unwind functions of such images. There, a `syscall`, `sysenter` or `int 0x80` pattern fails the [syscall scan](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) only when a constant syscall number is set before it; the others, and every `sysret`, are skipped and counted in one message. The number is looked for in the decoded instructions and, whatever alignment the decoding took, in the bytes before the pattern: a `mov eax, imm32`, `mov rax, imm32`, `mov rax, imm64` or `xor eax, eax`, optionally followed by `mov al, imm8` or `mov ax, imm16`, then by any number of register moves or zeroings that leave `rax` alone. A real syscall without an unwind entry whose number is set otherwise is not refused and runs on the host: from memory or another register (`mov eax, ecx`), by `push`/`pop` or arithmetic (`or eax, imm32`), or with any other instruction between the load and the pattern.
 - In the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs for such images, a relocation or `lea` target outside every unwind function is followed as code only when its linear decoding, up to the first jump, return or trap, the next unwind function or 256 instructions, holds an `fs:[disp32]` access, or when it is 16-byte aligned, starts less than 256 bytes after an unwind function and ends in a jump, return or trap. Every other such target is taken as data and counted in one message, and the Windows TLS rewrite fails instead of overwriting one. A TLS access of another form, such as `mov rax, fs:[rax]`, or a `gs` instruction in code reached only through such a target is therefore not rewritten or trapped. Other fs and gs instructions do not tell code from data there: string bytes decode as these prefixes, and in two measured titles about 2,500 of about 5,500 such targets decode to one before their first jump.
-- [Embedded data tables and relative jump tables in inter-FDE gaps](../../../core/relinker/relinker/src/analysis/RelativeJumpTables.cpp) - in modules with unwind records (`PT_GNU_EH_FRAME` or `PT_SCE_DYNLIBDATA`), constant data tables referenced by RIP-relative `LEA` containing undecodable bytes and trailing jump tables in inter-FDE gaps are masked with `0x90` in the scan buffer before syscall scanning and excluded from code roots and control-flow analysis in [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp), avoiding illegal opcode rejections on embedded data such as `0F 78` in `ubiservices.prx` (The Rogue Prince of Persia, PPSA28155, #7547). Gaps with direct branch targets (`CALL`, `JMP`, `Jcc`) or valid instructions are preserved as code and undergo strict scanning. Underlying bytes in `image.Bytes` remain unmodified except for syscall traps.
+- [Embedded data tables and relative jump tables in inter-FDE gaps](../../../core/relinker/relinker/src/analysis/RelativeJumpTables.cpp) - in modules with unwind records (`PT_GNU_EH_FRAME` or `PT_SCE_DYNLIBDATA`), constant data tables referenced by a RIP-relative `LEA` that hold undecodable bytes, and trailing relative jump tables, are masked with `0x90` in the scan buffer before syscall scanning and kept out of the code roots of [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp), so embedded data such as `0F 78` in `ubiservices.prx` (The Rogue Prince of Persia, PPSA28155, #7547) is no longer refused as an illegal opcode. The masked range of a table starts at the candidate `LEA` target and stops at the first byte whose linear decoding reaches a jump, return or trap, so gap bytes that are code keep being scanned, such as a callback reached through `lea` or a routine that contains a syscall, and so does a gap that a direct branch targets. The bytes from the end of a function to the candidate table must be padding only, and a gap whose bytes decode as valid instructions is left alone. The per-byte padding, trailing-code and syscall properties of a gap are computed once in a backward pass, so the analysis stays linear in the size of the gap. The bytes written to the output are unchanged apart from syscall traps.
 - In executables and guest modules with a `PT_SCE_DYNLIBDATA` segment, the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs follows code only from the end of `PT_INTERP`, or of the `/libexec/ld-elf.so.1` string that begins the segment when no `PT_INTERP` covers it, as in OpenOrbis modules, to the end of the PLT after the last function of the unwind table, or to the end of that function when the PLT comes before the code, as in the `libSceFios2.prx` and `libc.prx` that CUSA02636 bundles (PLT at 0xc8); the pipeline's scans of executables above stop at this same end, also when the PLT comes before the code. A guest module with PLT relocations and no PLT before or after its unwind functions, or with a PLT that overlaps one, fails as the executable does. Code after that end is not analyzed, such as the `DT_FINI` routine without an unwind entry that follows the last unwind function in both modules and that the Windows and macOS outputs call when the program exits: a TLS access in it is not rewritten, the ELF entry point, `DT_INIT`, `DT_FINI`, a branch or a pointer into it is ignored, and a function symbol or init/fini array entry pointing into it fails the conversion.
 - Under Rosetta (M5, macOS 27.0.1), a VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store or load that faults on an element other than an active first one ends the process (`unexpectedly need to EmulateForward on a synchronous exception`) instead of raising SIGSEGV or SIGBUS, so a masked store into a page the macOS write watch keeps read-only ends the title. `--to-rosetta` moves each masked store to a [stub](../../../core/relinker/codegen/src/x86/MaskedStoreLowering.cpp) that first writes to the first and last byte of every active element with `LOCK OR` of 0, which faults normally and changes nothing; each store then costs up to 16 locked byte writes. A page made read-only again by another thread between those writes and the store still ends the process. A stack-relative displacement that exceeds signed disp32 after the spill frame throws. Masked loads are not converted.
 - A relocation against a dynamic symbol entry that is all zero, like the null symbol, takes the value 0 plus its addend, as the gABI defines for `STN_UNDEF` ([pipeline](../../../core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp)). The Linux output imports such an entry as an unnamed weak symbol, which the host loader resolves to 0; the Windows and macOS outputs write the value into the slot ([relocation builder](../../../core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp)). What the console's loader does with such an entry is not measured. OliSe Player (PPSA01153) has seven of them, and its code calls through those slots only when they are not 0 ([#4437](https://github.com/boykopovar/AnyPS5/issues/4437)).

From b7c91d33721a75221fdfa54bbb4691b08e65cf6e Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 10:30:46 +1300
Subject: [PATCH 181/218] fix(libSceVideoOut): declare the sized color wrappers
 once in VideoOut.hpp

---
 core/libs/prx/libSceVideoOut/include/Output.hpp | 2 --
 core/libs/prx/libSceVideoOut/tests/Flip.cpp     | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceVideoOut/include/Output.hpp b/core/libs/prx/libSceVideoOut/include/Output.hpp
index f4c0e74aa2..caebc2514a 100644
--- a/core/libs/prx/libSceVideoOut/include/Output.hpp
+++ b/core/libs/prx/libSceVideoOut/include/Output.hpp
@@ -27,8 +27,6 @@ int APS5_VABI sceVideoOutLatencyControlWaitBeforeInput(int handle);
 int APS5_VABI sceVideoOutLatencyMeasureSetStartPoint(int handle, uint32_t point);
 int APS5_VABI sceVideoOutColorSettingsSetGamma(VideoOutColorSettings* settings, float gamma);
 int APS5_VABI sceVideoOutAdjustColor(int handle, const VideoOutColorSettings* settings);
-int APS5_VABI sceVideoOutColorSettingsSetGamma_(VideoOutColorSettings* settings, float gamma, uint32_t settings_size);
-int APS5_VABI sceVideoOutAdjustColor_(int handle, const VideoOutColorSettings* settings, uint32_t settings_size);
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetDefaultSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings);
 int APS5_VABI sceVideoOutColorSpaceConversionSettingsSetSdrToHdrConversion(VideoOutColorSpaceConversionSettings* settings, float lumaScale, uint32_t option);
 int APS5_VABI sceVideoOutAdjustColorSpaceConversion(int handle, const VideoOutColorSpaceConversionSettings* settings);
diff --git a/core/libs/prx/libSceVideoOut/tests/Flip.cpp b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
index 0b30de6e98..e7ce91e7b8 100644
--- a/core/libs/prx/libSceVideoOut/tests/Flip.cpp
+++ b/core/libs/prx/libSceVideoOut/tests/Flip.cpp
@@ -2,6 +2,7 @@
 #include "prx/libSceVideoOut/include/VideoOutDriver.hpp"
 #include "prx/libSceVideoOut/include/Buffer.hpp"
 #include "prx/libSceVideoOut/include/Output.hpp"
+#include "prx/libSceVideoOut/include/VideoOut.hpp"
 #include "prx/libSceVideoOut/include/Event.hpp"
 #include "prx/libkernel/Equeue/Equeue.hpp"
 #include "prx/libSceAgcDriver/Execution/include/Driver.hpp"

From ada20294a6ac6b6c56a53b969ca9a72b298e7c1d Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Sun, 25 Oct 2026 21:49:58 +0100
Subject: [PATCH 182/218] fix(agc): read a frame capture's memory delta once
 the accepted submissions completed

A delta read its blocks with ReadCommittedUnsynced while GPU work
accepted before the call could still write them, so a capture could
hold a block from before a DMA copy that the replay then wrote back over
the copy's result. A delta with blocks to read now waits up to 10 s for
the accepted submissions and records the serials after the wait; the
capture stops with a warning when the work does not finish. The Windows
quarantine of agc_driver_frame_replay is removed.

Fixes #10711

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceAgcDriver/CMakeLists.txt  |  3 +-
 .../Execution/include/FrameRecorder.hpp       |  1 +
 .../Execution/src/FrameRecorder.cpp           | 42 ++++++++++++-------
 docs/dev/BUILD.md                             |  2 +-
 docs/dev/debt/libSceAgcDriver.md              |  3 +-
 5 files changed, 32 insertions(+), 19 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index 0b65806855..bb3fa5e95b 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -3465,8 +3465,7 @@ if(BUILD_TESTING)
         endif()
     endforeach()
 
-    option(ANYPS5_RUN_QUARANTINED_FRAME_REPLAY "Build and register agc_driver_frame_replay on Windows" OFF)
-    if(WIN32 AND ANYPS5_RUN_QUARANTINED_FRAME_REPLAY)
+    if(WIN32)
         add_test_executable(agc_driver_frame_replay_tests tests/FrameReplay.cpp Execution/src/FrameCapture.cpp)
         target_include_directories(agc_driver_frame_replay_tests PRIVATE ${LIBS_INCLUDE_DIR})
         target_link_libraries(agc_driver_frame_replay_tests PRIVATE libSceAgc libSceAgcDriver libkernel libc libzstd_static)
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
index bad806af09..b899f1b51c 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
@@ -72,6 +72,7 @@ private:
     void snapshot(const Range& range);
     void writeReferenceFrames();
     bool abandonIfDiskLow();
+    void stop(const char* reason);
     std::string header() const;
     std::vector<Range> committedRanges();
     std::vector<Range> newRanges();
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
index 8d34708b90..7dc3f02253 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
@@ -360,10 +360,23 @@ void FrameRecorder::emitShaderDelta(std::span<const Shader* const> shaders) {
 
 void FrameRecorder::writeDelta(std::span<const Span> spans, std::span<const std::uint64_t> hostPages, std::span<const Range> added) {
     if (abandonIfDiskLow()) return;
-    const auto [accepted, completed] = DriverDetail::Driver::Get().SerialProgress();
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> blocks;
+    std::vector<std::pair<std::uint64_t, std::uint64_t>> written;
+    for (const auto& span : spans) {
+        GuestMemory::CollectWrittenBlocks(span.address, static_cast<std::size_t>(span.bytes), span.since, written);
+        blocks.insert(blocks.end(), written.begin(), written.end());
+    }
+    auto& driver = DriverDetail::Driver::Get();
+    auto [accepted, completed] = driver.SerialProgress();
+    if (completed < accepted && (!added.empty() || !blocks.empty())) {
+        if (!driver.WaitIdleFor(std::chrono::seconds(10))) {
+            stop("stopped: the GPU work submitted before a memory delta did not finish within 10 s");
+            return;
+        }
+        std::tie(accepted, completed) = driver.SerialProgress();
+    }
     const auto group = deltaGroups + 1;
     bool any = false;
-    std::vector<std::pair<std::uint64_t, std::uint64_t>> written;
     std::vector<std::byte> bytes;
     for (const auto& range : added) {
         writer->WriteRange(range.address, range.bytes, range.kind, range.protection, range.access);
@@ -397,15 +410,12 @@ void FrameRecorder::writeDelta(std::span<const Span> spans, std::span<const std:
         deltaBytes += bytes.size();
         any = true;
     }
-    for (const auto& span : spans) {
-        GuestMemory::CollectWrittenBlocks(span.address, static_cast<std::size_t>(span.bytes), span.since, written);
-        for (const auto& [begin, end] : written) {
-            bytes.resize(static_cast<std::size_t>(end - begin));
-            GuestMemory::ReadCommittedUnsynced(begin, bytes);
-            writer->WriteDelta(group, completed, begin, bytes);
-            deltaBytes += bytes.size();
-            any = true;
-        }
+    for (const auto& [begin, end] : blocks) {
+        bytes.resize(static_cast<std::size_t>(end - begin));
+        GuestMemory::ReadCommittedUnsynced(begin, bytes);
+        writer->WriteDelta(group, completed, begin, bytes);
+        deltaBytes += bytes.size();
+        any = true;
     }
     if (!any) return;
     deltaGroups = group;
@@ -436,8 +446,13 @@ bool FrameRecorder::abandonIfDiskLow() {
     std::error_code error;
     const auto space = std::filesystem::space(directory, error);
     if (error || space.available >= MinimumFreeBytes) return false;
-    warnings.push_back("stopped: less than 4 GiB free on the capture volume");
-    std::fprintf(stderr, "[frame-capture] stopped: less than 4 GiB free on the capture volume\n");
+    stop("stopped: less than 4 GiB free on the capture volume");
+    return true;
+}
+
+void FrameRecorder::stop(const char* reason) {
+    warnings.push_back(reason);
+    std::fprintf(stderr, "[frame-capture] %s\n", reason);
     try {
         writer->Finish(header());
     } catch (const std::exception& failure) {
@@ -445,7 +460,6 @@ bool FrameRecorder::abandonIfDiskLow() {
     }
     writer.reset();
     state = State::Done;
-    return true;
 }
 
 void FrameRecorder::start() {
diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md
index dfef62f9b1..71536bb86e 100644
--- a/docs/dev/BUILD.md
+++ b/docs/dev/BUILD.md
@@ -195,7 +195,7 @@ On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched`
 
 ## Frame capture and replay
 
-Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps); an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk.
+Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps), read once the submissions already accepted have completed; an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk.
 
 `agc_frame_replay <capture> [--no-pace] [--no-release] [--release-after-ms <n>] [--no-synthesize] [--strict] [--dump <address>:<bytes>:<file>]... [--frames <dir>]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers.
 
diff --git a/docs/dev/debt/libSceAgcDriver.md b/docs/dev/debt/libSceAgcDriver.md
index 3337ced18c..e3b353683e 100644
--- a/docs/dev/debt/libSceAgcDriver.md
+++ b/docs/dev/debt/libSceAgcDriver.md
@@ -71,8 +71,7 @@
 ### Functional
 
 - [Written staging window on discrete GPUs](../../../core/libs/prx/libSceAgcDriver/Graphics/src/GuestBufferMemory.cpp) (libSceAgcDriver) - a written buffer element of a dispatch that is not swept is staged device-local up to 8 MiB on a discrete GPU (`Context::discreteGpu`) and up to 2 MiB otherwise; `APS5_WRITTEN_SHADOW_MAX_KIB` replaces either bound. The 8 MiB figure comes from one title on one NVIDIA Windows system (PPSA09911: a 2.5 and a 3.3 MiB skin-cache output written in place cost 55 ms of GPU time per frame, 1.8 ms of extra staging copies once staged); the point where the two copies of a larger element cost more than its in-place stores, and whether AMD or Linux drivers move it, has not been measured. The window is per element and per use, so a kernel that streams once through an element inside the window pays the copy-in and the copy-back on every dispatch.
-- [Frame capture](../../../core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp) (libSceAgcDriver) records guest memory on Windows only (a VirtualQuery walk of the registry allocations and the Windows write tracker); elsewhere a capture throws when it starts. Ranges are captured by allocation and protection, not by mapping: section views, aliases of one direct memory block and file views are snapshotted and replayed as separate private memory, so a store through one alias is not seen through another, and CPU stores to them during the captured frames are not recorded (only write-watched private memory is). Pages of the title's image are recorded during the frames only when a shader header or an array it points to lies in them and their content changed. A capture starts only at a frame boundary where the driver goes idle within 10 s, and gives up after five boundaries that do not.
-- [agc_driver_frame_replay](../../../core/libs/prx/libSceAgcDriver/CMakeLists.txt) (libSceAgcDriver) is neither built nor registered on Windows until the recorder fix for [#10711](https://github.com/boykopovar/AnyPS5/issues/10711) lands: the recorder reads a delta block with `ReadCommittedUnsynced` while the second DMA copy into it is still in flight, so the capture can hold zeros for that block and the replay does not reproduce the second copy. Configure with `-DANYPS5_RUN_QUARANTINED_FRAME_REPLAY=ON` to build and register it; Linux is unaffected, as the test only exists on Windows.
+- [Frame capture](../../../core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp) (libSceAgcDriver) records guest memory on Windows only (a VirtualQuery walk of the registry allocations and the Windows write tracker); elsewhere a capture throws when it starts. Ranges are captured by allocation and protection, not by mapping: section views, aliases of one direct memory block and file views are snapshotted and replayed as separate private memory, so a store through one alias is not seen through another, and CPU stores to them during the captured frames are not recorded (only write-watched private memory is). Pages of the title's image are recorded during the frames only when a shader header or an array it points to lies in them and their content changed. A capture starts only at a frame boundary where the driver goes idle within 10 s, and gives up after five boundaries that do not. A capture also stops when GPU work in flight at a delta waits on a later CPU store.
 - [Frame replay](../../../core/libs/prx/libSceAgcDriver/tools/FrameReplay.cpp) (libSceAgcDriver) orders the calls of different captured threads only by their start (a call starts once every earlier call has started), so the driver sees a schedule the title could have produced, not necessarily the one it did. CPU stores a title made from threads that never call the driver are known only by the next recorded call, so the replay applies them early or late when a GPU wait needs them and derives a value from the wait's reference when no recorded store satisfies it (`of_them_synthesized`). Pacing compares the number of submissions in flight, not what they hold. Prologue registrations of shaders whose memory the title reused after registering them fail and are counted (`stale_registrations`). The title's image range must be free in the replaying process, so the tool is linked at a high image base on Windows.
 - [Workgroup count split](../../../core/libs/prx/libSceAgcDriver/Execution/src/VulkanDevice.cpp) (libSceAgcDriver) - a direct dispatch over `maxComputeWorkGroupCount` runs as `vkCmdDispatch` chunks, each bound to a pipeline variant whose workgroup offset specialization constants add the chunk's base to `WorkgroupId` and `GlobalInvocationId`. A variant is built when its chunk base is first recorded, not when the dispatch is prepared. A split of a shader with device-memory LDS throws: its slot base reads the chunk's `NumWorkgroups`, not the dispatch's. Chunks are ordered by a compute barrier, which the console does not have between workgroups of one dispatch.
 - [Experimental submission progress](../../../core/libs/prx/libSceAgcDriver/Execution/include/Driver/Queues/SubmissionProgress.hpp) (AGC driver) - the opt-in two-millisecond pacing budget is not derived from console hardware. Cross-title performance remains unvalidated; host scheduling can overshoot the timeout and pacing can reduce CPU/GPU overlap.

From e27a9d3e01e51eb1cc549ba80ba1b2f1b356c83a Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 10:37:03 +1300
Subject: [PATCH 183/218] test: restore the function layout of the rosetta
 in-place execution tests

---
 core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
index 4e2707665d..998fc11443 100644
--- a/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
+++ b/core/relinker/codegen/tests/Amd64OnlyConverterTests.cpp
@@ -2120,6 +2120,7 @@ void scalarCompareExecution() {
     }
     munmap(code, 4096);
 }
+
 void rdpidExecution() {
     const auto matcher = Codegen::MakeAmd64OnlyInstructionMatcher(Codegen::Amd64OnlyTarget::Rosetta);
     const Bytes site = {0xF3, 0x0F, 0xC7, 0xF8};
@@ -2204,7 +2205,6 @@ void clwbExecution() {
     require(kept == 0x5A5A5A5A5A5A5A5Aull, "CLWB replacement changed an unrelated register");
     require(carry == 1, "CLWB replacement changed the flags");
 }
-}
 #else
 void reciprocalExecution() {}
 void registerFormExecution() {}

From 56718b3314834c2507c4e5e2b5966c99068e5bb6 Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Sun, 25 Oct 2026 23:44:07 +0200
Subject: [PATCH 184/218] fix(relinker): keep non-SCE scans strict while
 masking gap tables

Read the unwind functions of an image that only has PT_GNU_EH_FRAME so
inter-FDE data tables are still found and masked, but leave the syscall
and call-site scan ranges empty without PT_SCE_DYNLIBDATA as main does.
The fixture now emits standard dynamic tags for its SysV block, and the
debt entry stays within the 1000 character limit.
---
 .../relinker/src/guest/GuestModuleBuilder.cpp        |  2 +-
 .../relinker/src/pipeline/RelinkerPipeline.cpp       | 12 ++++++------
 core/relinker/relinker/tests/test_sce_code_extent.py |  8 ++++----
 docs/dev/debt/relinker.md                            |  2 +-
 4 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
index 0569a3eda2..26866a48a3 100644
--- a/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
+++ b/core/relinker/relinker/src/guest/GuestModuleBuilder.cpp
@@ -414,7 +414,7 @@ std::vector<GuestArtifact> GuestModuleBuilder::Build(const std::filesystem::path
                     std::fill(scanCode.begin() + static_cast<std::ptrdiff_t>(maskBegin), scanCode.begin() + static_cast<std::ptrdiff_t>(maskEnd), std::uint8_t{0x90});
                 }
             }
-            const auto scanUnwindRanges = hasEhFrame ? SceUnwindRanges(code, header.MappedAddress, unwindFunctions) : std::vector<CodeRange>{};
+            const auto scanUnwindRanges = sceImage ? SceUnwindRanges(code, header.MappedAddress, unwindFunctions) : std::vector<CodeRange>{};
             for (const auto offset : syscallScanner.ScanCodeSectionForSyscalls(scanCode, header.MappedAddress, scanCode.size(), Io::Utf8Path(image.SourcePath), scanUnwindRanges)) {
                 if (offset > code.size() || code.size() - offset < 2u)
                     throw Domain::RelinkerException("Syscall trap patch exceeds guest executable segment", header.MappedAddress + offset);
diff --git a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
index 6ca097d65d..977560a934 100644
--- a/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
+++ b/core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp
@@ -399,14 +399,14 @@ RelinkResult RelinkerPipeline::Relink() {
         const auto functions = UnusedNidFilter::ReadExceptionFunctions(raw, programHeaders, {}, {});
         for (const auto& function : functions) unwindRanges.emplace_back(function.Begin, function.End);
         std::sort(unwindRanges.begin(), unwindRanges.end());
-        for (std::size_t index = 0; index < executableSegments.size(); ++index) {
-            auto& [segment, segmentVAddr, segmentFileOffset] = executableSegments[index];
-            static_cast<void>(segmentFileOffset);
-            if (sceImage)
+        if (sceImage)
+            for (std::size_t index = 0; index < executableSegments.size(); ++index) {
+                auto& [segment, segmentVAddr, segmentFileOffset] = executableSegments[index];
+                static_cast<void>(segmentFileOffset);
                 if (const auto codeEnd = FindSceCodeEnd(segment, segmentVAddr, functions, gotVAddr, dynJmpRelSize))
                     segment.resize(*codeEnd - segmentVAddr);
-            segmentUnwindRanges[index] = SceUnwindRanges(segment, segmentVAddr, functions);
-        }
+                segmentUnwindRanges[index] = SceUnwindRanges(segment, segmentVAddr, functions);
+            }
     }
 
     std::vector<std::vector<std::uint8_t>> scanSegments;
diff --git a/core/relinker/relinker/tests/test_sce_code_extent.py b/core/relinker/relinker/tests/test_sce_code_extent.py
index 2110d6d987..2f13121709 100644
--- a/core/relinker/relinker/tests/test_sce_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_code_extent.py
@@ -48,10 +48,10 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
     struct.pack_into("<HHIQQQIHHHHHH", image, 16, 3, 62, 1, entry, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
     tags = [
         (1, 1),
-        (0x61000035, 0x600), (0x61000037, 16),
-        (0x61000039, 0x620), (0x6100003B, 24), (0x6100003F, 48),
-        (0x6100002F, 0x700), (0x61000031, 24 if interpreter_pointer or pointer_target is not None else 0), (0x61000033, 24),
-        (0x61000027, GOT), (0x61000029, 0x720), (0x6100002B, 7), (0x6100002D, 24),
+        (0x61000035 if sce_block else 5, 0x600), (0x61000037 if sce_block else 10, 16),
+        (0x61000039 if sce_block else 6, 0x620), (0x6100003B if sce_block else 11, 24), (0x6100003F, 48),
+        (0x6100002F if sce_block else 7, 0x700), (0x61000031 if sce_block else 8, 24 if interpreter_pointer or pointer_target is not None else 0), (0x61000033 if sce_block else 9, 24),
+        (0x61000027 if sce_block else 3, GOT), (0x61000029 if sce_block else 23, 0x720), (0x6100002B, 7), (0x6100002D if sce_block else 2, 24),
         (0, 0),
     ]
     struct.pack_into("<IIQQQQQQ", image, 64, PT_LOAD, 7, 0, 0, 0, len(image), len(image), 0x1000)
diff --git a/docs/dev/debt/relinker.md b/docs/dev/debt/relinker.md
index c8669dbfc5..ac8f37fff9 100644
--- a/docs/dev/debt/relinker.md
+++ b/docs/dev/debt/relinker.md
@@ -30,7 +30,7 @@
 - In the same executables and modules, the bytes between unwind functions are 16-byte slots of function tails and padding, and a tail can begin inside an instruction. The [instruction scanner](../../../core/relinker/codegen/src/InstructionScanner.cpp) of the syscall and call-site scans therefore resumes at the next byte when bytes outside every unwind function do not decode, and ends a decoding outside them at the start of the next unwind function. Code without an unwind entry that does not decode from its first byte is skipped by these scans instead of failing the relink; inside an unwind function a decode failure still fails it.
 - Read-only data can also sit between the unwind functions of such images. There, a `syscall`, `sysenter` or `int 0x80` pattern fails the [syscall scan](../../../core/relinker/relinker/src/analysis/SyscallScanner.cpp) only when a constant syscall number is set before it; the others, and every `sysret`, are skipped and counted in one message. The number is looked for in the decoded instructions and, whatever alignment the decoding took, in the bytes before the pattern: a `mov eax, imm32`, `mov rax, imm32`, `mov rax, imm64` or `xor eax, eax`, optionally followed by `mov al, imm8` or `mov ax, imm16`, then by any number of register moves or zeroings that leave `rax` alone. A real syscall without an unwind entry whose number is set otherwise is not refused and runs on the host: from memory or another register (`mov eax, ecx`), by `push`/`pop` or arithmetic (`or eax, imm32`), or with any other instruction between the load and the pattern.
 - In the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs for such images, a relocation or `lea` target outside every unwind function is followed as code only when its linear decoding, up to the first jump, return or trap, the next unwind function or 256 instructions, holds an `fs:[disp32]` access, or when it is 16-byte aligned, starts less than 256 bytes after an unwind function and ends in a jump, return or trap. Every other such target is taken as data and counted in one message, and the Windows TLS rewrite fails instead of overwriting one. A TLS access of another form, such as `mov rax, fs:[rax]`, or a `gs` instruction in code reached only through such a target is therefore not rewritten or trapped. Other fs and gs instructions do not tell code from data there: string bytes decode as these prefixes, and in two measured titles about 2,500 of about 5,500 such targets decode to one before their first jump.
-- [Embedded data tables and relative jump tables in inter-FDE gaps](../../../core/relinker/relinker/src/analysis/RelativeJumpTables.cpp) - in modules with unwind records (`PT_GNU_EH_FRAME` or `PT_SCE_DYNLIBDATA`), constant data tables referenced by a RIP-relative `LEA` that hold undecodable bytes, and trailing relative jump tables, are masked with `0x90` in the scan buffer before syscall scanning and kept out of the code roots of [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp), so embedded data such as `0F 78` in `ubiservices.prx` (The Rogue Prince of Persia, PPSA28155, #7547) is no longer refused as an illegal opcode. The masked range of a table starts at the candidate `LEA` target and stops at the first byte whose linear decoding reaches a jump, return or trap, so gap bytes that are code keep being scanned, such as a callback reached through `lea` or a routine that contains a syscall, and so does a gap that a direct branch targets. The bytes from the end of a function to the candidate table must be padding only, and a gap whose bytes decode as valid instructions is left alone. The per-byte padding, trailing-code and syscall properties of a gap are computed once in a backward pass, so the analysis stays linear in the size of the gap. The bytes written to the output are unchanged apart from syscall traps.
+- [Embedded data tables and relative jump tables in inter-FDE gaps](../../../core/relinker/relinker/src/analysis/RelativeJumpTables.cpp) - in modules with `PT_GNU_EH_FRAME` or `PT_SCE_DYNLIBDATA`, a constant table of undecodable bytes that a RIP-relative `LEA` references, and a trailing relative jump table, are masked with `0x90` in the scan buffer before syscall scanning and kept out of the code roots of [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp), so `0F 78` data in `ubiservices.prx` (PPSA28155, #7547) is no longer refused as an illegal opcode. Masking starts at the `LEA` target, stops at the first byte whose linear decoding reaches a jump, return or trap, keeps gap code being scanned, and needs padding only from the function end to the table; A gap that decodes as valid instructions or that a direct branch targets is left alone. The gap properties are computed once in a backward pass. Output bytes are unchanged apart from syscall traps.
 - In executables and guest modules with a `PT_SCE_DYNLIBDATA` segment, the [code analysis](../../../core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp) of the Windows and macOS outputs follows code only from the end of `PT_INTERP`, or of the `/libexec/ld-elf.so.1` string that begins the segment when no `PT_INTERP` covers it, as in OpenOrbis modules, to the end of the PLT after the last function of the unwind table, or to the end of that function when the PLT comes before the code, as in the `libSceFios2.prx` and `libc.prx` that CUSA02636 bundles (PLT at 0xc8); the pipeline's scans of executables above stop at this same end, also when the PLT comes before the code. A guest module with PLT relocations and no PLT before or after its unwind functions, or with a PLT that overlaps one, fails as the executable does. Code after that end is not analyzed, such as the `DT_FINI` routine without an unwind entry that follows the last unwind function in both modules and that the Windows and macOS outputs call when the program exits: a TLS access in it is not rewritten, the ELF entry point, `DT_INIT`, `DT_FINI`, a branch or a pointer into it is ignored, and a function symbol or init/fini array entry pointing into it fails the conversion.
 - Under Rosetta (M5, macOS 27.0.1), a VMASKMOVPS, VMASKMOVPD, VPMASKMOVD or VPMASKMOVQ store or load that faults on an element other than an active first one ends the process (`unexpectedly need to EmulateForward on a synchronous exception`) instead of raising SIGSEGV or SIGBUS, so a masked store into a page the macOS write watch keeps read-only ends the title. `--to-rosetta` moves each masked store to a [stub](../../../core/relinker/codegen/src/x86/MaskedStoreLowering.cpp) that first writes to the first and last byte of every active element with `LOCK OR` of 0, which faults normally and changes nothing; each store then costs up to 16 locked byte writes. A page made read-only again by another thread between those writes and the store still ends the process. A stack-relative displacement that exceeds signed disp32 after the spill frame throws. Masked loads are not converted.
 - A relocation against a dynamic symbol entry that is all zero, like the null symbol, takes the value 0 plus its addend, as the gABI defines for `STN_UNDEF` ([pipeline](../../../core/relinker/relinker/src/pipeline/RelinkerPipeline.cpp)). The Linux output imports such an entry as an unnamed weak symbol, which the host loader resolves to 0; the Windows and macOS outputs write the value into the slot ([relocation builder](../../../core/relinker/elfpatcher/src/windows/WindowsRelocationBuilder.cpp)). What the console's loader does with such an entry is not measured. OliSe Player (PPSA01153) has seven of them, and its code calls through those slots only when they are not 0 ([#4437](https://github.com/boykopovar/AnyPS5/issues/4437)).

From c8de02cba916afac9879fe0ae885f530df832443 Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Sun, 25 Oct 2026 23:44:09 +0200
Subject: [PATCH 185/218] test(relinker): cover 32 large zero gaps in the table
 analysis

A 2 MiB text with 32 gaps of 64 KiB, the largest gap the analysis
follows, fails the fixture if the padding, trailing-code and syscall
queries go back to a quadratic walk, and asserts the bounded table end.
---
 .../relinker/tests/ControlFlowGraphTests.cpp  | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 19401ad15d..dccbd99d71 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -8,6 +8,7 @@
 #include <stdexcept>
 #include <string>
 #include <limits>
+#include <chrono>
 
 namespace {
 
@@ -501,6 +502,47 @@ void CheckEmbeddedDataTables() {
     Require(tablesWhirlpool[0].Begin == TextAddress + 32, "Whirlpool table start was incorrect");
 }
 
+void CheckLargeZeroGaps() {
+    constexpr std::size_t stride = 0x10000;
+    constexpr std::size_t count = 32;
+    constexpr std::size_t functionSize = 8;
+    constexpr std::size_t codeFill = 0x8000;
+    Bytes text(stride * count, 0x00);
+    std::vector<std::pair<VirtualAddress, VirtualAddress>> functions;
+    for (std::size_t index = 0; index < count; ++index) {
+        const auto begin = index * stride;
+        text[begin] = 0x48;
+        text[begin + 1] = 0x8d;
+        text[begin + 2] = 0x05;
+        SetDisplacement(text, begin + 3, begin + 7, TextAddress + begin + functionSize);
+        text[begin + 7] = 0xc3;
+        const auto table = begin + functionSize;
+        text[table] = 0x0f;
+        text[table + 1] = 0x78;
+        text[table + 2] = 0x33;
+        text[table + 3] = 0x1e;
+        for (auto at = table + 4; at + 2 < begin + codeFill; at += 3) {
+            text[at] = 0x48;
+            text[at + 1] = 0x89;
+            text[at + 2] = 0xc0;
+        }
+        functions.emplace_back(TextAddress + begin, TextAddress + begin + functionSize);
+    }
+    functions.emplace_back(TextAddress + stride * count, TextAddress + stride * count + functionSize);
+
+    const auto started = std::chrono::steady_clock::now();
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    const auto elapsed = std::chrono::steady_clock::now() - started;
+
+    Require(tables.size() == count, "Expected one data table per large gap");
+    for (std::size_t index = 0; index < tables.size(); ++index) {
+        Require(tables[index].Function == TextAddress + index * stride, "Large gap table was attached to the wrong function");
+        Require(tables[index].Begin == TextAddress + index * stride + functionSize, "Large gap table start was incorrect");
+        Require(tables[index].End == TextAddress + (index + 1) * stride, "Large gap table end was incorrect");
+    }
+    Require(elapsed < std::chrono::seconds(10), "Large gap analysis took too long");
+}
+
 }
 
 int main() {
@@ -520,6 +562,7 @@ int main() {
         CheckHighVirtualAddress();
         CheckRelativeJumpTables();
         CheckEmbeddedDataTables();
+        CheckLargeZeroGaps();
         std::cout << "Control-flow graph tests passed\n";
         return 0;
     } catch (const std::exception& error) {

From 4b5660b01902c200a180e33833293346124d1ada Mon Sep 17 00:00:00 2001
From: Danigamer05 <96824289+Danigamer05@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:07:24 +0100
Subject: [PATCH 186/218] test(pngdec): stop pinning unsupported pixel format

---
 core/libs/tests/GuestPngDec.cpp | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/core/libs/tests/GuestPngDec.cpp b/core/libs/tests/GuestPngDec.cpp
index 597f19c712..ef3149d724 100644
--- a/core/libs/tests/GuestPngDec.cpp
+++ b/core/libs/tests/GuestPngDec.cpp
@@ -10,7 +10,6 @@
 #include <initializer_list>
 #include <source_location>
 #include <span>
-#include <stdexcept>
 #include <vector>
 
 static void Require(bool value, std::source_location location = std::source_location::current()) {
@@ -19,16 +18,6 @@ static void Require(bool value, std::source_location location = std::source_loca
     std::abort();
 }
 
-template<typename TFunction>
-static bool ThrowsRuntimeError(TFunction function) {
-    try {
-        function();
-    } catch (const std::runtime_error&) {
-        return true;
-    }
-    return false;
-}
-
 static const std::uint8_t PALETTE_TRNS[] = {
     0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
     0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02, 0x02, 0x03, 0x00, 0x00, 0x00, 0x0F, 0xD8, 0xE5,
@@ -355,8 +344,6 @@ int main() {
     Check16BitImage(handle, deepHandle, RGBA16, {0x12, 0x56, 0x9A, 0x0D, 0xAB, 0x20, 0xEE, 0xFF, 0, 0x80, 0xFF, 0, 0xFF, 1, 0x7F, 0x80}, 19, 0);
     decode = DecodeParam(rgbPng, image);
     Require(scePngDecDecode(deepHandle, &decode, &info) == (3 << 16 | 2));
-    decode.pixel_format = 132;
-    Require(ThrowsRuntimeError([&] { scePngDecDecode(deepHandle, &decode, &info); }));
     Require(scePngDecDelete(deepHandle) == 0);
 
     Require(scePngDecDelete(nullptr) == invalidHandle);

From 4d845fb4e1736899a3e3b10853a289a672874410 Mon Sep 17 00:00:00 2001
From: Danigamer05 <96824289+Danigamer05@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:08:02 +0100
Subject: [PATCH 187/218] docs(keyboard): retain title character-use evidence

---
 docs/dev/debt/libSceKeyboard.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libSceKeyboard.md b/docs/dev/debt/libSceKeyboard.md
index df0713a7ed..12c1ff0c79 100644
--- a/docs/dev/debt/libSceKeyboard.md
+++ b/docs/dev/debt/libSceKeyboard.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): initialization, output length and reserved bytes remain unverified on a console; unconverted keys retain the host's length of 0. One title (PPSA15246) disassembled for this entry checks the first output byte and reads the 16-bit value at offset 8. Which other output fields it reads and what its other arguments mean are not shown.
+- [sceKeyboardGetKey2Char](../../../core/libs/prx/libSceKeyboard/src/keyboard_impl.cpp): initialization, output length and reserved bytes remain unverified on a console; unconverted keys retain the host's length of 0. One title (PPSA15246) disassembled for this entry calls it after clearing the first 20 bytes of its output buffer (16-byte store 0x69942d, 32-bit store 0x699435; no size argument), uses a character only when the result is 0 and the first output byte is nonzero, and then reads the 16-bit value at offset 8. Which other output fields it reads and what its other arguments mean are not shown.
 
 ### Unknown function info
 

From c54589b40cd99c17ff1260a7d14688ba7a54d480 Mon Sep 17 00:00:00 2001
From: Danigamer05 <96824289+Danigamer05@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:09:37 +0100
Subject: [PATCH 188/218] docs(pngdec): qualify large-image validation evidence

---
 docs/dev/debt/libScePngDec.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/dev/debt/libScePngDec.md b/docs/dev/debt/libScePngDec.md
index 9449f5a2e9..56d2263a09 100644
--- a/docs/dev/debt/libScePngDec.md
+++ b/docs/dev/debt/libScePngDec.md
@@ -3,7 +3,7 @@
 ### Functional
 
 - [libScePngDec](../../../core/libs/prx/libScePngDec/Export.cpp): the supplied module confirms the work-memory size formula, 16-byte handle alignment, the first 24 bytes of its context, and Create/QueryMemorySize validation order. The host now exposes these values but still allocates decoder working storage on the host instead of using the guest work region.
-- [scePngDecDecode](../../../core/libs/prx/libScePngDec/Export.cpp): 16-bit output and the original's accepted pixel format 132 remain unsupported and throw. Malformed-image diagnostics and decoder scratch-memory behavior are not fully matched to the supplied module.
+- [scePngDecDecode](../../../core/libs/prx/libScePngDec/Export.cpp): 16-bit output and the original's accepted pixel format 132 remain unsupported and throw. The large-dimension image-info requirement and its validation order follow [Prosper's PS5 3.20 module analysis](https://github.com/mattias800/prosper/blob/550886e3677e4a2ef81ad1603bf313f6a9696de2/prosper/src/hle/util/hle_pngdec.cpp#L385-L396), not a console measurement here. Malformed-image diagnostics and decoder scratch-memory behavior are not fully matched to the supplied module.
 
 ### Unknown function info
 

From d824ec2264843969bad6f36d0850cadaabb1f71f Mon Sep 17 00:00:00 2001
From: MarcZX10 <67475268+MarcZX10@users.noreply.github.com>
Date: Sun, 25 Oct 2026 22:19:02 +0000
Subject: [PATCH 189/218] test(libSceLibcInternal): let the spawn test's child
 die from SIGBUS in an ASan build

---
 core/libs/prx/libSceLibcInternal/CMakeLists.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/libs/prx/libSceLibcInternal/CMakeLists.txt b/core/libs/prx/libSceLibcInternal/CMakeLists.txt
index 96be9446d3..f17760d179 100644
--- a/core/libs/prx/libSceLibcInternal/CMakeLists.txt
+++ b/core/libs/prx/libSceLibcInternal/CMakeLists.txt
@@ -78,6 +78,7 @@ if(BUILD_TESTING)
     configure_windows_unwind(guest_posix_spawn_tests)
     add_test(NAME guest_posix_spawn COMMAND guest_posix_spawn_tests)
     set_tests_properties(guest_posix_spawn PROPERTIES TIMEOUT 20)
+    add_asan_test_options(guest_posix_spawn handle_sigbus=0)
     if(WIN32)
         set_tests_properties(guest_posix_spawn PROPERTIES ENVIRONMENT_MODIFICATION
             "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceLibcInternal>")

From a69872e516c06e24975eb3cd593ca0c71d82ee6e Mon Sep 17 00:00:00 2001
From: LeandroLP23 <leandroplacidi@gmail.com>
Date: Sun, 25 Oct 2026 23:20:21 +0100
Subject: [PATCH 190/218] fix(agc): hand a recorded submission to the driver
 before the recorder takes its next call

The recorder released its lock between recording a submission, flip or
suspend point and the driver accepting it. Another thread's delta could
then wait for the accepted work, read its blocks, and record itself
after a call whose work the driver had not accepted yet, so the replay
submitted that work before applying stale bytes over its result. The
entry points now pass the driver call to the recorder, which runs it
under the same lock right after recording the call.

agc_driver_frame_replay_concurrent submits copies from a second thread
during the capture and checks that every memory delta was read after
the submissions recorded before it had completed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libSceAgcDriver/CMakeLists.txt  |  6 ++
 .../Execution/include/FrameRecorder.hpp       | 10 ++-
 .../Execution/src/Driver/EntryPoints.cpp      | 20 +++--
 .../Execution/src/FrameRecorder.cpp           | 19 +++--
 .../prx/libSceAgcDriver/tests/FrameReplay.cpp | 79 +++++++++++++++++--
 docs/dev/BUILD.md                             |  2 +-
 6 files changed, 110 insertions(+), 26 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/CMakeLists.txt b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
index bb3fa5e95b..2bc2cc9a49 100644
--- a/core/libs/prx/libSceAgcDriver/CMakeLists.txt
+++ b/core/libs/prx/libSceAgcDriver/CMakeLists.txt
@@ -3478,6 +3478,12 @@ if(BUILD_TESTING)
                 TIMEOUT 120)
         set_tests_properties(agc_driver_frame_replay PROPERTIES ENVIRONMENT_MODIFICATION
                 "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
+        add_test(NAME agc_driver_frame_replay_concurrent COMMAND agc_driver_frame_replay_tests $<TARGET_FILE:agc_frame_replay> concurrent)
+        set_tests_properties(agc_driver_frame_replay_concurrent PROPERTIES
+                ENVIRONMENT "ANYPS5_NO_SHADER_CACHE=1;APS5_FRAME_CAPTURE=${CMAKE_CURRENT_BINARY_DIR}/frame-replay-concurrent-capture;APS5_FRAME_CAPTURE_AT_FLIP=1;APS5_FRAME_CAPTURE_FRAMES=8"
+                TIMEOUT 120)
+        set_tests_properties(agc_driver_frame_replay_concurrent PROPERTIES ENVIRONMENT_MODIFICATION
+                "PATH=path_list_prepend:$<TARGET_FILE_DIR:libc>")
     endif()
 endif()
 
diff --git a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
index b899f1b51c..e4ed5cf19b 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/include/FrameRecorder.hpp
@@ -10,6 +10,7 @@
 #include <cstdint>
 #include <deque>
 #include <filesystem>
+#include <functional>
 #include <map>
 #include <memory>
 #include <mutex>
@@ -35,10 +36,10 @@ public:
     void ResolveGraphicsAbi(const Shader* vertex, const Shader* pixel, std::uint32_t primitiveType);
     void RegisterVideoOutput(std::uint32_t handle);
     void UnregisterVideoOutput(std::uint32_t handle);
-    void Submit(const Packet& packet, std::uint32_t queue);
-    void Flip(const FlipInfo& info);
+    void Submit(const Packet& packet, std::uint32_t queue, const std::function<void()>& accept);
+    void Flip(const FlipInfo& info, const std::function<void()>& accept);
     void ReserveEopFlip(const FlipInfo& info, std::uint32_t token);
-    void Suspend();
+    void Suspend(const std::function<void()>& accept);
     void PresentBuffer(const DisplayBuffer& buffer);
     void FrameBoundary();
 
@@ -62,7 +63,8 @@ private:
     };
 
     FrameCall make(FrameCallKind kind);
-    void record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders = {});
+    void record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders = {}, const std::function<void()>& accept = {});
+    void recordLocked(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders);
     void emitDelta();
     void emitShaderDelta(std::span<const Shader* const> shaders);
     void writeDelta(std::span<const Span> spans, std::span<const std::uint64_t> hostPages, std::span<const Range> added = {});
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
index af6202cb08..785f1b1ca8 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/Driver/EntryPoints.cpp
@@ -19,9 +19,8 @@ void Submit(const Packet* packet, std::uint32_t queue) try {
         return;
     }
     GuestMemory::CheckRange(packet, sizeof(Packet), alignof(Packet));
-    recorder->Submit(*packet, queue);
     const auto flips = driver.FlipSubmissions();
-    driver.Submit(packet, queue);
+    recorder->Submit(*packet, queue, [&] { driver.Submit(packet, queue); });
     if (driver.FlipSubmissions() != flips) recorder->FrameBoundary();
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
@@ -41,8 +40,12 @@ void RegisterShader(const Shader* shader) {
 }
 
 void SuspendPoint() {
-    if (auto* const recorder = FrameRecorder::Active()) recorder->Suspend();
-    DriverDetail::Driver::Get().SuspendPoint();
+    auto* const recorder = FrameRecorder::Active();
+    if (recorder == nullptr) {
+        DriverDetail::Driver::Get().SuspendPoint();
+        return;
+    }
+    recorder->Suspend([] { DriverDetail::Driver::Get().SuspendPoint(); });
 }
 
 void RegisterVideoOutput(std::uint32_t handle, const std::shared_ptr<IVideoOutput>& output) {
@@ -146,9 +149,12 @@ extern "C" void AgcDriverSerialProgress_nid_postfix(std::uint64_t* accepted, std
 
 extern "C" void AgcDriverSubmitFlip_nid_postfix(const AgcDriver::FlipInfo& info) try {
     auto* const recorder = AgcDriver::FrameRecorder::Active();
-    if (recorder != nullptr) recorder->Flip(info);
-    AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info);
-    if (recorder != nullptr) recorder->FrameBoundary();
+    if (recorder == nullptr) {
+        AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info);
+        return;
+    }
+    recorder->Flip(info, [&] { AgcDriver::DriverDetail::Driver::Get().SubmitFlip(info); });
+    recorder->FrameBoundary();
 } catch (const ProcessShutdown&) {
     LibcAwaitExit_nid_postfix();
 }
diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
index 7dc3f02253..cdfdc9afbe 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/FrameRecorder.cpp
@@ -163,20 +163,20 @@ void FrameRecorder::UnregisterVideoOutput(std::uint32_t handle) {
     record(std::move(call), true);
 }
 
-void FrameRecorder::Submit(const Packet& packet, std::uint32_t queue) {
+void FrameRecorder::Submit(const Packet& packet, std::uint32_t queue, const std::function<void()>& accept) {
     auto call = make(FrameCallKind::Submit);
     call.queue = queue;
     call.address = pointer(packet.addr);
     call.size = packet.dw_num;
     call.flags = packet.flags;
-    record(std::move(call), false);
+    record(std::move(call), false, {}, accept);
 }
 
-void FrameRecorder::Flip(const FlipInfo& info) {
+void FrameRecorder::Flip(const FlipInfo& info, const std::function<void()>& accept) {
     auto call = make(FrameCallKind::Flip);
     call.cpuFlip = true;
     call.values = {info.handle, flipValue(info.index), info.mode, flipValue(info.argument)};
-    record(std::move(call), false);
+    record(std::move(call), false, {}, accept);
 }
 
 void FrameRecorder::ReserveEopFlip(const FlipInfo& info, std::uint32_t token) {
@@ -198,8 +198,8 @@ void FrameRecorder::ReserveEopFlip(const FlipInfo& info, std::uint32_t token) {
     ++recordedCalls;
 }
 
-void FrameRecorder::Suspend() {
-    record(make(FrameCallKind::Suspend), false);
+void FrameRecorder::Suspend(const std::function<void()>& accept) {
+    record(make(FrameCallKind::Suspend), false, {}, accept);
 }
 
 void FrameRecorder::PresentBuffer(const DisplayBuffer& buffer) {
@@ -236,8 +236,13 @@ void FrameRecorder::writeReferenceFrames() {
     }
 }
 
-void FrameRecorder::record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders) {
+void FrameRecorder::record(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders, const std::function<void()>& accept) {
     std::lock_guard lock(mutex);
+    recordLocked(std::move(call), prologueCall, shaders);
+    if (accept) accept();
+}
+
+void FrameRecorder::recordLocked(FrameCall call, bool prologueCall, std::span<const Shader* const> shaders) {
     if (state == State::Waiting) {
         if (!prologueCall) return;
         call.ordinal = ++ordinal;
diff --git a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
index dc652cddfe..23e6c21513 100644
--- a/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
+++ b/core/libs/prx/libSceAgcDriver/tests/FrameReplay.cpp
@@ -17,6 +17,7 @@
 #include <memory>
 #include <stdexcept>
 #include <string>
+#include <thread>
 #include <vector>
 #ifdef _WIN32
 #include <windows.h>
@@ -100,14 +101,18 @@ std::vector<std::byte> pattern(std::uint8_t seed) {
     return bytes;
 }
 
-void copyFrame(std::uint32_t* words, const Layout& layout, std::byte* target) {
-    CommandBuffer buffer{words, words + CommandBytes / sizeof(std::uint32_t), words, words + CommandBytes / sizeof(std::uint32_t), nullptr, nullptr, 0};
-    sceAgcDcbDmaData(&buffer, 0, DmaMemory, 0, at(target), DmaMemory, 0, at(layout.source), DataBytes, 0, 1, 0);
-    sceAgcDcbWriteData(&buffer, GraphicsMemory, 0, at(layout.label), &Done, 1, 0, 1);
+void copy(std::uint32_t* words, std::size_t commandBytes, const std::byte* source, std::byte* target, std::uint32_t* label) {
+    CommandBuffer buffer{words, words + commandBytes / sizeof(std::uint32_t), words, words + commandBytes / sizeof(std::uint32_t), nullptr, nullptr, 0};
+    sceAgcDcbDmaData(&buffer, 0, DmaMemory, 0, at(target), DmaMemory, 0, at(source), DataBytes, 0, 1, 0);
+    sceAgcDcbWriteData(&buffer, GraphicsMemory, 0, at(label), &Done, 1, 0, 1);
     Packet packet{words, static_cast<std::uint32_t>(buffer.cursor_up - words), 0, {}};
     check(sceAgcDriverSubmitDcb(&packet) == 0, "submission failed");
 }
 
+void copyFrame(std::uint32_t* words, const Layout& layout, std::byte* target) {
+    copy(words, CommandBytes, layout.source, target, layout.label);
+}
+
 void flip() {
     AgcDriverSubmitFlip_nid_postfix(AgcDriver::FlipInfo{Handle, -1, 1, 0});
 }
@@ -187,15 +192,75 @@ void testCaptureAndReplay(const std::filesystem::path& tool) {
     check(readFile(secondDump) == second, "the replay did not reproduce the second copy");
 }
 
+void testConcurrentCopies(const std::filesystem::path& tool) {
+    constexpr std::size_t Copies = 64;
+    constexpr std::size_t Frames = 8;
+    constexpr std::size_t CopyCommandBytes = 1024;
+    const char* directory = std::getenv("APS5_FRAME_CAPTURE");
+    check(directory != nullptr && *directory != '\0', "APS5_FRAME_CAPTURE is not set");
+    const std::filesystem::path capture(directory);
+    const auto layout = allocate();
+    const auto other = allocate();
+    auto* const otherSource = other.base + 128 * 1024;
+    auto* const targets = otherSource + DataBytes;
+    auto* const otherLabel = reinterpret_cast<std::uint32_t*>(other.base + 512 * 1024);
+    const auto copied = pattern(57);
+    std::memcpy(otherSource, copied.data(), copied.size());
+    auto output = std::make_shared<Output>();
+    AgcDriverRegisterVideoOutput_nid_postfix(Handle, output);
+
+    flip();
+    std::thread copier([&] {
+        for (std::size_t index = 0; index < Copies; ++index) {
+            copy(reinterpret_cast<std::uint32_t*>(other.base + index * CopyCommandBytes), CopyCommandBytes, otherSource, targets + index * DataBytes, otherLabel);
+        }
+    });
+    for (std::size_t frame = 0; frame + 1 < Frames; ++frame) {
+        const auto bytes = pattern(static_cast<std::uint8_t>(frame));
+        std::memcpy(layout.source, bytes.data(), bytes.size());
+        copyFrame(layout.firstCommands, layout, layout.firstTarget);
+        flip();
+    }
+    copier.join();
+    flip();
+    AgcDriverWaitIdle_nid_postfix();
+
+    const FrameCaptureReader reader(capture);
+    check(!reader.Truncated(), "the capture is truncated");
+    std::uint64_t base = 0;
+    std::size_t submits = 0, memory = 0;
+    for (const auto& call : reader.Calls()) {
+        if (call.kind == FrameCallKind::FrameStart) base = call.completed;
+        if (call.kind == FrameCallKind::Memory) {
+            ++memory;
+            check(call.completed >= base + submits, "a memory delta was read with " + std::to_string(base + submits - call.completed) + " of the " + std::to_string(submits) + " submissions recorded before it unfinished");
+        }
+        submits += call.kind == FrameCallKind::Submit;
+    }
+    check(submits == Copies + Frames - 1, "the capture holds " + std::to_string(submits) + " submits, not " + std::to_string(Copies + Frames - 1));
+    check(memory != 0, "the capture holds no memory deltas");
+
+    const auto dump = capture / "targets.bin";
+    const auto command = "\"\"" + tool.string() + "\" \"" + capture.string() + "\" --strict --dump " + std::to_string(at(targets)) + ":" + std::to_string(Copies * DataBytes) + ":\"" + dump.string() + "\"\"";
+    const auto code = std::system(command.c_str());
+    check(code == 0, "agc_frame_replay exited with " + std::to_string(code));
+    const auto replayed = readFile(dump);
+    check(replayed.size() == Copies * DataBytes, "the replay dumped " + std::to_string(replayed.size()) + " bytes of the copy targets");
+    for (std::size_t index = 0; index < Copies; ++index) {
+        check(std::memcmp(replayed.data() + index * DataBytes, copied.data(), DataBytes) == 0, "the replay did not reproduce copy " + std::to_string(index) + " of the second thread");
+    }
+}
+
 }
 
 int main(int argc, char** argv) {
-    if (argc != 2) {
-        std::fprintf(stderr, "usage: agc_driver_frame_replay_tests <agc_frame_replay>\n");
+    if (argc != 2 && !(argc == 3 && std::string(argv[2]) == "concurrent")) {
+        std::fprintf(stderr, "usage: agc_driver_frame_replay_tests <agc_frame_replay> [concurrent]\n");
         return 2;
     }
     try {
-        testCaptureAndReplay(argv[1]);
+        if (argc == 3) testConcurrentCopies(argv[1]);
+        else testCaptureAndReplay(argv[1]);
     } catch (const std::exception& error) {
         std::fprintf(stderr, "FAILED: %s\n", error.what());
         return 1;
diff --git a/docs/dev/BUILD.md b/docs/dev/BUILD.md
index 71536bb86e..377205720b 100644
--- a/docs/dev/BUILD.md
+++ b/docs/dev/BUILD.md
@@ -195,7 +195,7 @@ On Windows use `agc_pm4_replay.exe` and prepend `build/core/libs/libs/unpatched`
 
 ## Frame capture and replay
 
-Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps), read once the submissions already accepted have completed; an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk.
+Set `APS5_FRAME_CAPTURE` to a directory to record a few frames of a title at the AGC driver boundary, then replay them with `agc_frame_replay` through any build of the driver with no title running. From the start of the process the driver keeps every shader registration and ABI resolution, video output registration and EOP flip reservation. At the frame boundary picked by `APS5_FRAME_CAPTURE_AT_FLIP` (default 1), or by the appearance of the file `APS5_FRAME_CAPTURE_TRIGGER` names (a number in it replaces the frame count), it waits for the driver to go idle and writes every committed, readable allocation of the guest allocation registry, the title's image included, as zstd chunks without their all-zero 64 KiB blocks. A frame ends at a CPU flip or at a submission that flips (a flip packet, or the EOP release of a reserved flip token); the reservation itself only records its token. For the next `APS5_FRAME_CAPTURE_FRAMES` (10) frames it records each submission (queue, command buffer address and size), flip and suspend point with the thread that made it and the accepted and completed serials, each preceded by the guest pages the write tracker saw the CPU write since the previous call that handed work to the GPU (`GuestMemory::CollectWrittenBlocks`, per 4 KiB where the tracker kept page stamps), read once the submissions already accepted have completed (a recorded submission, flip or suspend point reaches the driver before the recorder takes its next call, so that wait covers every call recorded before the delta); an allocation the registry gained after the snapshot is recorded there as a new range with its nonzero 64 KiB blocks. A submission ends a frame only when it flips itself, not when another thread's submission flipped while it was being submitted. Shader registrations and ABI resolutions only collect the blocks of the shader header and the arrays it points to, and the pages of the title's image only when their content changed. At the end it stores each display buffer the title presented, decoded, as a reference image. A capture is `calls.bin`, `memory.bin` and `capture.json` (commit, switches, sizes, warnings), and the recorder stops with a warning when its volume has less than 4 GiB free. A 20-frame capture in the Demon's Souls Nexus is 5.3 GiB of snapshot and 11.5 GiB of deltas before compression, 3.9 GiB on disk.
 
 `agc_frame_replay <capture> [--no-pace] [--no-release] [--release-after-ms <n>] [--no-synthesize] [--strict] [--dump <address>:<bytes>:<file>]... [--frames <dir>]` maps the captured ranges at their addresses and registers them with their access (a range the replaying process already maps writable, such as the driver's fixed memory, is only refilled, and a non-GPU range it uses itself is skipped and counted), repeats the registrations, then replays the calls of each captured thread on a thread of its own, started in captured order. Before a call that hands work to the GPU it waits until no more submissions are in flight than when the title made it (`--no-pace` turns this off). Titles release GPU waits from threads that never call the driver, so when the driver completes nothing for 3 ms the replay reads the waits its queues are blocked on (`AgcDriverAwaitedWaits`) and writes the next recorded CPU value of the awaited dword that satisfies the compare, else the last earlier one, else a value derived from the reference (`--no-synthesize` turns this last step off). It prints one JSON line with the frame count and times, the submissions, the pacing wait, the released waits and how many were derived, the submissions that never completed and, for captures with reference images, the share of identical pixels and the largest channel difference of the replayed display buffers (`--frames` writes both images). Effects that depend on timing (temporal antialiasing, particles) make pixels differ, so expect a visual match rather than identical frames. Replay times follow the GPU clock state: lock the clocks (`nvidia-smi -lgc`, `-lmc`) when comparing two drivers.
 

From eed35dc5d907409d92e5c485dd94e6b9bb611430 Mon Sep 17 00:00:00 2001
From: lakhantheboss <61951686+lakhantheboss@users.noreply.github.com>
Date: Mon, 26 Oct 2026 03:50:51 +0530
Subject: [PATCH 191/218] feat(libSceRegMgr): implement core registry access
 and query interfaces

---
 core/libs/prx/libSceRegMgr/Export.cpp      | 87 +++++++++++++++++++---
 core/libs/prx/libSceRegMgr/include/Api.hpp |  8 +-
 core/libs/tests/GuestRegMgr.cpp            | 25 +++++++
 docs/dev/debt/libSceRegMgr.md              |  5 ++
 4 files changed, 113 insertions(+), 12 deletions(-)

diff --git a/core/libs/prx/libSceRegMgr/Export.cpp b/core/libs/prx/libSceRegMgr/Export.cpp
index d1efe47018..07cc796290 100644
--- a/core/libs/prx/libSceRegMgr/Export.cpp
+++ b/core/libs/prx/libSceRegMgr/Export.cpp
@@ -1,22 +1,91 @@
 #include "prx/libSceRegMgr/include/Api.hpp"
 #include <cstdint>
 #include <cstddef>
+#include <cstring>
+#include <mutex>
+#include <string>
+#include <unordered_map>
+#include <vector>
 #include "SceTypes.hpp"
 #include "prx/libc/include/General.hpp"
 
+namespace {
+
+constexpr int SCE_REG_MGR_ERROR_INVALID_PARAM = static_cast<int>(0x80820001);
+constexpr int SCE_REG_MGR_ERROR_NOT_FOUND = static_cast<int>(0x80820002);
+constexpr int SCE_REG_MGR_ERROR_BUFFER_TOO_SMALL = static_cast<int>(0x80820004);
+constexpr int SCE_REG_MGR_ERROR_INVALID_TYPE = static_cast<int>(0x80820006);
+
+enum EntryType {
+    TypeInt = 0,
+    TypeStr = 1,
+    TypeBin = 2,
+};
+
+struct RegEntry {
+    EntryType type;
+    int32_t intVal = 0;
+    std::string strVal;
+    std::vector<uint8_t> binVal;
+};
+
+class RegistryStore {
+public:
+    RegistryStore() = default;
+
+    int getInt(int64_t key, int32_t* out) {
+        if (out == nullptr) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        std::lock_guard<std::mutex> lock(mutex_);
+        auto it = entries_.find(key);
+        if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
+        if (it->second.type != TypeInt) return SCE_REG_MGR_ERROR_INVALID_TYPE;
+        *out = it->second.intVal;
+        return 0;
+    }
+
+    int getStr(int64_t key, char* out, int len) {
+        if (out == nullptr || len <= 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        std::lock_guard<std::mutex> lock(mutex_);
+        auto it = entries_.find(key);
+        if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
+        if (it->second.type != TypeStr) return SCE_REG_MGR_ERROR_INVALID_TYPE;
+        if (static_cast<size_t>(len) <= it->second.strVal.size()) return SCE_REG_MGR_ERROR_BUFFER_TOO_SMALL;
+        std::memcpy(out, it->second.strVal.c_str(), it->second.strVal.size() + 1);
+        return 0;
+    }
+
+    int getBin(int64_t key, void* out, int size) {
+        if (out == nullptr || size <= 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        std::lock_guard<std::mutex> lock(mutex_);
+        auto it = entries_.find(key);
+        if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
+        if (it->second.type != TypeBin) return SCE_REG_MGR_ERROR_INVALID_TYPE;
+        if (static_cast<size_t>(size) < it->second.binVal.size()) return SCE_REG_MGR_ERROR_BUFFER_TOO_SMALL;
+        std::memcpy(out, it->second.binVal.data(), it->second.binVal.size());
+        return 0;
+    }
+
+private:
+    std::mutex mutex_;
+    std::unordered_map<int64_t, RegEntry> entries_;
+};
+
+RegistryStore gStore;
+
+} // namespace
+
 extern "C" {
 
-int APS5_VABI sceRegMgrGetBin(std::uint32_t optionId, void* data, std::size_t size) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+int APS5_VABI sceRegMgrGetBin(std::int64_t optionId, void* data, int size) {
+    return gStore.getBin(optionId, data, size);
 }
-int APS5_VABI sceRegMgrGetInt(int32_t optionId, int32_t* outInt) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+int APS5_VABI sceRegMgrGetInt(std::int64_t optionId, int32_t* outInt) {
+    return gStore.getInt(optionId, outInt);
 }
-int APS5_VABI sceRegMgrGetStr(int32_t optionId, char* outString, std::size_t stringLength) {
-    NotImplemented_nid_no_patch(__func__);
-    return 0;
+
+int APS5_VABI sceRegMgrGetStr(std::int64_t optionId, char* outString, int stringLength) {
+    return gStore.getStr(optionId, outString, stringLength);
 }
 int APS5_VABI sceRegMgrSetBin(std::uint32_t optionId, const void* data, std::size_t size) {
     NotImplemented_nid_no_patch(__func__);
diff --git a/core/libs/prx/libSceRegMgr/include/Api.hpp b/core/libs/prx/libSceRegMgr/include/Api.hpp
index 91e57f01f1..8d062d5377 100644
--- a/core/libs/prx/libSceRegMgr/include/Api.hpp
+++ b/core/libs/prx/libSceRegMgr/include/Api.hpp
@@ -1,12 +1,14 @@
 #pragma once
 
+#include <cstddef>
+#include <cstdint>
 #include "SceTypes.hpp"
 
 extern "C" {
 
-int APS5_VABI sceRegMgrGetBin(std::uint32_t optionId, void* data, std::size_t size);
-int APS5_VABI sceRegMgrGetInt(int32_t optionId, int32_t* outInt);
-int APS5_VABI sceRegMgrGetStr(int32_t optionId, char* outString, std::size_t stringLength);
+int APS5_VABI sceRegMgrGetBin(std::int64_t optionId, void* data, int size);
+int APS5_VABI sceRegMgrGetInt(std::int64_t optionId, int32_t* outInt);
+int APS5_VABI sceRegMgrGetStr(std::int64_t optionId, char* outString, int stringLength);
 int APS5_VABI sceRegMgrSetBin(std::uint32_t optionId, const void* data, std::size_t size);
 int APS5_VABI sceRegMgrSetInt(int32_t optionId, int32_t inInt);
 int APS5_VABI sceRegMgrSetStr(int32_t optionId, const char* inStirng, std::size_t stringLength);
diff --git a/core/libs/tests/GuestRegMgr.cpp b/core/libs/tests/GuestRegMgr.cpp
index f9e8901ef4..179435c09c 100644
--- a/core/libs/tests/GuestRegMgr.cpp
+++ b/core/libs/tests/GuestRegMgr.cpp
@@ -2,6 +2,7 @@
 #include "prx/libc/include/general/VabiMacros.hpp"
 #include <cstdint>
 #include <cstdlib>
+#include <cstring>
 #include <stdexcept>
 #include <string>
 
@@ -21,4 +22,28 @@ int main() {
     std::int32_t value = 0;
     Require(ReportsNotImplemented("sceRegMgrNonSysGetInt", [&] { sceRegMgrNonSysGetInt(0, 0, &value); }));
     Require(ReportsNotImplemented("sceRegMgrNonSysGetInt", [&] { sceRegMgrNonSysGetInt(-1, 1, nullptr); }));
+
+    int32_t intVal = 0;
+    char strBuf[64] = {};
+    uint8_t binBuf[32] = {};
+
+    Require(sceRegMgrGetInt(0x1000, nullptr) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetStr(0x1001, nullptr, 10) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetStr(0x1001, strBuf, 0) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetStr(0x1001, strBuf, -1) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetBin(0x1002, nullptr, 10) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetBin(0x1002, binBuf, 0) == static_cast<int>(0x80820001));
+    Require(sceRegMgrGetBin(0x1002, binBuf, -1) == static_cast<int>(0x80820001));
+
+    intVal = 0x55AA;
+    Require(sceRegMgrGetInt(888888, &intVal) == static_cast<int>(0x80820002));
+    Require(intVal == 0x55AA);
+    std::strcpy(strBuf, "CANARY");
+    Require(sceRegMgrGetStr(888888, strBuf, sizeof(strBuf)) == static_cast<int>(0x80820002));
+    Require(std::strcmp(strBuf, "CANARY") == 0);
+    binBuf[0] = 0x77;
+    Require(sceRegMgrGetBin(888888, binBuf, sizeof(binBuf)) == static_cast<int>(0x80820002));
+    Require(binBuf[0] == 0x77);
+
+    return 0;
 }
diff --git a/docs/dev/debt/libSceRegMgr.md b/docs/dev/debt/libSceRegMgr.md
index 24cd287ce7..53f952c029 100644
--- a/docs/dev/debt/libSceRegMgr.md
+++ b/docs/dev/debt/libSceRegMgr.md
@@ -1,5 +1,10 @@
 # libSceRegMgr technical debt
 
+### Functional
+
+- [Registry store](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - entries are queried through an in-memory process-local store without persistence. Callable prototypes for `sceRegMgrGetInt`, `sceRegMgrGetStr`, and `sceRegMgrGetBin` derive from [regmgr.h](https://github.com/ps5-payload-dev/regdump/blob/883524cc48c8497267ba7fc94ff0ac58880c4227/regmgr.h#L3713-L3729). Setters (`sceRegMgrSetInt`, `sceRegMgrSetStr`, `sceRegMgrSetBin`, `sceRegMgrSetbin`), reset (`sceRegMgrResetVal`), and return error codes remain unimplemented throwing `NotImplemented_nid_no_patch` until callable contracts and error codes are supported by evidence.
+- [Unverified registry APIs](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - export names and NIDs for initial-value getters, version queries, region queries and conversions, error checks, control/backup routines, and `sceRegMgrNonSys*` variants are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/cf6eede3f6588d779664e01874638f09484324b7/libSceRegMgr.c) and [NID database](https://github.com/zecoxao/sce_symbols/blob/9620e03b2964dbf0cfc1cb143ab24a65125091de/aerolib.csv), but their callable contracts and runtime behavior remain unverified and retain `NotImplemented_nid_no_patch`.
+
 ### Unknown function info
 
 - [sceRegMgrCheckError](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - unknown signature

From ea02895cc071865dd32181ec74dcc4f217366503 Mon Sep 17 00:00:00 2001
From: orezraey <eliatan1122@gmail.com>
Date: Sun, 25 Oct 2026 19:35:33 -0300
Subject: [PATCH 192/218] fix(libkernel): refuse TCP_MAXSEG before a connection
 and raise it to 216 as measured on a PS5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../libs/prx/libkernel/Socket/src/SocketOptions.cpp | 10 ++++++++--
 core/libs/prx/libkernel/Socket/src/Udp.cpp          |  2 ++
 core/libs/tests/GuestSocketStreamOptions.cpp        | 13 ++++++++++++-
 docs/dev/debt/libkernel.md                          |  2 +-
 4 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
index 83b5231843..ff0fb47fb7 100644
--- a/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
+++ b/core/libs/prx/libkernel/Socket/src/SocketOptions.cpp
@@ -322,6 +322,12 @@ int GetSocketLevelOption(std::uintptr_t native, SocketOptionState& state, int fa
     return Copy(value, length, &number, sizeof(number));
 }
 
+bool HasPeer(std::uintptr_t native) {
+    sockaddr_storage peer{};
+    socklen_t size = sizeof(peer);
+    return ::getpeername(static_cast<NativeHandle>(native), reinterpret_cast<sockaddr*>(&peer), &size) == 0;
+}
+
 int SetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp, int option, const void* value, std::uint32_t length) {
     if (!tcp) return ErrorInvalid;
     if (option != GuestTcpNoDelay && option != GuestTcpMaximumSegment && option != GuestTcpKeepIdle && option != GuestTcpKeepInterval &&
@@ -336,8 +342,8 @@ int SetTcpLevelOption(std::uintptr_t native, SocketOptionState& state, bool tcp,
     }
     const auto unsignedNumber = static_cast<unsigned int>(number);
     if (option == GuestTcpMaximumSegment) {
-        if (number <= 0 || number > state.tcpMaximumSegment || number + 40 < MinimumSegment) return ErrorInvalid;
-        state.tcpMaximumSegment = number;
+        if (!HasPeer(native) || number <= 0 || number > state.tcpMaximumSegment || number + 40 < MinimumSegment) return ErrorInvalid;
+        state.tcpMaximumSegment = std::max(number, MinimumSegment);
         return 0;
     }
     if (option == GuestTcpKeepCount) {
diff --git a/core/libs/prx/libkernel/Socket/src/Udp.cpp b/core/libs/prx/libkernel/Socket/src/Udp.cpp
index 9de4a4e179..b2a1cec17c 100644
--- a/core/libs/prx/libkernel/Socket/src/Udp.cpp
+++ b/core/libs/prx/libkernel/Socket/src/Udp.cpp
@@ -1206,6 +1206,7 @@ int APS5_VABI socket_nid_postfix(int family, int type, int protocol) {
     try {
         auto socket = std::make_shared<Socket>(native, family, plainType);
         guard.value = Invalid;
+        if (family == 28) socket->options.tcpMaximumSegment = 1220;
         if (nonblocking && SetNonBlocking(*socket)) return -1;
         const int number = Install(std::move(socket));
         if (number >= 0 && (type & GuestCloseOnExec) != 0) {
@@ -1311,6 +1312,7 @@ int APS5_VABI accept_nid_postfix(int descriptor, void* address, std::uint32_t* l
     try {
         auto accepted = std::make_shared<Socket>(native, listener->family, listener->type);
         guard.value = Invalid;
+        if (listener->family == 28) accepted->options.tcpMaximumSegment = 1220;
         bool inheritNonblocking;
         {
             std::lock_guard modeLock(listener->modeMutex);
diff --git a/core/libs/tests/GuestSocketStreamOptions.cpp b/core/libs/tests/GuestSocketStreamOptions.cpp
index 08434c8ae8..647c93cdda 100644
--- a/core/libs/tests/GuestSocketStreamOptions.cpp
+++ b/core/libs/tests/GuestSocketStreamOptions.cpp
@@ -106,7 +106,18 @@ int main() {
     for (const int segment : {1000, 175, 0, -1}) {
         Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, TcpMaximumSegment, &segment, sizeof(segment)), Invalid));
     }
-    Require(Set(fresh, TcpLevel, TcpMaximumSegment, 300) && Get(fresh, TcpLevel, TcpMaximumSegment) == 300);
+    for (const int segment : {176, 300, 536})
+        Require(Fails(setsockopt_nid_postfix(fresh, TcpLevel, TcpMaximumSegment, &segment, sizeof(segment)), Invalid));
+    Require(Get(fresh, TcpLevel, TcpMaximumSegment) == 536);
+    const int fresh6 = socket_nid_postfix(28, 1, 0);
+    if (fresh6 >= 0) {
+        Require(Get(fresh6, TcpLevel, TcpMaximumSegment) == 1220);
+        Require(close_nid_postfix(fresh6) == 0);
+    }
+    Require(Set(client, TcpLevel, TcpMaximumSegment, 176) && Get(client, TcpLevel, TcpMaximumSegment) == 216);
+    Require(Set(client, TcpLevel, TcpMaximumSegment, 200) && Get(client, TcpLevel, TcpMaximumSegment) == 216);
+    const int larger = 400;
+    Require(Fails(setsockopt_nid_postfix(client, TcpLevel, TcpMaximumSegment, &larger, sizeof(larger)), Invalid));
     Require(Get(fresh, TcpLevel, 0x100) == 7200 && Get(fresh, TcpLevel, 0x200) == 75 && Get(fresh, TcpLevel, 0x400) == 8);
     Require(Set(fresh, TcpLevel, 0x100, 60) && Get(fresh, TcpLevel, 0x100) == 60);
     Require(Set(fresh, TcpLevel, 0x100, 0) && Get(fresh, TcpLevel, 0x100) == 7200);
diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md
index 875084ff1b..d9311f255b 100644
--- a/docs/dev/debt/libkernel.md
+++ b/docs/dev/debt/libkernel.md
@@ -240,7 +240,7 @@
 - [TCP_NOPUSH, TCP_NOOPT, TCP option 0x80, IP_RECVDSTADDR, IP_RECVIF, IP_RECVTTL](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept and read back as a payload process on a PS5 (firmware 13.60) did: the TCP ones as the bits 0x1000, 0x8 and 0x10000 (so 0x80 is not FreeBSD's `TCP_KEEPINIT` there), the IP ones as 0 or 1. None of them changes what the socket does: `TCP_NOPUSH` does not hold back sends, and the IP ones add no control message to `recvmsg`. `IP_RECVTTL` was only read, never set, on the console, and an accepted socket takes `TCP_NOPUSH` from its listener as FreeBSD 11.4's `syncache_socket` does, which was not measured
 - [SO_DEBUG, SO_REUSEADDR, SO_USELOOPBACK, SO_REUSEPORT, SO_TIMESTAMP, SO_BINTIME and option 0x10000](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept as bits that read back as on a PS5 (firmware 13.60, payload process), and options 0x4000 and 0x8000 are accepted and cannot be read, as there; only `SO_REUSEADDR` and `SO_REUSEPORT` change what the socket does. Both are set on the host, `SO_REUSEPORT` as `SO_REUSEADDR` on Windows, which has no `SO_REUSEPORT` and there also lets the socket bind over one that did not set it; Linux spreads unicast datagrams across the sockets, where FreeBSD gives each to one. Option 0x10000 is only kept: if the console treats it as FreeBSD 12's `SO_REUSEPORT_LB`, two sockets that set it share a port there, where the second `bind` here fails with `EADDRINUSE`. An accepted socket takes the bits from its listener, as FreeBSD 11.4's `sonewconn` copies `so_options`; that was not measured
 - [IP_ADD_MEMBERSHIP, IP_DROP_MEMBERSHIP, IP_MULTICAST_IF](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - set on the host socket after the checks a PS5 (firmware 13.60, payload process) showed: `EOPNOTSUPP` on a stream socket, `EINVAL` for a short value or a group outside 224.0.0.0/4, `EADDRINUSE` for a group joined twice and `EADDRNOTAVAIL` for one not joined, tracked per socket. An interface the host lacks fails with the host's error (`EADDRNOTAVAIL` on the console). A group joined through `INADDR_ANY` and through that interface's address counts as two here. Not measured, after FreeBSD 11.4: a drop through `INADDR_ANY` leaves the first such group on any interface (`inp_leave_group`), and the other multicast options fail with `EOPNOTSUPP` on a stream socket (`inp_setmoptions`). An `ip_mreqn` with a non-zero index or address throws, as only a zeroed one was measured, and so does reading `IP_MULTICAST_IF` into 12 bytes, where FreeBSD returns an `ip_mreqn`
-- [TCP_MAXSEG](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per stream socket, read as 536 at first and failing with `EINVAL` for 1000, 70000 and 100, as a payload process on a PS5 (firmware 13.60) did. No segment set succeeded there, so the rule here, `EINVAL` above the current segment or below 176 and any segment between accepted, follows FreeBSD 11.4's `tcp_default_ctloutput` (`optval + 40 >= V_tcp_minmss`) and is not measured. An `AF_INET6` socket also starts at 536 here, where FreeBSD's `tcp_newtcpcb` uses 1220; not measured. The segment is not set on the host socket, so the host's segment size is its own, and a connected socket still reads the segment it was given instead of the negotiated one
+- [TCP_MAXSEG](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - a connected socket reads 536 (1220 for `AF_INET6`) until a segment is set, where a payload process on PS5 firmware 13.60 read the negotiated segment (16344 over loopback, lo0's MTU less 40) on both ends; the segment is not set on the host socket, and a listening socket was not measured. Otherwise it follows that console: a fresh socket reads 536, or 1220 for `AF_INET6`, and fails every set with `EINVAL` (175, 176, 200, 400, 536, 537, 1460 tried); a connected one fails a segment above the current one or below 176, and stores the rest raised to 216 (176 and 200 both read back 216), as FreeBSD 11.4's `tcp_default_ctloutput` with `V_tcp_minmss` does
 - [TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per stream socket and read back as a payload process on a PS5 (firmware 13.60) did: 7200, 75 and 8 at first, 0 restoring a keepalive default, and a count stored as an unsigned value. They are not set on the host socket, so the host's keepalive timers are its own while `SO_KEEPALIVE` is applied there. An interval above 4294967 seconds fails with `EINVAL`, after FreeBSD 11.4's `tcp_default_ctloutput` with `hz` taken as 1000, and an accepted socket takes the keepalive values from its listener as `syncache_socket` copies them; neither was measured
 - [IP_TTL, IP_TOS, IP_MULTICAST_TTL, IP_MULTICAST_LOOP](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per `AF_INET` socket with the defaults (64, 0, 1, 1), the low-byte storage of `IP_TTL` and `IP_TOS`, the one-byte forms and the `EINVAL` above 255 of the multicast options that a payload process on a PS5 (firmware 13.60) showed. `IP_TTL` and the multicast options are also set on the host socket, except a time to live of 0, which hosts refuse; `IP_TOS` is only kept, so the host's packets carry its own type of service, and the host's default time to live (128 on Windows) is not changed to 64. An accepted socket takes `IP_TTL` and `IP_TOS` from its listener, as FreeBSD's `syncache_socket` does, and an `int` `IP_MULTICAST_LOOP` keeps only its low byte, as FreeBSD 11.4's `inp_setmoptions` does; neither was measured. Winsock applies `IP_MULTICAST_LOOP` on the receiving socket, not the sender, so on Windows the receiver's setting decides loopback
 - [SO_SNDBUF, SO_RCVBUF, SO_SNDLOWAT, SO_RCVLOWAT](../../../core/libs/prx/libkernel/Socket/src/SocketOptions.cpp) (libkernel) - kept per socket with the defaults, the 524288-byte limit, the `ENOBUFS` above 5592405 bytes and the low-water clipping of a payload process on a PS5 (firmware 13.60); the host socket gets the size asked for, so a request above the limit still enlarges the host's buffer. The host's real buffering, FreeBSD's automatic growth of a connected TCP socket's buffers, and a low-water mark's effect on `select`, `poll` and a receive are not reproduced. An accepted socket takes all four from its listener, as FreeBSD's [`sonewconn`](https://github.com/freebsd/freebsd-src/blob/8c639945a44588f6cfdddfb057bb5aad88735da0/sys/kern/uipc_socket.c#L603) does; that was not measured

From 640577c3ecfd4cdf443224d59ef90f1f0e0cd75d Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Mon, 26 Oct 2026 00:37:56 +0200
Subject: [PATCH 193/218] fix(relinker): keep the terminator before a decoded
 padding suffix

trailing[next] is Padding for an instruction that starts with 00 or CC
even when the rest of its bytes are code, so it is not the same as
padding[next]. The recurrence treated the two as interchangeable and
overwrote the trailing state of a syscall that precedes such an
instruction, which let the fallback extend the mask over it and made
both conversion routes accept the gap. Decide from the trailing state
whether the successor is padding.

The regression covers the table helper plus the executable and guest
module routes; without the correction the executable and module
conversions succeed instead of refusing syscall 9.
---
 .../src/analysis/RelativeJumpTables.cpp       |  2 +-
 .../relinker/tests/ControlFlowGraphTests.cpp  | 21 +++++++++++++++++++
 .../relinker/tests/test_sce_code_extent.py    | 14 ++++++++++---
 .../tests/test_sce_module_code_extent.py      |  9 ++++++--
 4 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index ce6b17e718..630abbb05d 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -155,7 +155,7 @@ public:
             const auto next = pos + info.Length;
             const bool isSyscall = IsForbiddenSyscallInstruction(code, pos, info);
             syscalls[pos] = isSyscall || syscalls[next];
-            if (!padding[next]) {
+            if (trailing[next] != Trailing::Padding) {
                 trailing[pos] = trailing[next];
                 continue;
             }
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index dccbd99d71..709e333898 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -502,6 +502,26 @@ void CheckEmbeddedDataTables() {
     Require(tablesWhirlpool[0].Begin == TextAddress + 32, "Whirlpool table start was incorrect");
 }
 
+void CheckDecodedPaddingSuffix() {
+    Bytes text(0x38, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + 0x10);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < 0x10; ++i) text[i] = 0xcc;
+    static constexpr std::uint8_t suffix[]{0x0f, 0x78, 0xcc, 0xb8, 0x09, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x00, 0x01, 0x90};
+    std::memcpy(text.data() + 0x10, suffix, sizeof(suffix));
+    text[0x30] = 0xc3;
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + 0x30, TextAddress + 0x38}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected one decoded data table before a padding-suffixed syscall");
+    Require(tables[0].Begin == TextAddress + 0x10 && tables[0].End == TextAddress + 0x12, "Mask extended over the syscall after a decoded padding suffix");
+}
+
 void CheckLargeZeroGaps() {
     constexpr std::size_t stride = 0x10000;
     constexpr std::size_t count = 32;
@@ -562,6 +582,7 @@ int main() {
         CheckHighVirtualAddress();
         CheckRelativeJumpTables();
         CheckEmbeddedDataTables();
+        CheckDecodedPaddingSuffix();
         CheckLargeZeroGaps();
         std::cout << "Control-flow graph tests passed\n";
         return 0;
diff --git a/core/relinker/relinker/tests/test_sce_code_extent.py b/core/relinker/relinker/tests/test_sce_code_extent.py
index 2f13121709..e423f6c15d 100644
--- a/core/relinker/relinker/tests/test_sce_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_code_extent.py
@@ -31,8 +31,9 @@ LATER_FUNCTION = 0x300
 
 def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False, data_pointer=False, gap_entry=False,
             plt_at=None, early_function=False, function_tls=False, pointer_target=None, gap_bytes=None, functions=None,
-            tls=False, gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False):
-    has_gap_embedded = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable
+            tls=False, gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False,
+            gap_decoded_padding_syscall=False):
+    has_gap_embedded = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall
     plt = (LATER_FUNCTION + FUNCTION_SIZE + gap if has_gap_embedded else FUNCTION + FUNCTION_SIZE + gap) if plt_at is None else plt_at
     entry = FUNCTION + FUNCTION_SIZE if gap_entry else FUNCTION
     data = plt + 0x20 if plt > FUNCTION else FUNCTION + FUNCTION_SIZE
@@ -103,7 +104,7 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         image[entry:entry + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
     if function_tls:
         image[FUNCTION:FUNCTION + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
-    if gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable:
+    if gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall:
         table = FUNCTION + FUNCTION_SIZE + 0x10
         image[FUNCTION:FUNCTION + 3] = b"\x48\x8d\x05"
         struct.pack_into("<iB", image, FUNCTION + 3, table - (FUNCTION + 7), 0xC3)
@@ -116,6 +117,9 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         elif gap_callback_syscall_undecodable:
             image[table:table + 14] = b"\xb8\x3b\x00\x00\x00\x0f\x05\x0f\x78\x11\x22\x33\x44\xc3"
             image[table + 14:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 14))
+        elif gap_decoded_padding_syscall:
+            image[table:table + 13] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\x00\x01\x90"
+            image[table + 13:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 13))
         else:
             image[table:LATER_FUNCTION] = b"\x0f\x78\x33\x1e" * ((LATER_FUNCTION - table) // 4)
         image[data:data + 0x30] = b"\x90" * 0x30
@@ -240,6 +244,10 @@ def main():
                 fixture(sce_block=True, gap_embedded_data=True), target=target)
             run(relinker, work, "sysv-gap-embedded-data-" + target,
                 fixture(sce_block=False, gap_embedded_data=True), target=target)
+            for name, sce_block in (("sce", True), ("sysv", False)):
+                run(relinker, work, name + "-gap-decoded-padding-syscall-" + target,
+                    fixture(sce_block=sce_block, gap_decoded_padding_syscall=True),
+                    "Forbidden syscall instruction", target=target)
             run(relinker, work, "gap-data-then-syscall-" + target,
                 fixture(sce_block=False, gap_data_then_syscall=True), "Forbidden syscall instruction", target=target)
             run(relinker, work, "gap-callback-syscall-" + target,
diff --git a/core/relinker/relinker/tests/test_sce_module_code_extent.py b/core/relinker/relinker/tests/test_sce_module_code_extent.py
index 17a8bc8a00..10f4ff2d3c 100644
--- a/core/relinker/relinker/tests/test_sce_module_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_module_code_extent.py
@@ -114,10 +114,11 @@ def unwind_table_multiple(text, base, functions, header, frame):
     struct.pack_into("<I", text, fde - base, 0)
 
 
-def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False):
+def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False,
+               gap_decoded_padding_syscall=False):
     image = bytearray(0xC00)
     tags = [(0x61000035, 0), (0x61000037, 1), (0x61000039, 0x20), (0x6100003B, 24), (0x6100003F, 24), (0, 0)]
-    has_gap = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable
+    has_gap = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall
     headers = [
         (PT_LOAD, 5, 0x400, 0x1000, 0x100, 0x100, 0x100),
         (PT_LOAD, 6, 0x600, 0x2000, 0x400, 0x400, 0x100),
@@ -143,6 +144,9 @@ def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callbac
         elif gap_callback_syscall_undecodable:
             text[table:table + 14] = b"\xb8\x3b\x00\x00\x00\x0f\x05\x0f\x78\x11\x22\x33\x44\xc3"
             text[table + 14:0x40] = b"\x90" * 18
+        elif gap_decoded_padding_syscall:
+            text[table:table + 13] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\x00\x01\x90"
+            text[table + 13:0x40] = b"\x90" * (0x40 - (table + 13))
         else:
             text[table:0x40] = b"\x0f\x78\x33\x1e" * 8
         text[0x40:0x48] = b"\xc3" + b"\x90" * 7
@@ -192,6 +196,7 @@ def main():
             run_module(relinker, work, "sce-module-gap-embedded-data-" + system, sce_module(gap_embedded_data=True), flags)
             run_module(relinker, work, "sce-module-gap-data-then-syscall-" + system, sce_module(gap_data_then_syscall=True), flags, "Forbidden syscall instruction")
             run_module(relinker, work, "sce-module-gap-callback-syscall-" + system, sce_module(gap_callback_syscall_undecodable=True), flags, "Forbidden syscall instruction")
+            run_module(relinker, work, "sce-module-gap-decoded-padding-syscall-" + system, sce_module(gap_decoded_padding_syscall=True), flags, "Forbidden syscall instruction")
     print("SCE module code extent tests passed")
 
 

From 1674e450e962b61341fc85782cdd4e64bcc8b5ac Mon Sep 17 00:00:00 2001
From: lakhantheboss <61951686+lakhantheboss@users.noreply.github.com>
Date: Mon, 26 Oct 2026 04:34:43 +0530
Subject: [PATCH 194/218] fix(libSceRegMgr): preserve unsupported zero-length
 paths

---
 core/libs/prx/libSceRegMgr/Export.cpp | 6 ++++--
 core/libs/tests/GuestRegMgr.cpp       | 2 --
 docs/dev/debt/libSceRegMgr.md         | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/libs/prx/libSceRegMgr/Export.cpp b/core/libs/prx/libSceRegMgr/Export.cpp
index 07cc796290..84326f6c25 100644
--- a/core/libs/prx/libSceRegMgr/Export.cpp
+++ b/core/libs/prx/libSceRegMgr/Export.cpp
@@ -44,7 +44,8 @@ public:
     }
 
     int getStr(int64_t key, char* out, int len) {
-        if (out == nullptr || len <= 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        if (len == 0) NotImplemented_nid_no_patch(__func__);
+        if (out == nullptr || len < 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
         std::lock_guard<std::mutex> lock(mutex_);
         auto it = entries_.find(key);
         if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
@@ -55,7 +56,8 @@ public:
     }
 
     int getBin(int64_t key, void* out, int size) {
-        if (out == nullptr || size <= 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
+        if (size == 0) NotImplemented_nid_no_patch(__func__);
+        if (out == nullptr || size < 0) return SCE_REG_MGR_ERROR_INVALID_PARAM;
         std::lock_guard<std::mutex> lock(mutex_);
         auto it = entries_.find(key);
         if (it == entries_.end()) return SCE_REG_MGR_ERROR_NOT_FOUND;
diff --git a/core/libs/tests/GuestRegMgr.cpp b/core/libs/tests/GuestRegMgr.cpp
index 179435c09c..ec355a78f7 100644
--- a/core/libs/tests/GuestRegMgr.cpp
+++ b/core/libs/tests/GuestRegMgr.cpp
@@ -29,10 +29,8 @@ int main() {
 
     Require(sceRegMgrGetInt(0x1000, nullptr) == static_cast<int>(0x80820001));
     Require(sceRegMgrGetStr(0x1001, nullptr, 10) == static_cast<int>(0x80820001));
-    Require(sceRegMgrGetStr(0x1001, strBuf, 0) == static_cast<int>(0x80820001));
     Require(sceRegMgrGetStr(0x1001, strBuf, -1) == static_cast<int>(0x80820001));
     Require(sceRegMgrGetBin(0x1002, nullptr, 10) == static_cast<int>(0x80820001));
-    Require(sceRegMgrGetBin(0x1002, binBuf, 0) == static_cast<int>(0x80820001));
     Require(sceRegMgrGetBin(0x1002, binBuf, -1) == static_cast<int>(0x80820001));
 
     intVal = 0x55AA;
diff --git a/docs/dev/debt/libSceRegMgr.md b/docs/dev/debt/libSceRegMgr.md
index 53f952c029..939ecae49d 100644
--- a/docs/dev/debt/libSceRegMgr.md
+++ b/docs/dev/debt/libSceRegMgr.md
@@ -2,7 +2,7 @@
 
 ### Functional
 
-- [Registry store](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - entries are queried through an in-memory process-local store without persistence. Callable prototypes for `sceRegMgrGetInt`, `sceRegMgrGetStr`, and `sceRegMgrGetBin` derive from [regmgr.h](https://github.com/ps5-payload-dev/regdump/blob/883524cc48c8497267ba7fc94ff0ac58880c4227/regmgr.h#L3713-L3729). Setters (`sceRegMgrSetInt`, `sceRegMgrSetStr`, `sceRegMgrSetBin`, `sceRegMgrSetbin`), reset (`sceRegMgrResetVal`), and return error codes remain unimplemented throwing `NotImplemented_nid_no_patch` until callable contracts and error codes are supported by evidence.
+- [Registry store](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - entries are queried through an in-memory process-local store without persistence. Callable prototypes for `sceRegMgrGetInt`, `sceRegMgrGetStr`, and `sceRegMgrGetBin` derive from [regmgr.h](https://github.com/ps5-payload-dev/regdump/blob/883524cc48c8497267ba7fc94ff0ac58880c4227/regmgr.h#L3713-L3729). Implemented getters return error codes for invalid parameters (`0x80820001`), missing keys (`0x80820002`), buffer sizing (`0x80820004`), and type mismatches (`0x80820006`) as unverified host implementation assumptions, as the cited regmgr.h does not establish error codes or validation behavior. Setters (`sceRegMgrSetInt`, `sceRegMgrSetStr`, `sceRegMgrSetBin`, `sceRegMgrSetbin`), reset (`sceRegMgrResetVal`), and zero-length getter paths remain unimplemented throwing `NotImplemented_nid_no_patch` until callable contracts and error codes are supported by evidence.
 - [Unverified registry APIs](../../../core/libs/prx/libSceRegMgr/Export.cpp) (libSceRegMgr) - export names and NIDs for initial-value getters, version queries, region queries and conversions, error checks, control/backup routines, and `sceRegMgrNonSys*` variants are present in the [PS5 3.20 export inventory](https://github.com/DNNDHH/PS5-3.20_Libs/blob/cf6eede3f6588d779664e01874638f09484324b7/libSceRegMgr.c) and [NID database](https://github.com/zecoxao/sce_symbols/blob/9620e03b2964dbf0cfc1cb143ab24a65125091de/aerolib.csv), but their callable contracts and runtime behavior remain unverified and retain `NotImplemented_nid_no_patch`.
 
 ### Unknown function info

From fff18d2f3b12e1654d266bb84f2b8337b5fea0b8 Mon Sep 17 00:00:00 2001
From: Muhammad Wasif Ali Wasif <76695420+wachi35676@users.noreply.github.com>
Date: Mon, 26 Oct 2026 02:28:37 +0500
Subject: [PATCH 195/218] test(libSceSystemService): accept the write watch
 diagnostic before the LoadExec child's line

guest_system_load_exec_standard_error compared the host standard error of
the re-executed child with "started <mode>\n" exactly. On a Linux kernel
without asynchronous userfaultfd write protection (before 6.7, such as
WSL2's 6.6) libc prints "[memory] write watch unavailable: ..." to the
host standard error at start-up, so the comparison failed and the test
aborted on every run. That one diagnostic line is now skipped when it
comes first; the rest of the host stream must still be the child's line
exactly, and the guest pipe must still be empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01En5cnt6RwCiNXDJwm9t8Tf
---
 .../GuestSystemServiceLoadExecStandardError.cpp    | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp b/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
index 777c63ba32..f054b5793b 100644
--- a/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
+++ b/core/libs/tests/GuestSystemServiceLoadExecStandardError.cpp
@@ -5,6 +5,7 @@
 #include <cstdlib>
 #include <cstring>
 #include <string>
+#include <string_view>
 #include <sys/wait.h>
 #include <unistd.h>
 
@@ -25,6 +26,17 @@ std::string Drain(int descriptor) {
     return text;
 }
 
+bool HostOutputIs(const std::string& text, const std::string& line) {
+    constexpr std::string_view WriteWatchUnavailable = "[memory] write watch unavailable: ";
+    std::size_t begin = 0;
+    if (text.compare(0, WriteWatchUnavailable.size(), WriteWatchUnavailable) == 0) {
+        const std::size_t end = text.find('\n');
+        if (end == std::string::npos) return false;
+        begin = end + 1;
+    }
+    return text.compare(begin, std::string::npos, line) == 0;
+}
+
 void Run(const char* mode, const char* const* arguments) {
     int host[2] = {-1, -1};
     int guest[2] = {-1, -1};
@@ -50,7 +62,7 @@ void Run(const char* mode, const char* const* arguments) {
     int status = 0;
     Require(::waitpid(child, &status, 0) == child);
     Require(WIFEXITED(status) && WEXITSTATUS(status) == 0);
-    Require(hostText == std::string("started ") + mode + "\n");
+    Require(HostOutputIs(hostText, std::string("started ") + mode + "\n"));
     Require(guestText.empty());
 }
 

From ac1dc93255473450326f39049b1d7a0f1f843a99 Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Mon, 26 Oct 2026 01:23:39 +0200
Subject: [PATCH 196/218] perf(relinker): binary-search function ranges for gap
 branch targets

Every pending gap target walked the whole unwind function vector, so a
large executable cost targets x functions. Sort and merge the ranges once,
then use upper_bound for each target.
---
 .../src/analysis/RelativeJumpTables.cpp       | 20 ++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index 630abbb05d..ce33b4f4a8 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -320,19 +320,25 @@ std::vector<RelativeJumpTable> FindRelativeJumpTables(std::span<const std::uint8
             pos += info.Length;
         }
     }
+    auto knownFunctions = functions;
+    std::erase_if(knownFunctions, [](const auto& range) { return range.first >= range.second; });
+    std::sort(knownFunctions.begin(), knownFunctions.end());
+    std::vector<std::pair<VirtualAddress, VirtualAddress>> mergedFunctions;
+    for (const auto& range : knownFunctions) {
+        if (!mergedFunctions.empty() && range.first <= mergedFunctions.back().second)
+            mergedFunctions.back().second = std::max(mergedFunctions.back().second, range.second);
+        else
+            mergedFunctions.emplace_back(range);
+    }
     std::vector<VirtualAddress> pendingTargets(branchTargets.begin(), branchTargets.end());
     std::set<VirtualAddress> exploredGaps;
     while (!pendingTargets.empty()) {
         const auto current = pendingTargets.back();
         pendingTargets.pop_back();
         if (current < segmentVAddr || current >= segmentEnd) continue;
-        bool inKnownFunction = false;
-        for (const auto& [funcBegin, funcEnd] : functions) {
-            if (current >= funcBegin && current < funcEnd) {
-                inKnownFunction = true;
-                break;
-            }
-        }
+        const auto after = std::upper_bound(mergedFunctions.begin(), mergedFunctions.end(), current,
+            [](VirtualAddress value, const auto& range) { return value < range.first; });
+        const bool inKnownFunction = after != mergedFunctions.begin() && current < std::prev(after)->second;
         if (inKnownFunction || !exploredGaps.insert(current).second) continue;
         auto pos = static_cast<std::size_t>(current - segmentVAddr);
         while (pos < segment.size()) {

From 3cb3e8f53ba29296f07676428d349b851850987c Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Mon, 26 Oct 2026 01:23:47 +0200
Subject: [PATCH 197/218] fix(relinker): end the data table mask at a
 control-flow terminator

A gap that holds a table, padding and then a syscall stub followed by
non-padding data classified the stub as invalid, so the mask ran to the end
of the gap and hid the syscall from the scan. Mark any instruction that ends
control flow as a terminator, which stops the mask before that block.

Covered by the helper test and by the SCE, SysV and guest-module conversion
tests, which convert before the change and refuse syscall 9 after it.
---
 .../src/analysis/RelativeJumpTables.cpp       |  8 ++++---
 .../relinker/tests/ControlFlowGraphTests.cpp  | 24 +++++++++++++++++++
 .../relinker/tests/test_sce_code_extent.py    | 12 +++++++---
 .../tests/test_sce_module_code_extent.py      |  8 +++++--
 4 files changed, 44 insertions(+), 8 deletions(-)

diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index ce33b4f4a8..d39fdb766f 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -155,13 +155,15 @@ public:
             const auto next = pos + info.Length;
             const bool isSyscall = IsForbiddenSyscallInstruction(code, pos, info);
             syscalls[pos] = isSyscall || syscalls[next];
+            if (EndsControlFlow(info, isSyscall)) {
+                trailing[pos] = Trailing::Terminator;
+                continue;
+            }
             if (trailing[next] != Trailing::Padding) {
                 trailing[pos] = trailing[next];
                 continue;
             }
-            trailing[pos] = nop || code[pos] == 0xcc || code[pos] == 0x00
-                ? Trailing::Padding
-                : (EndsControlFlow(info, isSyscall) ? Trailing::Terminator : Trailing::NonTerminator);
+            trailing[pos] = nop || code[pos] == 0xcc || code[pos] == 0x00 ? Trailing::Padding : Trailing::NonTerminator;
         }
     }
 
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 709e333898..475ae9d66a 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -522,6 +522,29 @@ void CheckDecodedPaddingSuffix() {
     Require(tables[0].Begin == TextAddress + 0x10 && tables[0].End == TextAddress + 0x12, "Mask extended over the syscall after a decoded padding suffix");
 }
 
+void CheckStubBeforeUndecodableData() {
+    Bytes text(0x38, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + 0x10);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < 0x10; ++i) text[i] = 0xcc;
+    static constexpr std::uint8_t suffix[]{
+        0x0f, 0x78, 0xcc, 0xb8, 0x09, 0x00, 0x00, 0x00,
+        0x0f, 0x05, 0xc3, 0x0f, 0x78, 0x33, 0x1e
+    };
+    std::memcpy(text.data() + 0x10, suffix, sizeof(suffix));
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + text.size(), TextAddress + text.size() + 8}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected one data table before a syscall stub followed by undecodable data");
+    Require(tables[0].Begin == TextAddress + 0x10, "Data table start before a syscall stub was incorrect");
+    Require(tables[0].End <= TextAddress + 0x13, "Mask covered the syscall stub before undecodable data");
+}
+
 void CheckLargeZeroGaps() {
     constexpr std::size_t stride = 0x10000;
     constexpr std::size_t count = 32;
@@ -583,6 +606,7 @@ int main() {
         CheckRelativeJumpTables();
         CheckEmbeddedDataTables();
         CheckDecodedPaddingSuffix();
+        CheckStubBeforeUndecodableData();
         CheckLargeZeroGaps();
         std::cout << "Control-flow graph tests passed\n";
         return 0;
diff --git a/core/relinker/relinker/tests/test_sce_code_extent.py b/core/relinker/relinker/tests/test_sce_code_extent.py
index e423f6c15d..e7dafe53c9 100644
--- a/core/relinker/relinker/tests/test_sce_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_code_extent.py
@@ -32,8 +32,8 @@ LATER_FUNCTION = 0x300
 def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False, data_pointer=False, gap_entry=False,
             plt_at=None, early_function=False, function_tls=False, pointer_target=None, gap_bytes=None, functions=None,
             tls=False, gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False,
-            gap_decoded_padding_syscall=False):
-    has_gap_embedded = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall
+            gap_decoded_padding_syscall=False, gap_stub_then_data=False):
+    has_gap_embedded = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall or gap_stub_then_data
     plt = (LATER_FUNCTION + FUNCTION_SIZE + gap if has_gap_embedded else FUNCTION + FUNCTION_SIZE + gap) if plt_at is None else plt_at
     entry = FUNCTION + FUNCTION_SIZE if gap_entry else FUNCTION
     data = plt + 0x20 if plt > FUNCTION else FUNCTION + FUNCTION_SIZE
@@ -104,7 +104,7 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         image[entry:entry + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
     if function_tls:
         image[FUNCTION:FUNCTION + len(UNSUPPORTED_TLS)] = UNSUPPORTED_TLS
-    if gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall:
+    if gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall or gap_stub_then_data:
         table = FUNCTION + FUNCTION_SIZE + 0x10
         image[FUNCTION:FUNCTION + 3] = b"\x48\x8d\x05"
         struct.pack_into("<iB", image, FUNCTION + 3, table - (FUNCTION + 7), 0xC3)
@@ -120,6 +120,9 @@ def fixture(sce_block=True, plt_push_offset=8, gap=0, interpreter_pointer=False,
         elif gap_decoded_padding_syscall:
             image[table:table + 13] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\x00\x01\x90"
             image[table + 13:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 13))
+        elif gap_stub_then_data:
+            image[table:table + 15] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\xc3\x0f\x78\x33\x1e"
+            image[table + 15:LATER_FUNCTION] = b"\x90" * (LATER_FUNCTION - (table + 15))
         else:
             image[table:LATER_FUNCTION] = b"\x0f\x78\x33\x1e" * ((LATER_FUNCTION - table) // 4)
         image[data:data + 0x30] = b"\x90" * 0x30
@@ -248,6 +251,9 @@ def main():
                 run(relinker, work, name + "-gap-decoded-padding-syscall-" + target,
                     fixture(sce_block=sce_block, gap_decoded_padding_syscall=True),
                     "Forbidden syscall instruction", target=target)
+                run(relinker, work, name + "-gap-stub-then-data-" + target,
+                    fixture(sce_block=sce_block, gap_stub_then_data=True),
+                    "Forbidden syscall instruction", target=target)
             run(relinker, work, "gap-data-then-syscall-" + target,
                 fixture(sce_block=False, gap_data_then_syscall=True), "Forbidden syscall instruction", target=target)
             run(relinker, work, "gap-callback-syscall-" + target,
diff --git a/core/relinker/relinker/tests/test_sce_module_code_extent.py b/core/relinker/relinker/tests/test_sce_module_code_extent.py
index 10f4ff2d3c..b2d52622cd 100644
--- a/core/relinker/relinker/tests/test_sce_module_code_extent.py
+++ b/core/relinker/relinker/tests/test_sce_module_code_extent.py
@@ -115,10 +115,10 @@ def unwind_table_multiple(text, base, functions, header, frame):
 
 
 def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callback_syscall_undecodable=False,
-               gap_decoded_padding_syscall=False):
+               gap_decoded_padding_syscall=False, gap_stub_then_data=False):
     image = bytearray(0xC00)
     tags = [(0x61000035, 0), (0x61000037, 1), (0x61000039, 0x20), (0x6100003B, 24), (0x6100003F, 24), (0, 0)]
-    has_gap = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall
+    has_gap = gap_embedded_data or gap_data_then_syscall or gap_callback_syscall_undecodable or gap_decoded_padding_syscall or gap_stub_then_data
     headers = [
         (PT_LOAD, 5, 0x400, 0x1000, 0x100, 0x100, 0x100),
         (PT_LOAD, 6, 0x600, 0x2000, 0x400, 0x400, 0x100),
@@ -147,6 +147,9 @@ def sce_module(gap_embedded_data=False, gap_data_then_syscall=False, gap_callbac
         elif gap_decoded_padding_syscall:
             text[table:table + 13] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\x00\x01\x90"
             text[table + 13:0x40] = b"\x90" * (0x40 - (table + 13))
+        elif gap_stub_then_data:
+            text[table:table + 15] = b"\x0f\x78\xcc\xb8\x09\x00\x00\x00\x0f\x05\xc3\x0f\x78\x33\x1e"
+            text[table + 15:0x40] = b"\x90" * (0x40 - (table + 15))
         else:
             text[table:0x40] = b"\x0f\x78\x33\x1e" * 8
         text[0x40:0x48] = b"\xc3" + b"\x90" * 7
@@ -197,6 +200,7 @@ def main():
             run_module(relinker, work, "sce-module-gap-data-then-syscall-" + system, sce_module(gap_data_then_syscall=True), flags, "Forbidden syscall instruction")
             run_module(relinker, work, "sce-module-gap-callback-syscall-" + system, sce_module(gap_callback_syscall_undecodable=True), flags, "Forbidden syscall instruction")
             run_module(relinker, work, "sce-module-gap-decoded-padding-syscall-" + system, sce_module(gap_decoded_padding_syscall=True), flags, "Forbidden syscall instruction")
+            run_module(relinker, work, "sce-module-gap-stub-then-data-" + system, sce_module(gap_stub_then_data=True), flags, "Forbidden syscall instruction")
     print("SCE module code extent tests passed")
 
 

From a36fd27f64513a9dd20efbc92f9f3d88509f958f Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:43:17 +0000
Subject: [PATCH 198/218] fix(freetype): reconcile provider NIDs and public
 declarations

---
 core/libs/prx/libSceFreeType/include/Api.hpp  |  3 +++
 .../prx/libSceFreeType/src/OutlineBorders.cpp |  2 +-
 .../prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp |  2 ++
 core/libs/prx/libSceFreeTypeOt/Export.cpp     | 20 +++++++++----------
 .../prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp |  2 ++
 .../libs/tests/GuestFreeTypeOutlineBorder.cpp |  6 ++++--
 docs/dev/debt/libSceFreeTypeOt.md             |  4 +++-
 7 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/core/libs/prx/libSceFreeType/include/Api.hpp b/core/libs/prx/libSceFreeType/include/Api.hpp
index ac044b7919..163d4120df 100644
--- a/core/libs/prx/libSceFreeType/include/Api.hpp
+++ b/core/libs/prx/libSceFreeType/include/Api.hpp
@@ -6,6 +6,9 @@
 
 extern "C" {
 
+std::int32_t APS5_VABI FT_Outline_GetInsideBorder_nid_postfix(const FreeType::GuestOutline* outline);
+std::int32_t APS5_VABI FT_Outline_GetOutsideBorder_nid_postfix(const FreeType::GuestOutline* outline);
+
 int APS5_VABI FT_Init_FreeType_nid_postfix(FreeType::GuestLibrary** alibrary);
 int APS5_VABI FT_Done_FreeType_nid_postfix(FreeType::GuestLibrary* library);
 int APS5_VABI FT_New_Face_nid_postfix(FreeType::GuestLibrary* library, const char* filepathname, std::int64_t faceIndex, FreeType::GuestFaceRec** aface);
diff --git a/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp b/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
index 0362e25ff0..34d54d7c03 100644
--- a/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
+++ b/core/libs/prx/libSceFreeType/src/OutlineBorders.cpp
@@ -1,4 +1,4 @@
-#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "prx/libSceFreeType/include/Api.hpp"
 #include <algorithm>
 #include <bit>
 #include <cstdint>
diff --git a/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp b/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
index 6f70f09bee..e1970ef93b 100644
--- a/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
+++ b/core/libs/prx/libSceFreeTypeOl/libSceFreeTypeOl.hpp
@@ -1 +1,3 @@
 #pragma once
+
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/prx/libSceFreeTypeOt/Export.cpp b/core/libs/prx/libSceFreeTypeOt/Export.cpp
index dd0e06da52..d4478564f0 100644
--- a/core/libs/prx/libSceFreeTypeOt/Export.cpp
+++ b/core/libs/prx/libSceFreeTypeOt/Export.cpp
@@ -216,10 +216,10 @@ int APS5_VABI sceFreeTypeOtUnknown_4RRjK_Wd1lU_nid_no_patch() {
 }
 APS5_EXPORT("4RRjK-Wd1lU", sceFreeTypeOtUnknown_4RRjK_Wd1lU_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_weVsBCT_TTQ_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtOutlineGetOrientation_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("weVsBCT+TTQ", sceFreeTypeOtUnknown_weVsBCT_TTQ_nid_no_patch);
+APS5_EXPORT("weVsBCT+TTQ", sceFreeTypeOtOutlineGetOrientation_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_QH2emcgeFck_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
@@ -301,10 +301,10 @@ int APS5_VABI sceFreeTypeOtUnknown_z9Wsaf34JA4_nid_no_patch() {
 }
 APS5_EXPORT("z9Wsaf34JA4", sceFreeTypeOtUnknown_z9Wsaf34JA4_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_PaDk9bdmdhU_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtRequestSize_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("PaDk9bdmdhU", sceFreeTypeOtUnknown_PaDk9bdmdhU_nid_no_patch);
+APS5_EXPORT("PaDk9bdmdhU", sceFreeTypeOtRequestSize_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_Z8KG6700sw4_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
@@ -341,10 +341,10 @@ int APS5_VABI sceFreeTypeOtUnknown_yCEJIsjIOO8_nid_no_patch() {
 }
 APS5_EXPORT("yCEJIsjIOO8", sceFreeTypeOtUnknown_yCEJIsjIOO8_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_L1uHkWTazkI_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtSin_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("L1uHkWTazkI", sceFreeTypeOtUnknown_L1uHkWTazkI_nid_no_patch);
+APS5_EXPORT("L1uHkWTazkI", sceFreeTypeOtSin_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_C7N2GuwqTA0_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
@@ -616,10 +616,10 @@ int APS5_VABI sceFreeTypeOtUnknown_B3uU5aDZn94_nid_no_patch() {
 }
 APS5_EXPORT("B3uU5aDZn94", sceFreeTypeOtUnknown_B3uU5aDZn94_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_dojyaLKzKN0_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtTan_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("dojyaLKzKN0", sceFreeTypeOtUnknown_dojyaLKzKN0_nid_no_patch);
+APS5_EXPORT("dojyaLKzKN0", sceFreeTypeOtTan_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_08_mhD_AAds_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
@@ -666,10 +666,10 @@ int APS5_VABI sceFreeTypeOtUnknown_PrZtZyFwM6c_nid_no_patch() {
 }
 APS5_EXPORT("PrZtZyFwM6c", sceFreeTypeOtUnknown_PrZtZyFwM6c_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_3WpTQrvGUcU_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtVectorUnit_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("3WpTQrvGUcU", sceFreeTypeOtUnknown_3WpTQrvGUcU_nid_no_patch);
+APS5_EXPORT("3WpTQrvGUcU", sceFreeTypeOtVectorUnit_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_P6WOAeb0lJ8_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
diff --git a/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp b/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
index 6f70f09bee..e1970ef93b 100644
--- a/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
+++ b/core/libs/prx/libSceFreeTypeOt/libSceFreeTypeOt.hpp
@@ -1 +1,3 @@
 #pragma once
+
+#include "prx/libSceFreeType/include/Api.hpp"
diff --git a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
index e191a4c131..28dd07b908 100644
--- a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
+++ b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
@@ -1,4 +1,4 @@
-#include "prx/libSceFreeType/include/GuestFreeType.hpp"
+#include "prx/libSceFreeType/include/Api.hpp"
 #include <ft2build.h>
 #include FT_FREETYPE_H
 #include FT_STROKER_H
@@ -13,6 +13,7 @@
 #include <stdexcept>
 #include <string>
 #include <thread>
+#include <type_traits>
 #include <vector>
 #ifdef _WIN32
 #include <windows.h>
@@ -24,7 +25,8 @@
 
 using FreeType::GuestOutline;
 using FreeType::GuestVector;
-using Query = int (APS5_VABI*)(const GuestOutline*);
+using Query = decltype(&FT_Outline_GetInsideBorder_nid_postfix);
+static_assert(std::is_same_v<Query, decltype(&FT_Outline_GetOutsideBorder_nid_postfix)>);
 static_assert(sizeof(GuestOutline) == 40 && alignof(GuestOutline) == 8);
 static_assert(offsetof(GuestOutline, points) == 8 && offsetof(GuestOutline, contours) == 24);
 static_assert(offsetof(GuestOutline, flags) == 32 && sizeof(GuestVector) == 16);
diff --git a/docs/dev/debt/libSceFreeTypeOt.md b/docs/dev/debt/libSceFreeTypeOt.md
index 09b25390e2..2babe4103e 100644
--- a/docs/dev/debt/libSceFreeTypeOt.md
+++ b/docs/dev/debt/libSceFreeTypeOt.md
@@ -4,4 +4,6 @@
 
 - [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeTypeOt/CMakeLists.txt) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.
 
-- The 148 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
+- The 143 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
+
+- The FT_Outline_Get_Orientation, FT_Request_Size, FT_Sin, FT_Tan and FT_Vector_Unit NIDs in this provider are identified, but their provider-specific prototypes and behavior remain unverified. Their named helpers retain the explicit inventory aliases and throw; the separate libSceFreeType implementations do not supply this provider.

From 54dadc019e415d286a2ed1ca6fb4091b4ece6e68 Mon Sep 17 00:00:00 2001
From: Kraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Sun, 25 Oct 2026 23:43:52 +0000
Subject: [PATCH 199/218] fix(freetype): retain newly identified Ot inventory
 aliases

---
 core/libs/prx/libSceFreeTypeOt/Export.cpp | 12 ++++++------
 docs/dev/debt/libSceFreeTypeOt.md         |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/core/libs/prx/libSceFreeTypeOt/Export.cpp b/core/libs/prx/libSceFreeTypeOt/Export.cpp
index d4478564f0..c4ec1cd9ca 100644
--- a/core/libs/prx/libSceFreeTypeOt/Export.cpp
+++ b/core/libs/prx/libSceFreeTypeOt/Export.cpp
@@ -156,10 +156,10 @@ int APS5_VABI sceFreeTypeOtUnknown_tCMhTh7h8D4_nid_no_patch() {
 }
 APS5_EXPORT("tCMhTh7h8D4", sceFreeTypeOtUnknown_tCMhTh7h8D4_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_zyezaHweY3U_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtNewSize_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("zyezaHweY3U", sceFreeTypeOtUnknown_zyezaHweY3U_nid_no_patch);
+APS5_EXPORT("zyezaHweY3U", sceFreeTypeOtNewSize_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_C_PpdS5zris_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
@@ -176,15 +176,15 @@ int APS5_VABI sceFreeTypeOtUnknown_OeNH41MA2Vs_nid_no_patch() {
 }
 APS5_EXPORT("OeNH41MA2Vs", sceFreeTypeOtUnknown_OeNH41MA2Vs_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown_Bhm8Injl0KA_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtOutlineCopy_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("Bhm8Injl0KA", sceFreeTypeOtUnknown_Bhm8Injl0KA_nid_no_patch);
+APS5_EXPORT("Bhm8Injl0KA", sceFreeTypeOtOutlineCopy_nid_no_patch);
 
-int APS5_VABI sceFreeTypeOtUnknown___lgV9pRsO4_nid_no_patch() {
+int APS5_VABI sceFreeTypeOtOutlineDecompose_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
 }
-APS5_EXPORT("++lgV9pRsO4", sceFreeTypeOtUnknown___lgV9pRsO4_nid_no_patch);
+APS5_EXPORT("++lgV9pRsO4", sceFreeTypeOtOutlineDecompose_nid_no_patch);
 
 int APS5_VABI sceFreeTypeOtUnknown_BqGJsJcFYaM_nid_no_patch() {
     NotImplemented_nid_no_patch(__func__);
diff --git a/docs/dev/debt/libSceFreeTypeOt.md b/docs/dev/debt/libSceFreeTypeOt.md
index 2babe4103e..6e93bdf35f 100644
--- a/docs/dev/debt/libSceFreeTypeOt.md
+++ b/docs/dev/debt/libSceFreeTypeOt.md
@@ -4,6 +4,6 @@
 
 - [FT_Outline_GetInsideBorder, FT_Outline_GetOutsideBorder](../../../core/libs/prx/libSceFreeTypeOt/CMakeLists.txt) (libSceFreeTypeOl, libSceFreeTypeOt) - console prototypes, enum/layout equivalence, FreeType configuration and module/library versions are unverified. The existing LP64 outline layout and unsigned 16-bit counts follow bundled FreeType 2.13.3; border selection follows [ftstroke.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftstroke.c), with the shifted polygon area from [ftoutln.c](https://github.com/freetype/freetype/blob/42608f77f20749dd6ddc9e0536788eaad70ea4b5/src/base/ftoutln.c) accumulated in 64 bits. Null positive-count arrays and out-of-range or non-increasing contour endpoints throw when reached; their console behavior is unknown. Tags and flags are not read, and input arrays remain caller-owned.
 
-- The 143 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
+- The 140 `sceFreeTypeOtUnknown_*_nid_no_patch` exports in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are present in the PS5 3.20 export inventory from [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs). Their prototypes and behavior are unverified. Each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`; these declarations make no ABI or behavior claim.
 
-- The FT_Outline_Get_Orientation, FT_Request_Size, FT_Sin, FT_Tan and FT_Vector_Unit NIDs in this provider are identified, but their provider-specific prototypes and behavior remain unverified. Their named helpers retain the explicit inventory aliases and throw; the separate libSceFreeType implementations do not supply this provider.
+- The FT_Outline_Get_Orientation, FT_Request_Size, FT_Sin, FT_Tan, FT_Vector_Unit, FT_New_Size, FT_Outline_Copy and FT_Outline_Decompose NIDs in [Export.cpp](../../../core/libs/prx/libSceFreeTypeOt/Export.cpp) are identified, but their provider-specific prototypes and behavior remain unverified. Their named helpers retain the explicit inventory aliases and throw; the separate libSceFreeType implementations do not supply this provider.

From 133ae3261f839a540269fd7bdd862a64aaafb607 Mon Sep 17 00:00:00 2001
From: Brainiac91 <alin.negut@gmail.com>
Date: Mon, 26 Oct 2026 02:02:49 +0200
Subject: [PATCH 200/218] fix(relinker): only end the gap mask at a block that
 holds a syscall

A chain of table bytes that decodes to a return after a padding run looked
like trailing gap code and stopped the mask inside a real table, which hands
the rest of it back to the decoder. Truncating now needs the block to contain
a syscall, or to end where the gap turns into padding, so a 2 KiB table with
00/cc/90 runs and return-like bytes stays masked.
---
 .../src/analysis/RelativeJumpTables.cpp       |  2 +-
 .../relinker/tests/ControlFlowGraphTests.cpp  | 31 +++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
index d39fdb766f..0171c49c9b 100644
--- a/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
+++ b/core/relinker/relinker/src/analysis/RelativeJumpTables.cpp
@@ -156,7 +156,7 @@ public:
             const bool isSyscall = IsForbiddenSyscallInstruction(code, pos, info);
             syscalls[pos] = isSyscall || syscalls[next];
             if (EndsControlFlow(info, isSyscall)) {
-                trailing[pos] = Trailing::Terminator;
+                trailing[pos] = isSyscall || trailing[next] == Trailing::Padding ? Trailing::Terminator : Trailing::NonTerminator;
                 continue;
             }
             if (trailing[next] != Trailing::Padding) {
diff --git a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
index 475ae9d66a..aa79bae7f0 100644
--- a/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
+++ b/core/relinker/relinker/tests/ControlFlowGraphTests.cpp
@@ -545,6 +545,36 @@ void CheckStubBeforeUndecodableData() {
     Require(tables[0].End <= TextAddress + 0x13, "Mask covered the syscall stub before undecodable data");
 }
 
+void CheckTableWithPaddingAndReturnBytes() {
+    constexpr std::size_t gap = 0x800;
+    Bytes text(0x10 + gap, 0x90);
+    text[0] = 0x48;
+    text[1] = 0x8d;
+    text[2] = 0x05;
+    SetDisplacement(text, 3, 7, TextAddress + 0x10);
+    text[7] = 0xc3;
+    for (std::size_t i = 8; i < 0x10; ++i) text[i] = 0xcc;
+    static constexpr std::uint8_t row[]{
+        0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8,
+        0x18, 0x18, 0x60, 0x18, 0xc0, 0x78, 0x30, 0xd8,
+        0x0f, 0x78, 0x33, 0x1e
+    };
+    for (std::size_t at = 0x10; at + sizeof(row) <= text.size(); at += sizeof(row))
+        std::memcpy(text.data() + at, row, sizeof(row));
+    static constexpr std::uint8_t paddedChain[]{0x00, 0xcc, 0x90, 0x48, 0x89, 0xc0, 0xc3};
+    static constexpr std::uint8_t alignedChain[]{0x00, 0xcc, 0x90, 0x00, 0x48, 0x89, 0xc0, 0xc3};
+    std::memcpy(text.data() + 0x10 + 0x3b8, paddedChain, sizeof(paddedChain));
+    std::memcpy(text.data() + 0x10 + 0x4ac, alignedChain, sizeof(alignedChain));
+    const std::vector<std::pair<VirtualAddress, VirtualAddress>> functions{
+        {TextAddress, TextAddress + 8},
+        {TextAddress + text.size(), TextAddress + text.size() + 8}
+    };
+    const auto tables = Relinker::FindRelativeJumpTables(text, TextAddress, functions);
+    Require(tables.size() == 1, "Expected a table with padding and return bytes to be recognized");
+    Require(tables[0].Begin == TextAddress + 0x10, "Table with padding and return bytes started at the wrong address");
+    Require(tables[0].End == TextAddress + text.size(), "Mask stopped inside a table with padding and return bytes");
+}
+
 void CheckLargeZeroGaps() {
     constexpr std::size_t stride = 0x10000;
     constexpr std::size_t count = 32;
@@ -607,6 +637,7 @@ int main() {
         CheckEmbeddedDataTables();
         CheckDecodedPaddingSuffix();
         CheckStubBeforeUndecodableData();
+        CheckTableWithPaddingAndReturnBytes();
         CheckLargeZeroGaps();
         std::cout << "Control-flow graph tests passed\n";
         return 0;

From a8c6b562d625d6c11fb54f73a3b8439ca1ffe7cb Mon Sep 17 00:00:00 2001
From: Rookie <175737347+rooklz@users.noreply.github.com>
Date: Sat, 24 Oct 2026 19:08:44 +0100
Subject: [PATCH 201/218] fix(libSceCesCs): map the strict JIS X 0208 profiles'
 unsettled cells as the console does

---
 core/libs/prx/libSceCesCs/Export.cpp | 64 ++++++++++++++--------------
 core/libs/tests/GuestCesJapanese.cpp | 44 ++++++++-----------
 docs/dev/debt/libSceCesCs.md         |  2 +-
 3 files changed, 51 insertions(+), 59 deletions(-)

diff --git a/core/libs/prx/libSceCesCs/Export.cpp b/core/libs/prx/libSceCesCs/Export.cpp
index eb908523be..54697f632f 100644
--- a/core/libs/prx/libSceCesCs/Export.cpp
+++ b/core/libs/prx/libSceCesCs/Export.cpp
@@ -210,10 +210,11 @@ struct JisChange {
     uint16_t code;
 };
 
-constexpr JisChange JIS_X0208_CHANGES[6] = {{0x2141, 0x301C}, {0x2142, 0x2016}, {0x215D, 0x2212}, {0x2171, 0x00A2}, {0x2172, 0x00A3}, {0x224C, 0x00AC}};
-constexpr uint16_t JIS_X0208_UNSETTLED_CELL = 0x2140;
-constexpr uint16_t JIS_X0208_UNSETTLED_CODE = 0xFF3C;
-constexpr const char* JIS_X0208_UNSETTLED = "libSceCesCs: the console's mapping of JIS X 0208 cell 0x2140 (U+005C or U+FF3C) is unknown";
+constexpr JisChange JIS_X0208_CHANGES[7] = {{0x213D, 0x2014}, {0x2141, 0x301C}, {0x2142, 0x2016}, {0x215D, 0x2212}, {0x2171, 0x00A2}, {0x2172, 0x00A3}, {0x224C, 0x00AC}};
+constexpr uint16_t JIS_X0208_BACKSLASH_CELL = 0x2140;
+constexpr JisChange JIS_X0208_EUC_FALLBACKS[2] = {{0x216F, 0x00A5}, {0x2131, 0x203E}};
+
+enum class JisStrict { None, Sjis, Euc };
 
 constexpr uint32_t jisIndex(uint16_t jis) {
     return ((jis >> 8) - 0x21) * 94 + (jis & 0xFF) - 0x21;
@@ -223,22 +224,21 @@ bool isCp932ExtensionRow(uint32_t row) {
     return row == 13 || (row >= 89 && row <= 92);
 }
 
-uint16_t strictJisX0208(uint32_t index) {
-    if (isCp932ExtensionRow(index / 94 + 1) || index == jisIndex(JIS_X0208_UNSETTLED_CELL)) return 0;
+uint16_t strictJisX0208(JisStrict strict, uint32_t index) {
+    if (isCp932ExtensionRow(index / 94 + 1)) return 0;
+    if (index == jisIndex(JIS_X0208_BACKSLASH_CELL)) return strict == JisStrict::Sjis ? 0x005C : 0xFF3C;
     for (const JisChange& change : JIS_X0208_CHANGES) {
         if (jisIndex(change.jis) == index) return change.code;
     }
     return JisX0208::TO_UCS2[index];
 }
 
-uint32_t jisX0208ToUnicode(bool strict, uint32_t index) {
-    if (!strict) return JisX0208::TO_UCS2[index];
-    if (index == jisIndex(JIS_X0208_UNSETTLED_CELL)) throw std::runtime_error(JIS_X0208_UNSETTLED);
-    return strictJisX0208(index);
+uint32_t jisX0208ToUnicode(JisStrict strict, uint32_t index) {
+    return strict == JisStrict::None ? JisX0208::TO_UCS2[index] : strictJisX0208(strict, index);
 }
 
-void requireSettledSjisX0208(uint32_t code) {
-    if (code == 0x5C || code == 0x7E || code == 0xA5 || code == 0x203E) throw std::runtime_error("libSceCesCs: the console's mapping of Shift-JIS bytes 0x5C and 0x7E (ASCII or JIS X 0201 Roman) is unknown");
+uint32_t sjisX0208Single(uint8_t byte) {
+    return byte == 0x5C ? 0x00A5 : byte == 0x7E ? 0x203E : byte;
 }
 
 constexpr uint8_t EUC_CN_TAG[8] = {'E', 'U', 'C', 'C', 'N', '9', '3', '6'};
@@ -674,7 +674,7 @@ int decodeEucJp(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint
         if (mbcsMax < 2) return needBytes(2, length);
         if (mbcs[1] < 0xA1 || mbcs[1] > 0xFE) return rejectTrail(mbcs[1], 2, length);
         length = 2;
-        code = jisX0208ToUnicode(isEucJpX0208(profile), (lead - 0xA1) * 94 + (mbcs[1] - 0xA1));
+        code = jisX0208ToUnicode(isEucJpX0208(profile) ? JisStrict::Euc : JisStrict::None, (lead - 0xA1) * 94 + (mbcs[1] - 0xA1));
         return code != 0 ? 0 : CES_ERROR_UNASSIGNED_CODE;
     }
     if (lead == 0x8F && hasSs3(profile)) {
@@ -701,9 +701,8 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
     if (isSjis(profile)) {
         const bool strict = isSjisX0208(profile);
         if (lead < 0x80) {
-            if (strict) requireSettledSjisX0208(lead);
             length = 1;
-            code = lead;
+            code = strict ? sjisX0208Single(lead) : lead;
             return 0;
         }
         if (lead >= 0xA1 && lead <= 0xDF) {
@@ -738,7 +737,7 @@ int decodeMbcs(const void* profile, const uint8_t* mbcs, uint32_t mbcsMax, uint3
             int cell = 0;
             sjisToJis(lead, trail, row, cell);
             if (row < 1 || row > 94 || cell < 1 || cell > 94) return unassigned(2, length);
-            code = jisX0208ToUnicode(strict, (row - 1) * 94 + (cell - 1));
+            code = jisX0208ToUnicode(strict ? JisStrict::Sjis : JisStrict::None, (row - 1) * 94 + (cell - 1));
             if (code == 0) return unassigned(2, length);
             length = 2;
             return 0;
@@ -754,13 +753,16 @@ struct JisCell {
     bool supplementary;
 };
 
-std::vector<JisCell> buildJisReverse(bool strict) {
+std::vector<JisCell> buildJisReverse(JisStrict strict) {
     std::vector<JisCell> entries;
     entries.reserve(2 * 94 * 94);
     for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
-        const uint16_t code = strict ? strictJisX0208(cell) : JisX0208::TO_UCS2[cell];
+        const uint16_t code = static_cast<uint16_t>(jisX0208ToUnicode(strict, cell));
         if (code != 0) entries.push_back({code, static_cast<uint16_t>(cell), false});
     }
+    if (strict == JisStrict::Euc) {
+        for (const JisChange& fallback : JIS_X0208_EUC_FALLBACKS) entries.push_back({fallback.code, static_cast<uint16_t>(jisIndex(fallback.jis)), false});
+    }
     for (uint32_t cell = 0; cell < 94 * 94; ++cell) {
         if (JisX0212::TO_UCS2[cell] != 0) entries.push_back({JisX0212::TO_UCS2[cell], static_cast<uint16_t>(cell), true});
     }
@@ -769,13 +771,11 @@ std::vector<JisCell> buildJisReverse(bool strict) {
     return entries;
 }
 
-const std::vector<JisCell>& jisReverse(bool strict) {
-    if (strict) {
-        static const auto strictReverse = buildJisReverse(true);
-        return strictReverse;
-    }
-    static const auto reverse = buildJisReverse(false);
-    return reverse;
+const std::vector<JisCell>& jisReverse(JisStrict strict) {
+    static const auto reverse = buildJisReverse(JisStrict::None);
+    static const auto sjisReverse = buildJisReverse(JisStrict::Sjis);
+    static const auto eucReverse = buildJisReverse(JisStrict::Euc);
+    return strict == JisStrict::Sjis ? sjisReverse : strict == JisStrict::Euc ? eucReverse : reverse;
 }
 
 uint32_t jisAlias(uint32_t code) {
@@ -804,8 +804,12 @@ int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& leng
     }
     if (isSjis(profile)) {
         const bool strict = isSjisX0208(profile);
-        if (strict) requireSettledSjisX0208(code);
-        if (code < 0x80) {
+        if (strict && (code == 0x00A5 || code == 0x203E)) {
+            length = 1;
+            mbcs[0] = code == 0x00A5 ? 0x5C : 0x7E;
+            return 0;
+        }
+        if (code < 0x80 && !(strict && (code == 0x5C || code == 0x7E))) {
             length = 1;
             mbcs[0] = static_cast<uint8_t>(code);
             return 0;
@@ -822,8 +826,7 @@ int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& leng
             return 0;
         }
         if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
-        if (strict && code == JIS_X0208_UNSETTLED_CODE) throw std::runtime_error(JIS_X0208_UNSETTLED);
-        const auto& reverse = jisReverse(strict);
+        const auto& reverse = jisReverse(strict ? JisStrict::Sjis : JisStrict::None);
         const auto found = std::lower_bound(reverse.begin(), reverse.end(), static_cast<uint16_t>(code), [](const JisCell& entry, uint16_t value) { return entry.code < value; });
         if (found == reverse.end() || found->code != code || found->supplementary) return CES_ERROR_UNASSIGNED_CODE;
         jisToSjis(found->cell / 94 + 1, found->cell % 94 + 1, mbcs[0], mbcs[1]);
@@ -850,8 +853,7 @@ int encodeMbcs(const void* profile, uint32_t code, uint8_t* mbcs, uint32_t& leng
         return 0;
     }
     if (code > 0xFFFF) return CES_ERROR_UNASSIGNED_CODE;
-    if (strict && code == JIS_X0208_UNSETTLED_CODE) throw std::runtime_error(JIS_X0208_UNSETTLED);
-    const auto& reverse = jisReverse(strict);
+    const auto& reverse = jisReverse(strict ? JisStrict::Euc : JisStrict::None);
     const auto found = std::lower_bound(reverse.begin(), reverse.end(), static_cast<uint16_t>(code), [](const JisCell& entry, uint16_t value) { return entry.code < value; });
     if (found == reverse.end() || found->code != code || (found->supplementary && !hasSs3(profile))) return CES_ERROR_UNASSIGNED_CODE;
     if (found->supplementary) {
diff --git a/core/libs/tests/GuestCesJapanese.cpp b/core/libs/tests/GuestCesJapanese.cpp
index ca3e52327f..42b8e2c16e 100644
--- a/core/libs/tests/GuestCesJapanese.cpp
+++ b/core/libs/tests/GuestCesJapanese.cpp
@@ -18,22 +18,11 @@ constexpr int invalidEncode = static_cast<int>(0x805C0014);
 constexpr int outOfCodeSpace = static_cast<int>(0x805C0015);
 constexpr int unassignedCode = static_cast<int>(0x805C0020);
 constexpr int dstBufferEnd = static_cast<int>(0x805C0031);
-constexpr std::uint32_t jisX0208Cells = 6878;
-constexpr std::uint32_t jisX0208Digest = 0xA614D6F6;
+constexpr std::uint32_t jisX0208Cells = 6879;
+constexpr std::uint32_t eucJisX0208Digest = 0xC1C98702;
+constexpr std::uint32_t sjisJisX0208Digest = 0x0CE46B27;
 constexpr std::uint32_t jisX0212Cells = 6067;
 constexpr std::uint32_t jisX0212Digest = 0x7C193A73;
-const std::string unsettledCell = "libSceCesCs: the console's mapping of JIS X 0208 cell 0x2140 (U+005C or U+FF3C) is unknown";
-const std::string unsettledByte = "libSceCesCs: the console's mapping of Shift-JIS bytes 0x5C and 0x7E (ASCII or JIS X 0201 Roman) is unknown";
-
-template <typename TCall>
-static bool Reports(const std::string& message, TCall call) {
-    try {
-        call();
-    } catch (const std::runtime_error& error) {
-        return error.what() == message;
-    }
-    return false;
-}
 
 static std::uint32_t Digest(std::uint32_t hash, std::uint16_t value) {
     hash = (hash ^ (value & 0xFF)) * 0x01000193u;
@@ -86,9 +75,7 @@ static void SweepEucJisX0208(const void* profile) {
             std::uint32_t used = 77;
             std::uint16_t ucs2 = 0xEEEE;
             std::uint16_t value = 0;
-            if (lead == 0xA1 && trail == 0xC0) {
-                Require(Reports(unsettledCell, [&] { sceCesEucJpToUcs2(profile, cell, 2, &used, &ucs2); }));
-            } else if (const int result = sceCesEucJpToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
+            if (const int result = sceCesEucJpToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
                 Require(used == 2);
                 value = ucs2;
                 ++assigned;
@@ -101,7 +88,7 @@ static void SweepEucJisX0208(const void* profile) {
             hash = Digest(hash, value);
         }
     }
-    Require(assigned == jisX0208Cells && hash == jisX0208Digest);
+    Require(assigned == jisX0208Cells && hash == eucJisX0208Digest);
 }
 
 static void SweepSJisJisX0208(const void* profile) {
@@ -115,9 +102,7 @@ static void SweepSJisJisX0208(const void* profile) {
             std::uint32_t used = 77;
             std::uint16_t ucs2 = 0xEEEE;
             std::uint16_t value = 0;
-            if (row == 1 && column == 32) {
-                Require(Reports(unsettledCell, [&] { sceCesSJisToUcs2(profile, cell, 2, &used, &ucs2); }));
-            } else if (const int result = sceCesSJisToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
+            if (const int result = sceCesSJisToUcs2(profile, cell, 2, &used, &ucs2); result == 0) {
                 Require(used == 2);
                 value = ucs2;
                 ++assigned;
@@ -130,7 +115,7 @@ static void SweepSJisJisX0208(const void* profile) {
             hash = Digest(hash, value);
         }
     }
-    Require(assigned == jisX0208Cells && hash == jisX0208Digest);
+    Require(assigned == jisX0208Cells && hash == sjisJisX0208Digest);
 }
 
 static void TestJisX0208Profiles(const void* cp932, const void* cp51932) {
@@ -159,7 +144,10 @@ static void TestJisX0208Profiles(const void* cp932, const void* cp51932) {
         Require(EucToUcs2(profile, "\xA1\xF2", 2, ucs2) == 0 && ucs2 == 0x00A3);
         Require(EucToUcs2(profile, "\xA2\xCC", 2, ucs2) == 0 && ucs2 == 0x00AC);
         for (const std::uint16_t cp932Form : {0xFF5E, 0x2225, 0xFF0D, 0xFFE0, 0xFFE1, 0xFFE2, 0x2460, 0x2170}) Require(EncodeLeavesOutputs(unassignedCode, profile, cp932Form, false));
-        Require(Reports(unsettledCell, [&] { EucEncodes(profile, 0xFF3C, ""); }));
+        Require(EucToUcs2(profile, "\xA1\xC0", 2, ucs2) == 0 && ucs2 == 0xFF3C && EucEncodes(profile, 0xFF3C, "\xA1\xC0"));
+        Require(EucToUcs2(profile, "\xA1\xBD", 2, ucs2) == 0 && ucs2 == 0x2014 && EucEncodes(profile, 0x2014, "\xA1\xBD") && EncodeLeavesOutputs(unassignedCode, profile, 0x2015, false));
+        Require(EucEncodes(profile, 0x00A5, "\xA1\xEF") && EucEncodes(profile, 0x203E, "\xA1\xB1"));
+        Require(EucToUcs2(profile, "\xA1\xEF", 2, ucs2) == 0 && ucs2 == 0xFFE5 && EucToUcs2(profile, "\xA1\xB1", 2, ucs2) == 0 && ucs2 == 0xFFE3);
         Require(DecodeRejects(unassignedCode, 2, profile, "\xAD\xA1", 2, false) && DecodeRejects(unassignedCode, 2, profile, "\xF9\xA1", 2, false));
         Require(DecodeRejects(unassignedCode, 2, profile, "\xA9\xA1", 2, false) && DecodeRejects(unassignedCode, 2, profile, "\xFE\xFE", 2, false));
         Require(DecodeRejects(invalidEncode, 2, profile, "\xA4\x41", 2, false) && DecodeRejects(invalidEncode, 2, profile, "\xA4\xFF", 2, false));
@@ -229,7 +217,8 @@ static void TestJisX0208Profiles(const void* cp932, const void* cp51932) {
     for (std::uint32_t byte = 0; byte <= 0xFF; ++byte) {
         const char bytes[2] = {static_cast<char>(byte), 0};
         if (byte == 0x5C || byte == 0x7E) {
-            Require(Reports(unsettledByte, [&] { SJisToUcs2(sjis, bytes, 1, ucs2); }));
+            const std::uint16_t roman = byte == 0x5C ? 0x00A5 : 0x203E;
+            Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == roman && SJisEncodes(sjis, roman, bytes));
         } else if (byte < 0x80) {
             Require(SJisToUcs2(sjis, bytes, 1, ucs2) == 0 && ucs2 == byte && (byte == 0 || SJisEncodes(sjis, ucs2, bytes)));
         } else if (byte >= 0xA1 && byte <= 0xDF) {
@@ -238,13 +227,14 @@ static void TestJisX0208Profiles(const void* cp932, const void* cp51932) {
             Require(DecodeRejects(byte == 0x80 || byte == 0xA0 || byte >= 0xFD ? invalidEncode : srcBufferEnd, byte == 0x80 || byte == 0xA0 || byte >= 0xFD ? 1u : 2u, sjis, bytes, 1, true));
         }
     }
-    for (const std::uint16_t unsettled : {0x5C, 0x7E, 0xA5, 0x203E}) Require(Reports(unsettledByte, [&] { SJisEncodes(sjis, unsettled, ""); }));
-    Require(Reports(unsettledCell, [&] { SJisEncodes(sjis, 0xFF3C, ""); }));
+    Require(SJisToUcs2(sjis, "\x81\x5F", 2, ucs2) == 0 && ucs2 == 0x005C && SJisEncodes(sjis, 0x005C, "\x81\x5F"));
+    Require(SJisToUcs2(sjis, "\x81\x5C", 2, ucs2) == 0 && ucs2 == 0x2014 && SJisEncodes(sjis, 0x2014, "\x81\x5C"));
+    for (const std::uint16_t unmapped : {0x007E, 0xFF3C, 0x2015}) Require(EncodeLeavesOutputs(unassignedCode, sjis, unmapped, true));
     Require(sceCesMbcsUcsContextInit(context, sjis) == 0);
     const std::uint16_t text[] = {0x3042, 0x301C, 0xFF71, 0};
     std::uint8_t mbcs[8] = {};
     Require(sceCesUcs2StrToMbcsStr(context, text, 4, &used, mbcs, sizeof(mbcs), &produced) == 0 && used == 3 && produced == 5 && std::memcmp(mbcs, "\x82\xA0\x81\x60\xB1", 5) == 0);
-    Require(Reports(unsettledByte, [&] { sceCesMbcsStrToUcs2Str(context, Bytes("A\\"), 2, &used, wide, 8, &produced); }));
+    Require(sceCesMbcsStrToUcs2Str(context, Bytes("A\\"), 2, &used, wide, 8, &produced) == 0 && used == 2 && produced == 2 && wide[1] == 0x00A5);
 }
 
 int main() {
diff --git a/docs/dev/debt/libSceCesCs.md b/docs/dev/debt/libSceCesCs.md
index b8957280ac..72af448a70 100644
--- a/docs/dev/debt/libSceCesCs.md
+++ b/docs/dev/debt/libSceCesCs.md
@@ -11,7 +11,7 @@
 - [Unicode scalar conversions](../../../core/libs/prx/libSceCesCs/Unicode.cpp) (libSceCesCs) - console error precedence, optional length pointers and length units are unverified. Signatures follow the [Orbital type database](https://github.com/AlexAltea/orbital/blob/b321fcdbd700cc02da1cb1ad25412781d5ec73c6/tools/ida/db_types.json); names are in the aerolib table pinned by `tools/nid_names.py`. Encoding follows [Unicode section 3.9](https://www.unicode.org/versions/Unicode17.0.0/core-spec/chapter-3/). Each call converts one scalar, including zero and U+FEFF, without a terminator or byte-order detection; lengths count bytes for UTF-8 and 16-bit units for UTF-16. Native forms use host byte order (supported hosts are little-endian). Errors follow the existing CES converters, not console measurements, and failure leaves outputs unchanged. No console or title comparison has been run
 - [sceCesEucJpToUtf8 and sceCesEucJpToUcs2](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) with the CP51932 profile follow a payload process on a PS5 (firmware 13.60): every two-byte input and every `0x8F` three-byte input gives the console's result, length and output (the test pins a hash of both sweeps). Bytes below 0xA0 other than 0x0E, 0x8E and 0x8F convert to themselves; JIS X 0212 is not decoded, so `0x8F` forms return `0x805C0020` in rows X 0212 leaves empty and `0x805C0014` elsewhere; a null profile returns `0x805C0004`, and the lengths are cleared first and then set as the console sets them. Their signatures follow the Orbital type database linked above. The console reads any other profile pointer as a sheet, where these return the invalid-parameter error.
 - [Shift-JIS and EUC-JP scalar conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSJisTo*`, `sceCesEucJpTo{Utf16,Utf32}*` and `sceCes{Ucs2,Utf8,Utf16,Utf32}*To{SJis,EucJp}` are unverified against the console. Signatures follow the Orbital type database linked above; the CP932 and CP51932 table and profile assumptions above apply. A profile of another encoding answers `INVALID_PARAMETER`, a surrogate or a value above U+10FFFF `INVALID_ENCODE`, a code point outside the BMP `UNASSIGNED_CODE`. UTF-8 input is decoded as `sceCesUtf8ToSbc` decodes it, so overlong forms answer `0x805C0015`. `sceCesSJisCodeToJisX0208` and `sceCesJisX0208ToSJisCode` do not check that the cell is assigned; their `INVALID_ENCODE` for rows or cells outside 1-94 and `INVALID_DST_BUFFER` for a null output are not console measurements
-- [Strict JIS X 0208 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - cell `0x2140` and U+FF3C throw: JIS0208.TXT gives U+005C, glibc 2.39 and Python's `euc_jp` U+FF3C. In `sceCesUcsProfileInitSJis1997X0208`, bytes `0x5C` and `0x7E` and U+005C, U+007E, U+00A5 and U+203E throw: SHIFTJIS.TXT gives JIS X 0201 Roman, CP932 and Python's `shift_jis` ASCII; the console's is unknown. The table, [JIS0208.TXT](https://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/JIS0208.TXT), is CP932's without rows 13 and 89-92 and with six cells changed, not measured. Per [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Text/Ces.cs#L57-L67), the `X0208Ss2` profile adds SS2 katakana and `X0208Ss2Ss3` SS3 JIS X 0212. Signatures follow Orbital; the conversions above take these profiles with the same errors, a missing SS2 or SS3 answering `INVALID_ENCODE` and Shift-JIS leads `0xF0`-`0xFC` `UNASSIGNED_CODE`
+- [Strict JIS X 0208 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the tables were measured on a PS5 (`sceCesMbcToUtf32` and `sceCesUtf32ToMbc` over every one- and two-byte sequence and every scalar); the errors follow the other JIS profiles, a missing SS2 or SS3 answering `INVALID_ENCODE`. The table is CP932's without rows 13 and 89-92 and with seven cells changed (`0x213D` U+2014 and the six of [JIS0208.TXT](https://unicode.org/Public/MAPPINGS/OBSOLETE/EASTASIA/JIS/JIS0208.TXT)). Cell `0x2140` is U+005C in `sceCesUcsProfileInitSJis1997X0208`, whose bytes `0x5C` and `0x7E` are U+00A5 and U+203E, and U+FF3C in the EUC-JP profiles, which keep ASCII and also encode U+00A5 and U+203E as `0xA1EF` and `0xA1B1`. Per [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Text/Ces.cs#L57-L67), `X0208Ss2` adds SS2 katakana and `X0208Ss2Ss3` SS3 JIS X 0212
 - [UTF-16 and UTF-32 forms of the single-byte and MBCS string conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - errors, their precedence and the optional length pointers of `sceCesSbcTo{Ucs2,Utf16,Utf32}*`, `sceCes{Ucs2,Utf16,Utf32}*ToSbc`, `sceCesMbcsStr{To,Get}{Utf16,Utf32}*` and `sceCes{Utf16,Utf32}Str{To,Get}Mbcs*` are unverified against the console. Signatures follow the Orbital type database linked above. They follow `sceCesSbcToUtf8`, `sceCesUtf8ToSbc` and the UTF-8 MBCS string forms with the profiles and tables listed above. A surrogate or a value above U+10FFFF answers `INVALID_ENCODE`, a valid code point no profile maps `UNASSIGNED_CODE`. The string forms stop at a zero code unit, write no terminator and count code units
 - [GBK (CP936) and EUC-CN conversions](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - `sceCesUcsProfileInitGbkCp936` and `sceCesUcsProfileInitEucCnGb2312` mark the caller's sheet with an 8-byte tag; the console's profile layout is not known. Both use one table ([Cp936.hpp](../../../core/libs/prx/libSceCesCs/Cp936.hpp)) read from Microsoft's [CP936.TXT](https://unicode.org/Public/MAPPINGS/VENDORS/MICSFT/WINDOWS/CP936.TXT); the EUC-CN profile accepts only its `0xA1`-`0xFE` lead and trail bytes, so it includes the GBK cells inside that range and the CP936 forms of `0xA1A4` (U+00B7) and `0xA1AA` (U+2014) instead of GB 2312's. That the console's GB 2312 and CP936 tables equal it is not measured. User-defined areas and `sceCesGbUcsProfileSet*` are not handled. Errors, their precedence and the length pointers follow the Shift-JIS forms above and are unverified
 - [GB 18030 profiles](../../../core/libs/prx/libSceCesCs/Export.cpp) (libSceCesCs) - the console's tables are not measured, and the sources disagree on 26 sequences. The 2000 profile follows ICU's `gb-18030-2000.ucm` at icu-data d9d3a6ed (before ICU-8427), which matches Python's codec: `0xA8BC` is U+E7C7 and `0x8135F437` U+1E3F. The 2005 profile follows `gb-18030-2005.ucm` (91850aec), which swaps those two and maps 24 PUA cells to U+FE10-U+FE19, U+9FB4-U+9FBB and six supplementary ideographs, keeping the PUA code points as encode fallbacks. Two-byte cells are CP936 plus [Gb18030.hpp](../../../core/libs/prx/libSceCesCs/Gb18030.hpp); four-byte runs include ICU's `gb18030Ranges`. The inits tag the sheet like GBK's; the `sceCesGb*`, `sceCesMbc*` and MBCS string forms accept them. The full mapping is assumed as the default of `sceCesGbUcsProfileSetUdaMapping` and `Set4ByteCharRange`, which throw. Supplementary characters to UCS-2 answer `UNASSIGNED_CODE`; other errors follow the GBK forms

From 58cca6fe6d29c1821fc817a8413d836674f54fa1 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 19:26:53 -0500
Subject: [PATCH 202/218] test(libSceAppContent): cover uninitialized rejection
 in sceAppContentTemporaryDataMount

---
 core/libs/tests/GuestAppContent.cpp | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/core/libs/tests/GuestAppContent.cpp b/core/libs/tests/GuestAppContent.cpp
index 12b6bc4a10..e1197f4a94 100644
--- a/core/libs/tests/GuestAppContent.cpp
+++ b/core/libs/tests/GuestAppContent.cpp
@@ -14,7 +14,6 @@ static constexpr int ErrorParameter = static_cast<int>(0x80D90002);
 static constexpr int ErrorNotFound = static_cast<int>(0x80D90005);
 static constexpr int ErrorDrmNoEntitlement = static_cast<int>(0x80D90007);
 static constexpr int ErrorBusy = static_cast<int>(0x80D90003);
-static constexpr int ErrorNotInitialized = static_cast<int>(0x80D90001);
 static constexpr int ErrorNotMounted = static_cast<int>(0x80D90004);
 static void Require(bool value) { if (!value) std::abort(); }
 
@@ -30,6 +29,9 @@ int main() {
     Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, nullptr) == notInitialized);
     Require(sceAppContentGetEntitlementKey(0, nullptr, nullptr) == notInitialized);
     Require(sceAppContentAppParamGetInt(0, nullptr) == notInitialized);
+    AppContentMountPoint uninitializedMount{};
+    Require(sceAppContentTemporaryDataMount(nullptr) == notInitialized);
+    Require(sceAppContentTemporaryDataMount(&uninitializedMount) == notInitialized);
     Require(sceAppContentTemporaryDataMount2(0, nullptr) == notInitialized);
     Require(sceAppContentTemporaryDataUnmount(nullptr) == notInitialized);
     Require(sceAppContentTemporaryDataFormat(nullptr) == notInitialized);
@@ -52,9 +54,6 @@ int main() {
     }
     AppContentInitParam init{};
     AppContentBootParam boot{};
-    Require(sceAppContentAddcontMount(0, nullptr, nullptr) == ErrorNotInitialized);
-    Require(sceAppContentAddcontUnmount(nullptr) == ErrorNotInitialized);
-    Require(sceAppContentGetAddcontInfoList(0, nullptr, 0, nullptr) == ErrorNotInitialized);
     Require(sceAppContentInitialize(nullptr, &boot) == ErrorParameter);
     Require(sceAppContentInitialize(&init, nullptr) == ErrorParameter);
     init.reserved[31] = 1;

From aa1581d59f23e4c3af2f96ec4e3b21fbe74a3408 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Wed, 21 Oct 2026 07:34:38 -0500
Subject: [PATCH 203/218] test(libSceHmd): cover distortion work memory query
 aliases

---
 core/libs/tests/GuestHmd.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/core/libs/tests/GuestHmd.cpp b/core/libs/tests/GuestHmd.cpp
index 257e9f381c..6f82327365 100644
--- a/core/libs/tests/GuestHmd.cpp
+++ b/core/libs/tests/GuestHmd.cpp
@@ -50,7 +50,9 @@ void CheckDisconnected() {
 
 void CheckBufferQueries() {
     Require(sceHmdDistortionGetWorkMemoryAlign() == 0x400, "distortion work memory alignment");
+    Require(sceHmdGetDistortionWorkMemoryAlign() == 0x400, "distortion work memory alignment query");
     Require(sceHmdDistortionGetWorkMemorySize() == 0x20000, "distortion work memory size");
+    Require(sceHmdGetDistortionWorkMemorySize() == 0x20000, "distortion work memory size query");
     Require(sceHmdReprojectionQueryGarlicBuffAlign() == 0x100, "reprojection garlic buffer alignment");
     Require(sceHmdReprojectionQueryGarlicBuffSize() == 0x100000, "reprojection garlic buffer size");
     Require(sceHmdReprojectionQueryOnionBuffAlign() == 0x100, "reprojection onion buffer alignment");

From 0a9e48f886f4478c281303e0896252429c6ade85 Mon Sep 17 00:00:00 2001
From: UnhealthyKraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:41:18 +0000
Subject: [PATCH 204/218] fix(freetype): build the patched kernel needed by
 border fixtures

---
 core/libs/prx/libSceFreeTypeOl/CMakeLists.txt  | 2 +-
 core/libs/tests/GuestFreeTypeOutlineBorder.cpp | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
index a9053faf5c..2caced1fd2 100644
--- a/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
+++ b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
@@ -11,7 +11,7 @@ if(BUILD_TESTING)
     endif()
     configure_windows_unwind(guest_freetype_outline_border_tests)
     add_custom_target(freetype_outline_border_patched DEPENDS
-        ${PATCHED_DIR}/libSceFreeTypeOl.prx ${PATCHED_DIR}/libSceFreeTypeOt.prx ${LIBC_PATCHED})
+        ${PATCHED_DIR}/libSceFreeTypeOl.prx ${PATCHED_DIR}/libSceFreeTypeOt.prx ${PATCHED_DIR}/libkernel.prx ${LIBC_PATCHED})
     add_dependencies(guest_freetype_outline_border_tests freetype_outline_border_patched)
     add_test(NAME guest_freetype_outline_border_reference COMMAND guest_freetype_outline_border_tests reference)
     foreach(module IN ITEMS Ol Ot)
diff --git a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
index 28dd07b908..609ec204f9 100644
--- a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
+++ b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
@@ -247,6 +247,7 @@ int main(int argc, char** argv) {
     auto query = reinterpret_cast<Query>(GetProcAddress(library, symbol));
 #else
     const auto library = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);
+    if (!library) std::fprintf(stderr, "%s\n", dlerror());
     Require(library != nullptr, "load requested library");
     auto query = reinterpret_cast<Query>(dlsym(library, symbol));
 #endif

From e9d4b8c282eda3ed49c7700f82f5a6228713dca2 Mon Sep 17 00:00:00 2001
From: UnhealthyKraken <10617703+UnhealthyKraken@users.noreply.github.com>
Date: Mon, 26 Oct 2026 00:44:55 +0000
Subject: [PATCH 205/218] test(freetype): enforce matching patched runtime DLL
 paths

---
 core/libs/prx/libSceFreeTypeOl/CMakeLists.txt  |  5 +++--
 core/libs/tests/GuestFreeTypeOutlineBorder.cpp | 11 +++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
index 2caced1fd2..e8f18eac97 100644
--- a/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
+++ b/core/libs/prx/libSceFreeTypeOl/CMakeLists.txt
@@ -23,9 +23,10 @@ if(BUILD_TESTING)
             set_tests_properties(guest_freetype_outline_border_${module}_${border}
                 guest_freetype_outline_border_${module}_${border}_patched PROPERTIES TIMEOUT 20)
             if(WIN32)
-                set_tests_properties(guest_freetype_outline_border_${module}_${border}
-                    guest_freetype_outline_border_${module}_${border}_patched PROPERTIES ENVIRONMENT_MODIFICATION
+                set_tests_properties(guest_freetype_outline_border_${module}_${border} PROPERTIES ENVIRONMENT_MODIFICATION
                     "PATH=path_list_prepend:$<TARGET_FILE_DIR:libSceFreeTypeOl>")
+                set_tests_properties(guest_freetype_outline_border_${module}_${border}_patched PROPERTIES ENVIRONMENT_MODIFICATION
+                    "PATH=path_list_prepend:${PATCHED_DIR}")
             endif()
         endforeach()
     endforeach()
diff --git a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
index 609ec204f9..069142dbb8 100644
--- a/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
+++ b/core/libs/tests/GuestFreeTypeOutlineBorder.cpp
@@ -9,6 +9,7 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
 #include <limits>
 #include <stdexcept>
 #include <string>
@@ -244,6 +245,16 @@ int main(int argc, char** argv) {
 #ifdef _WIN32
     const auto library = LoadLibraryA(argv[1]);
     Require(library != nullptr, "load requested library");
+    const auto checkPath = [](HMODULE module, const std::filesystem::path& expected) {
+        Require(module != nullptr, "load matching runtime module");
+        std::array<wchar_t, 32768> path{};
+        const auto length = GetModuleFileNameW(module, path.data(), static_cast<DWORD>(path.size()));
+        Require(length != 0 && length < path.size(), "read loaded module path");
+        Require(std::filesystem::equivalent(expected, std::filesystem::path(path.data())), "loaded module variant path");
+    };
+    const auto requested = std::filesystem::absolute(argv[1]);
+    checkPath(library, requested);
+    checkPath(GetModuleHandleW(L"libc.prx"), requested.parent_path() / "libc.prx");
     auto query = reinterpret_cast<Query>(GetProcAddress(library, symbol));
 #else
     const auto library = dlopen(argv[1], RTLD_NOW | RTLD_LOCAL);

From a385eee97cf430665f8b27a5a611d418c5350aa9 Mon Sep 17 00:00:00 2001
From: vaibhavindalia <btech25202.25@bitmesra.ac.in>
Date: Tue, 20 Oct 2026 13:17:42 +0530
Subject: [PATCH 206/218] fix(libkernel_sys): validate descriptor first in
 fchown

---
 core/libs/prx/libkernel_sys/Export.cpp | 4 +---
 core/libs/tests/GuestKernelSys.cpp     | 5 +++++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libkernel_sys/Export.cpp b/core/libs/prx/libkernel_sys/Export.cpp
index 4aa5f49a80..60e3d831b8 100644
--- a/core/libs/prx/libkernel_sys/Export.cpp
+++ b/core/libs/prx/libkernel_sys/Export.cpp
@@ -725,15 +725,13 @@ int APS5_VABI lchmod_nid_postfix(const char* path, std::uint16_t mode) {
 }
 
 int APS5_VABI fchown_nid_postfix(int fd, std::uint32_t uid, std::uint32_t gid) {
-    constexpr std::uint32_t Unchanged = 0xFFFFFFFFu;
-    if (uid != 0 && uid != Unchanged) NotImplemented_nid_no_patch("fchown: an owner other than the guest user");
-    if (gid != 0 && gid != Unchanged) NotImplemented_nid_no_patch("fchown: a group other than the guest group");
 #ifdef _WIN32
     if (GuestFstat(fd) != 0) return static_cast<int>(Fail(GuestEbadf));
 #else
     struct stat status{};
     if (::fstat(fd, &status) != 0) return static_cast<int>(Fail(GuestEbadf));
 #endif
+    RequireGuestOwner("fchown", uid, gid);
     return 0;
 }
 
diff --git a/core/libs/tests/GuestKernelSys.cpp b/core/libs/tests/GuestKernelSys.cpp
index 850fc67fcb..99ffc5a124 100644
--- a/core/libs/tests/GuestKernelSys.cpp
+++ b/core/libs/tests/GuestKernelSys.cpp
@@ -1107,7 +1107,12 @@ int main() {
 #endif
     Require(fchown_nid_postfix(base, 0, 0) == 0);
     Require(fchown_nid_postfix(base, 0xFFFFFFFFu, 0xFFFFFFFFu) == 0);
+    Require(fchown_nid_postfix(base, 0, 0xFFFFFFFFu) == 0);
+    Require(fchown_nid_postfix(base, 0xFFFFFFFFu, 0) == 0);
     Require(fchown_nid_postfix(-1, 0, 0) == -1 && Error() == 9);
+    Require(fchown_nid_postfix(-1, 1, 0) == -1 && Error() == 9);
+    Require(fchown_nid_postfix(-1, 0, 1) == -1 && Error() == 9);
+    Require(fchown_nid_postfix(-1, 1, 1) == -1 && Error() == 9);
     bool fchownThrew = false;
     try { fchown_nid_postfix(base, 1, 0); } catch (const std::exception&) { fchownThrew = true; }
     Require(fchownThrew);

From d84ce7c11ccc4da0c167a3f1d3dc101f990919dc Mon Sep 17 00:00:00 2001
From: Dean Galvin <dean.galvin@live.com>
Date: Mon, 26 Oct 2026 14:36:49 +1300
Subject: [PATCH 207/218] fix(agc): suspend the tracker lock around the unwatch
 hook

---
 core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
index 52bac9f0f7..e72fabda25 100644
--- a/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
+++ b/core/libs/prx/libSceAgcDriver/Execution/src/GuestMemory.cpp
@@ -1826,9 +1826,9 @@ bool ImportWatched(std::uint64_t address, std::size_t bytes, const std::function
         }
     }
     const auto saveBytes = [&](std::uint64_t begin, std::uint64_t end) {
-        lock.unlock();
+        lock.Suspend();
         beforeUnwatch(begin, static_cast<std::size_t>(end - begin));
-        lock.lock();
+        lock.Resume();
     };
     std::vector<std::pair<std::uint64_t, std::uint64_t>> leaving;
     std::erase_if(spans, [&](const auto& span) {

From 60f3dcc5dbe987ab75d3a980cd54b1aa9d93c1e5 Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Sat, 24 Oct 2026 08:27:00 -0400
Subject: [PATCH 208/218] test(libc): check acoshf domain errno and exception
 flags

---
 core/libs/tests/GuestMath.cpp | 54 ++++++++++++++++++++++++++++++++++-
 1 file changed, 53 insertions(+), 1 deletion(-)

diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp
index 8297d06458..5f7073e022 100644
--- a/core/libs/tests/GuestMath.cpp
+++ b/core/libs/tests/GuestMath.cpp
@@ -983,11 +983,62 @@ static void CheckHyperbolic() {
     Require(Near(acosh_nid_postfix(1e300), 691.4686750787736, 1e-15));
 }
 
+static void CheckAcoshfDomainEnvironment() {
+    const RestoreFloatingPointState saved;
+    const unsigned savedCsr = _mm_getcsr();
+    const struct {
+        std::uint32_t input;
+        std::uint32_t result;
+        unsigned raised;
+        unsigned x87Raised;
+        int error;
+    } cases[] = {
+        {0x00000000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0x80000000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0x3f000000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0x3f7fffffu, 0xffc00000u, 1u, 1u, EDOM},
+        {0xbf800000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0xff800000u, 0xffc00000u, 1u, 1u, EDOM},
+        {0xffc00001u, 0xffc00001u, 1u, 1u, EDOM},
+        {0xff800001u, 0xffc00001u, 1u, 1u, EDOM},
+        {0x3f800000u, 0x00000000u, 0u, 0u, 1234},
+        {0x7f800000u, 0x7f800000u, 0u, 0u, 1234},
+        {0x7fc00001u, 0x7fc00001u, 0u, 0u, 1234},
+        {0x7f800001u, 0x7fc00001u, 1u, 0u, 1234},
+    };
+    const int rounding[] = {FE_TONEAREST, FE_DOWNWARD, FE_UPWARD, FE_TOWARDZERO};
+    float (APS5_VABI * volatile call)(float) = acoshf_nid_postfix;
+    for (unsigned mode = 0; mode != 4; ++mode) {
+        for (unsigned denorm = 0; denorm != 4; ++denorm) {
+            const unsigned control = 0x1f80u | (mode << 13u) | ((denorm & 1u) ? 0x40u : 0u) | ((denorm & 2u) ? 0x8000u : 0u);
+            for (std::uint16_t sticky : {0u, 5u, 32u}) {
+                for (const auto& item : cases) {
+                    Require(std::fesetenv(FE_DFL_ENV) == 0 && std::fesetround(rounding[mode]) == 0);
+                    Require(fesetexceptflag_nid_postfix(&sticky, 0x3f) == 0);
+                    _mm_setcsr(control | sticky);
+                    GuestFloatingPointEnvironment before;
+                    Require(fegetenv_nid_postfix(&before) == 0 && (before.status & 0x3fu) == sticky);
+                    errno = 1234;
+                    const auto result = std::bit_cast<std::uint32_t>(call(std::bit_cast<float>(item.input)));
+                    const int error = errno;
+                    GuestFloatingPointEnvironment after;
+                    Require(fegetenv_nid_postfix(&after) == 0);
+                    if (result != item.result || after.mxcsr != (control | sticky | item.raised) || (after.status & 0x3fu) != (sticky | item.x87Raised) || after.control != before.control || error != item.error) {
+                        std::fprintf(stderr, "acoshf domain: input=%08llx mode=%u denorm=%u sticky=%u bits=%08llx csr=%x x87=%x errno=%d\n", static_cast<unsigned long long>(item.input), mode, denorm, sticky, static_cast<unsigned long long>(result), after.mxcsr, after.status, error);
+                        Require(false);
+                    }
+                }
+            }
+        }
+    }
+    _mm_setcsr(savedCsr);
+}
+
 static void CheckAcoshfMsunBoundaries() {
     Require(acoshf_nid_postfix(1.0f) == 0.0f && !std::signbit(acoshf_nid_postfix(1.0f)));
     errno = EINTR;
     std::feclearexcept(FE_ALL_EXCEPT);
-    Require(std::isnan(acoshf_nid_postfix(0.5f)) && errno == EINTR && (std::fetestexcept(FE_INVALID) & FE_INVALID) != 0);
+    Require(std::isnan(acoshf_nid_postfix(0.5f)) && errno == EDOM && (std::fetestexcept(FE_INVALID) & FE_INVALID) != 0);
     for (const std::uint32_t bits : {0x3f800001u, 0x3fffffffu, 0x40000000u, 0x40000001u,
                                      0x4d7fffffu, 0x4d800000u, 0x4d800001u, 0x7f7fffffu}) {
         const float x = std::bit_cast<float>(bits);
@@ -1845,6 +1896,7 @@ int main() {
     Require(std::isinf(__powidf2_nid_postfix(-0.0, -3)) && std::signbit(__powidf2_nid_postfix(-0.0, -3)));
     Require(__powidf2_nid_postfix(2.0, -127) == 0x1p-127);
     CheckHyperbolic();
+    CheckAcoshfDomainEnvironment();
     CheckAcoshfMsunBoundaries();
     CheckCoshfMsunBoundaries();
     CheckExp2fConsoleBits();

From ad111b3ce18e101010f49f0715be9a0d4b685248 Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Sat, 24 Oct 2026 08:28:59 -0400
Subject: [PATCH 209/218] fix(libc): preserve acoshf domain errno and exception
 flags

---
 core/libs/prx/libc/src/Math.cpp | 6 +++++-
 docs/dev/debt/libc.md           | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp
index d88fc6d00b..aee00ca2fd 100644
--- a/core/libs/prx/libc/src/Math.cpp
+++ b/core/libs/prx/libc/src/Math.cpp
@@ -1062,7 +1062,11 @@ float APS5_VABI acoshf_nid_postfix(float x) {
     constexpr float ln2 = 6.9314718246e-01f;
     const std::uint32_t bits = std::bit_cast<std::uint32_t>(x);
     const std::uint32_t magnitude = bits & 0x7fffffffu;
-    if ((bits & 0x80000000u) != 0 || magnitude < 0x3f800000u) return (x - x) / (x - x);
+    if ((bits & 0x80000000u) != 0 || magnitude < 0x3f800000u) {
+        _Feraise_nid_postfix(0x01);
+        errno = EDOM;
+        return (x - x) / (x - x);
+    }
     if (magnitude >= 0x7f800000u) return x + x;
     if (magnitude == 0x3f800000u) return 0.0f;
     if (magnitude >= 0x4d800000u) return logf_nid_postfix(x) + ln2;
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index c648774059..737d9be725 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -115,7 +115,7 @@
 - [log1p](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_log1p.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_log1p.c). As the titles' `libc.prx` does, it sets `EDOM` at msun's NaN return (arguments below -1, `-inf` and negative NaNs) and leaves `errno` alone for `log1p(-1)`, where it returns `-inf`. It gives the same bits, NaN payloads included, and `errno` as the `log1p` bundled with PPSA07923 and PPSA05916 on 320 million random and 68,216 structured arguments on a Windows host. The FMA-contracted build bundled with PPSA13934 differs on 73,682 of the random ones.
 - [nextafter and nextafterf](../../../core/libs/prx/libc/src/Math.cpp) (libc) do not compare floating-point exceptions, and their inputs are checked by sampling, not exhaustively. They are FreeBSD msun's [`s_nextafter.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafter.c) and [`s_nextafterf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafterf.c), with `ERANGE` at msun's overflow and underflow returns as the titles' `libc.prx` sets it; a step away from zero returns early and sets none. The copies bundled with eleven titles give the same bits and `errno` on 4,000,784 sampled pairs per function on a Windows host.
 - [sinhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `sinhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_sinhf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_sinhf.c) from before `__ldexp_expf`, which squares `expf(|x| / 2)` between `logf(FLT_MAX)` and the overflow threshold, calling msun's [`expm1f`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_expm1f.c) and [`expf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_expf.c), whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets `errno` to `ERANGE` before returning `x * 1e37`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system `libSceLibcInternal`, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return `libc.prx`, has the same code is assumed
-- [acoshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not reproduce bundled invalid-domain errno or x87 exception flags (#10610); exact system `libSceLibcInternal` behavior and FMA-contracted copies remain unverified. Positive finite inputs use [msun](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_acoshf.c) range handling and this file's `logf`; the middle range divides -1 before addition under directed rounding. Bits, errno and SSE/x87 status and controls match the supplied PPSA03766/PPSA07923 copies on 236,592 positive finite calls (4,929 inputs, four rounding modes, DAZ/FTZ combinations and sticky flags); these samples are not exhaustive.
+- [acoshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) exact system `libSceLibcInternal` behavior and FMA-contracted copies remain unverified. Positive finite inputs use [msun](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_acoshf.c) range handling and this file's `logf`; the middle range divides -1 before addition under directed rounding. Bits, errno and SSE/x87 status and controls match the supplied PPSA03766/PPSA07923 copies on 236,592 positive finite calls (4,929 inputs, four rounding modes, DAZ/FTZ combinations and sticky flags); these samples are not exhaustive. Invalid-domain errno and SSE/x87 invalid flags are checked against two supplied bundled copies; those samples are not exhaustive either.
 - [acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (`y0f`, `y1f`, `ynf` follow the console at `+-0`). As in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x56410), `lgammal` does not store the sign in `signgam`; `hypotl` returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. [hypot3, hypot3f and hypot3l](../../../core/libs/prx/libc/src/Math.cpp) follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two
 - [asinl](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `asinl` of the `libc.prx` bundled with PPSA28319 (disassembly), FreeBSD msun's [`e_asinl.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/src/e_asinl.c) with the ld80 [`invtrig.c`](https://github.com/freebsd/freebsd-src/blob/9f0432041b8fb69832f10c32da50a67f34feeb61/lib/msun/ld80/invtrig.c) coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises `FE_INVALID` and sets `errno` to `EDOM` before returning `(x - x) / (x - x)`, so a NaN argument also sets `EDOM`; msun itself sets no `errno`. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word `0x37f`), but guest threads do not set it: on Windows a thread started by `_beginthreadex` runs at 53 bits (`0x27f`), where `asinl(0.75)` returns mantissa `0xd91a98ae3406e000` instead of `0xd91a98ae3406e041`. The system `libSceLibcInternal` that RetroArch (PPSA99169) imports is assumed to have the same code
 - [acosf](../../../core/libs/prx/libc/src/Math.cpp) (libc) - for |x| > 1 and NaN the console stores `EDOM` and raises `FE_INVALID` before returning `(x - x) / (x - x)`; here those return the same NaNs and leave `errno` as it was (#3688). For |x| <= 1 it follows the `acosf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_acosf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/e_acosf.c), with the same constants, `pio2_lo` read at run time and the `0xfffff000` mask on `sqrtf(z)`, which the binary holds. Titles ship different builds of that `libc.prx`: PPSA13934's is FMA-contracted and differs from this one by 1 ulp on 129,170 inputs (#9668), so no single port matches every title's last bit.

From 5d347949b02ba16dd84e4109e321bb83da69a505 Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 18:24:43 -0400
Subject: [PATCH 210/218] fix(libc): accept signed char values in the ctype
 functions as titles' libc.prx does

The ctype functions threw std::invalid_argument for any value below EOF,
so a title passing a plain char with its high bit set, such as a UTF-8
byte, aborted. The libc.prx bundled with titles accepts -128 to -2: each
class function returns 0 for them, as for 128 to 255 in the C locale,
and toupper and tolower return them unchanged. Values outside -128 to
255 still throw.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/LocaleSupport.cpp |  6 +++---
 core/libs/tests/GuestCharacter.cpp       | 10 ++++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/core/libs/prx/libc/src/LocaleSupport.cpp b/core/libs/prx/libc/src/LocaleSupport.cpp
index db06ec8eaa..7173c10cbf 100644
--- a/core/libs/prx/libc/src/LocaleSupport.cpp
+++ b/core/libs/prx/libc/src/LocaleSupport.cpp
@@ -329,18 +329,18 @@ constexpr auto g_lowerTable = MakeCaseTable(false);
 constexpr auto g_upperTable = MakeCaseTable(true);
 
 void ValidateCharacter(int value) {
-    if (value != EOF && (value < 0 || value > UCHAR_MAX)) throw std::invalid_argument("Invalid character value");
+    if (value < SCHAR_MIN || value > UCHAR_MAX) throw std::invalid_argument("Invalid character value");
 }
 
 int ClassifyCharacter(int value, short mask) {
     ValidateCharacter(value);
     if (value == EOF) return 0;
-    return g_classificationTable[static_cast<std::size_t>(value) + 1] & mask;
+    return g_classificationTable[static_cast<std::size_t>(value < 0 ? value + UCHAR_MAX + 1 : value) + 1] & mask;
 }
 
 int ConvertCharacter(int value, bool upper) {
     ValidateCharacter(value);
-    if (value == EOF) return EOF;
+    if (value < 0) return value;
     const auto& facet = std::use_facet<std::ctype<char>>(std::locale::classic());
     const auto character = static_cast<char>(value);
     return static_cast<unsigned char>(upper ? facet.toupper(character) : facet.tolower(character));
diff --git a/core/libs/tests/GuestCharacter.cpp b/core/libs/tests/GuestCharacter.cpp
index 211b36ccfb..7f900acea7 100644
--- a/core/libs/tests/GuestCharacter.cpp
+++ b/core/libs/tests/GuestCharacter.cpp
@@ -37,8 +37,18 @@ static void CheckConsoleClassValues() {
         Require(isprint_nid_postfix(c) == (bits & 0x3e) && isgraph_nid_postfix(c) == (bits & 0x3a) && ispunct_nid_postfix(c) == (bits & 0x08));
     }
 }
+static void CheckSignedCharValues() {
+    for (int c = -128; c <= -2; ++c) {
+        Require(isupper_nid_postfix(c) == 0 && islower_nid_postfix(c) == 0 && isalpha_nid_postfix(c) == 0 && isdigit_nid_postfix(c) == 0);
+        Require(isalnum_nid_postfix(c) == 0 && isspace_nid_postfix(c) == 0 && isblank_nid_postfix(c) == 0 && iscntrl_nid_postfix(c) == 0);
+        Require(isprint_nid_postfix(c) == 0 && isgraph_nid_postfix(c) == 0 && ispunct_nid_postfix(c) == 0 && isxdigit_nid_postfix(c) == 0);
+        Require(toupper_nid_postfix(c) == c && tolower_nid_postfix(c) == c);
+    }
+}
+
 int main() {
     CheckConsoleClassValues();
+    CheckSignedCharValues();
     Require(std::setlocale(LC_CTYPE, "C") != nullptr);
     for (int category = 0; category <= 6; ++category) {
         const char* result = setlocale_nid_postfix(category, "C");

From f91f0450b5fec2067ce35019e53438d65d5c9b21 Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 15:25:05 -0400
Subject: [PATCH 211/218] fix(libc): quiet signalling NaNs in trunc, ceil,
 floor and nearbyint as titles' libc.prx does

trunc, ceil, floor and nearbyint and their float forms returned the
host's result, which on Windows passes a signalling NaN through
unchanged. The titles' copies follow FreeBSD msun, which returns x + x
for a NaN, so the NaN comes back quieted with its payload and sign; these
functions now do the same before calling the host for other arguments.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/Math.cpp | 16 ++++++++--------
 core/libs/tests/GuestMath.cpp   | 21 +++++++++++++++++++++
 2 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp
index d88fc6d00b..b6f00eabb3 100644
--- a/core/libs/prx/libc/src/Math.cpp
+++ b/core/libs/prx/libc/src/Math.cpp
@@ -416,9 +416,9 @@ int APS5_VABI __isfinitef_nid_postfix(float x) { return std::isfinite(x) ? 1 : 0
 int APS5_VABI __isnormal_nid_postfix(double x) { return std::isnormal(x) ? 1 : 0; }
 int APS5_VABI __isnormalf_nid_postfix(float x) { return std::isnormal(x) ? 1 : 0; }
 int APS5_VABI __isinff_nid_postfix(float x) { return std::isinf(x) ? 1 : 0; }
-float APS5_VABI nearbyintf_nid_postfix(float x) { return std::nearbyintf(x); }
+float APS5_VABI nearbyintf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::nearbyintf(x); }
 long double APS5_VABI nearbyintl_nid_postfix(long double x) { return std::nearbyint(x); }
-double APS5_VABI nearbyint_nid_postfix(double x) { return std::nearbyint(x); }
+double APS5_VABI nearbyint_nid_postfix(double x) { return std::isnan(x) ? x + x : std::nearbyint(x); }
 
 double APS5_VABI cbrt_nid_postfix(double x) { return std::cbrt(x); }
 double APS5_VABI asin_nid_postfix(double x) {
@@ -441,12 +441,12 @@ float APS5_VABI copysignf_nid_postfix(float x, float y) {
     return std::copysign(x, y);
 }
 int APS5_VABI abs_nid_postfix(int x) { return x < 0 ? static_cast<int>(0u - static_cast<unsigned>(x)) : x; }
-double APS5_VABI trunc_nid_postfix(double x) { return std::trunc(x); }
-double APS5_VABI ceil_nid_postfix(double x) { return std::ceil(x); }
-double APS5_VABI floor_nid_postfix(double x) { return std::floor(x); }
-float APS5_VABI truncf_nid_postfix(float x) { return std::trunc(x); }
-float APS5_VABI ceilf_nid_postfix(float x) { return std::ceil(x); }
-float APS5_VABI floorf_nid_postfix(float x) { return std::floor(x); }
+double APS5_VABI trunc_nid_postfix(double x) { return std::isnan(x) ? x + x : std::trunc(x); }
+double APS5_VABI ceil_nid_postfix(double x) { return std::isnan(x) ? x + x : std::ceil(x); }
+double APS5_VABI floor_nid_postfix(double x) { return std::isnan(x) ? x + x : std::floor(x); }
+float APS5_VABI truncf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::trunc(x); }
+float APS5_VABI ceilf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::ceil(x); }
+float APS5_VABI floorf_nid_postfix(float x) { return std::isnan(x) ? x + x : std::floor(x); }
 double APS5_VABI fma_nid_postfix(double x, double y, double z) { return std::fma(x, y, z); }
 float APS5_VABI fmaf_nid_postfix(float x, float y, float z) { return std::fma(x, y, z); }
 double APS5_VABI fmin_nid_postfix(double x, double y) { return GuestFmin(x, y); }
diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp
index 8297d06458..a715ca26e8 100644
--- a/core/libs/tests/GuestMath.cpp
+++ b/core/libs/tests/GuestMath.cpp
@@ -630,6 +630,26 @@ static void CheckLog1pConsoleBits() {
     }
 }
 
+static void CheckRoundingNaNConsoleBits() {
+    constexpr std::uint64_t cases[][2] = {
+        {0x7ff0000000000001ull, 0x7ff8000000000001ull}, {0xfff4000000000123ull, 0xfffc000000000123ull}, {0x7ff8000000000456ull, 0x7ff8000000000456ull},
+        {0x7ff0000000000000ull, 0x7ff0000000000000ull}, {0xfff0000000000000ull, 0xfff0000000000000ull},
+    };
+    constexpr std::uint32_t floatCases[][2] = {
+        {0x7f800001u, 0x7fc00001u}, {0xffa00123u, 0xffe00123u}, {0x7fc00456u, 0x7fc00456u}, {0x7f800000u, 0x7f800000u}, {0xff800000u, 0xff800000u},
+    };
+    for (const auto function : {trunc_nid_postfix, ceil_nid_postfix, floor_nid_postfix, nearbyint_nid_postfix}) {
+        for (const auto& [input, expected] : cases) {
+            Require(std::bit_cast<std::uint64_t>(function(std::bit_cast<double>(input))) == expected);
+        }
+    }
+    for (const auto function : {truncf_nid_postfix, ceilf_nid_postfix, floorf_nid_postfix, nearbyintf_nid_postfix}) {
+        for (const auto& [input, expected] : floatCases) {
+            Require(std::bit_cast<std::uint32_t>(function(std::bit_cast<float>(input))) == expected);
+        }
+    }
+}
+
 static void CheckAsinl() {
     const struct { std::uint64_t inputMantissa; std::uint16_t inputSignExponent; std::uint64_t outputMantissa; std::uint16_t outputSignExponent; } cases[] = {
         {0, 0x0000, 0, 0x0000}, {0, 0x8000, 0, 0x8000},
@@ -1722,6 +1742,7 @@ int main() {
     CheckExpm1ConsoleBits();
     CheckLog1pConsoleBits();
     CheckNextafterConsoleBits();
+    CheckRoundingNaNConsoleBits();
     CheckAsinl();
     Require(scalbn_nid_postfix(0.75, -2) == 0.1875);
     Require(scalbnf_nid_postfix(0.75f, 4) == 12.f);

From ca1b62a3bd8d2ea8bc0f720aae9cb360d18dad3e Mon Sep 17 00:00:00 2001
From: JJenkx <josh_jenkins@hotmail.com>
Date: Fri, 23 Oct 2026 13:16:20 -0400
Subject: [PATCH 212/218] fix(libc): compute tanh with FreeBSD msun's
 algorithm, as titles' libc.prx does

tanh returned the host's tanh, whose last bit differs from the titles' copy
on Windows. The titles' copy is FreeBSD msun's s_tanh.c over msun's expm1,
and it sets no errno. tanh now computes that algorithm over this file's
Expm1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 core/libs/prx/libc/src/Math.cpp | 26 +++++++++++++++++++++++++-
 core/libs/tests/GuestMath.cpp   | 22 ++++++++++++++++++++++
 docs/dev/debt/libc.md           |  1 +
 3 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/core/libs/prx/libc/src/Math.cpp b/core/libs/prx/libc/src/Math.cpp
index d88fc6d00b..43c3546cce 100644
--- a/core/libs/prx/libc/src/Math.cpp
+++ b/core/libs/prx/libc/src/Math.cpp
@@ -1336,7 +1336,31 @@ double APS5_VABI nan_nid_postfix(const char* tagp) {
 
 double APS5_VABI modf_nid_postfix(double x, double* integral) { return std::modf(x, integral); }
 float APS5_VABI modff_nid_postfix(float x, float* integral) { return std::modf(x, integral); }
-double APS5_VABI tanh_nid_postfix(double x) { return std::tanh(x); }
+double APS5_VABI tanh_nid_postfix(double x) {
+    static volatile double tiny = 1.0e-300;
+    const double huge = 1.0e300;
+    const std::int32_t jx = static_cast<std::int32_t>(std::bit_cast<std::uint64_t>(x) >> 32);
+    const std::int32_t ix = jx & 0x7fffffff;
+    if (ix >= 0x7ff00000) {
+        return jx >= 0 ? 1.0 / x + 1.0 : 1.0 / x - 1.0;
+    }
+    double z;
+    if (ix < 0x40360000) {
+        if (ix < 0x3e300000 && huge + x > 1.0) {
+            return x;
+        }
+        if (ix >= 0x3ff00000) {
+            const double t = Expm1(2.0 * std::fabs(x));
+            z = 1.0 - 2.0 / (t + 2.0);
+        } else {
+            const double t = Expm1(-2.0 * std::fabs(x));
+            z = -t / (t + 2.0);
+        }
+    } else {
+        z = 1.0 - tiny;
+    }
+    return jx >= 0 ? z : -z;
+}
 float APS5_VABI tanhf_nid_postfix(float x) { return std::tanh(x); }
 long double APS5_VABI atanl_nid_postfix(long double x) { return std::atan(x); }
 long double APS5_VABI sinl_nid_postfix(long double x) { return std::sin(x); }
diff --git a/core/libs/tests/GuestMath.cpp b/core/libs/tests/GuestMath.cpp
index 8297d06458..9fd4dbd27a 100644
--- a/core/libs/tests/GuestMath.cpp
+++ b/core/libs/tests/GuestMath.cpp
@@ -630,6 +630,27 @@ static void CheckLog1pConsoleBits() {
     }
 }
 
+static void CheckTanhConsoleBits() {
+    constexpr std::uint64_t cases[][2] = {
+        {0x0000000000000000ull, 0x0000000000000000ull}, {0x8000000000000000ull, 0x8000000000000000ull},
+        {0x3e2fffffffffffffull, 0x3e2fffffffffffffull}, {0x3e30000000000000ull, 0x3e30000000000000ull},
+        {0xbe30000000000000ull, 0xbe30000000000000ull}, {0x3fefffffffffffffull, 0x3fe85efab514f394ull},
+        {0x3ff0000000000000ull, 0x3fe85efab514f394ull}, {0xbff0000000000000ull, 0xbfe85efab514f394ull},
+        {0x3fe0000000000000ull, 0x3fdd9353d7568af3ull}, {0x4035ffffffffffffull, 0x3ff0000000000000ull},
+        {0x4036000000000000ull, 0x3ff0000000000000ull}, {0xc036000000000000ull, 0xbff0000000000000ull},
+        {0x4049000000000000ull, 0x3ff0000000000000ull}, {0x7fefffffffffffffull, 0x3ff0000000000000ull},
+        {0x7ff0000000000000ull, 0x3ff0000000000000ull}, {0xfff0000000000000ull, 0xbff0000000000000ull},
+        {0x7ff8000000000001ull, 0x7ff8000000000001ull}, {0xfff8000000000002ull, 0xfff8000000000002ull},
+        {0x3f927ed0db8370b1ull, 0x3f927e4d1092a580ull}, {0x3f95d74e4cee78bfull, 0x3f95d67547d523a0ull},
+        {0x3f18f1b062cb523cull, 0x3f18f1b06187faaeull}, {0x3f937129f25ae835ull, 0x3f937090dd8c9cb3ull},
+        {0x3facb0d89f8aa91cull, 0x3faca92afe31a32bull}, {0x3f07f462f020acdeull, 0x3f07f462efd91530ull},
+    };
+    for (const auto& [input, expected] : cases) {
+        errno = 1234;
+        Require(std::bit_cast<std::uint64_t>(tanh_nid_postfix(std::bit_cast<double>(input))) == expected && errno == 1234);
+    }
+}
+
 static void CheckAsinl() {
     const struct { std::uint64_t inputMantissa; std::uint16_t inputSignExponent; std::uint64_t outputMantissa; std::uint16_t outputSignExponent; } cases[] = {
         {0, 0x0000, 0, 0x0000}, {0, 0x8000, 0, 0x8000},
@@ -1722,6 +1743,7 @@ int main() {
     CheckExpm1ConsoleBits();
     CheckLog1pConsoleBits();
     CheckNextafterConsoleBits();
+    CheckTanhConsoleBits();
     CheckAsinl();
     Require(scalbn_nid_postfix(0.75, -2) == 0.1875);
     Require(scalbnf_nid_postfix(0.75f, 4) == 12.f);
diff --git a/docs/dev/debt/libc.md b/docs/dev/debt/libc.md
index c648774059..40e0f9edac 100644
--- a/docs/dev/debt/libc.md
+++ b/docs/dev/debt/libc.md
@@ -114,6 +114,7 @@
 - [expm1](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_expm1.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_expm1.c) with `huge` read at run time, and sets `ERANGE` only when a finite argument overflows to infinity, as the titles' `libc.prx` does. It gives the same bits and `errno` as the `expm1` bundled with PPSA07923 and PPSA05916 on 320 million random and 47,222 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 43,433 of the random ones.
 - [log1p](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_log1p.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_log1p.c). As the titles' `libc.prx` does, it sets `EDOM` at msun's NaN return (arguments below -1, `-inf` and negative NaNs) and leaves `errno` alone for `log1p(-1)`, where it returns `-inf`. It gives the same bits, NaN payloads included, and `errno` as the `log1p` bundled with PPSA07923 and PPSA05916 on 320 million random and 68,216 structured arguments on a Windows host. The FMA-contracted build bundled with PPSA13934 differs on 73,682 of the random ones.
 - [nextafter and nextafterf](../../../core/libs/prx/libc/src/Math.cpp) (libc) do not compare floating-point exceptions, and their inputs are checked by sampling, not exhaustively. They are FreeBSD msun's [`s_nextafter.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafter.c) and [`s_nextafterf.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_nextafterf.c), with `ERANGE` at msun's overflow and underflow returns as the titles' `libc.prx` sets it; a step away from zero returns early and sets none. The copies bundled with eleven titles give the same bits and `errno` on 4,000,784 sampled pairs per function on a Windows host.
+- [tanh](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's [`s_tanh.c`](https://github.com/freebsd/freebsd-src/blob/release/11.4.0/lib/msun/src/s_tanh.c) over this file's msun `Expm1`, with `tiny` read at run time; it sets no `errno`, as the titles' `libc.prx` does not. It gives the same bits as the `tanh` bundled with PPSA07923 and PPSA05916 on 16 million random and 68,211 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 1,054 of them.
 - [sinhf](../../../core/libs/prx/libc/src/Math.cpp) (libc) follows the `sinhf` of the `libc.prx` bundled with PPSA28319 (disassembly): FreeBSD msun's [`e_sinhf.c`](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_sinhf.c) from before `__ldexp_expf`, which squares `expf(|x| / 2)` between `logf(FLT_MAX)` and the overflow threshold, calling msun's [`expm1f`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/s_expm1f.c) and [`expf`](https://github.com/freebsd/freebsd-src/blob/59bc2f095289a10b8cfa55cbb2b45c3bd6c2d4ae/lib/msun/src/e_expf.c), whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets `errno` to `ERANGE` before returning `x * 1e37`; msun itself sets no `errno`. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system `libSceLibcInternal`, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return `libc.prx`, has the same code is assumed
 - [acoshf](../../../core/libs/prx/libc/src/Math.cpp) (libc) does not reproduce bundled invalid-domain errno or x87 exception flags (#10610); exact system `libSceLibcInternal` behavior and FMA-contracted copies remain unverified. Positive finite inputs use [msun](https://github.com/freebsd/freebsd-src/blob/5aa554c7e5b6fd9042986df07f12ac5687e41392/lib/msun/src/e_acoshf.c) range handling and this file's `logf`; the middle range divides -1 before addition under directed rounding. Bits, errno and SSE/x87 status and controls match the supplied PPSA03766/PPSA07923 copies on 236,592 positive finite calls (4,929 inputs, four rounding modes, DAZ/FTZ combinations and sticky flags); these samples are not exhaustive.
 - [acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf](../../../core/libs/prx/libc/src/Math.cpp) (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (`y0f`, `y1f`, `ynf` follow the console at `+-0`). As in the console's `libSceLibcInternal.sprx` (SDK 4.5x build of `J03950001`, 0x56410), `lgammal` does not store the sign in `signgam`; `hypotl` returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. [hypot3, hypot3f and hypot3l](../../../core/libs/prx/libc/src/Math.cpp) follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two

From 67b16acd53be995677f5f3c2556661f910a3d05a Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 19:29:44 -0500
Subject: [PATCH 213/218] test(libSceHmd): cover distortion work memory query
 aliases

---
 core/libs/tests/GuestHmd.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/libs/tests/GuestHmd.cpp b/core/libs/tests/GuestHmd.cpp
index 6f82327365..fa06463949 100644
--- a/core/libs/tests/GuestHmd.cpp
+++ b/core/libs/tests/GuestHmd.cpp
@@ -1,5 +1,6 @@
 #include "ProcessParametersFixture.hpp"
 #include "prx/libSceHmd/Hmd.hpp"
+#include "prx/libSceHmd/include/Api.hpp"
 
 #include <array>
 #include <cstddef>

From bcf57896c3052fce18c58efc3449a1bd9e7fca1a Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 22:53:29 -0500
Subject: [PATCH 214/218] test(libScePad): cover vibration mode argument range
 validation

---
 core/libs/tests/GuestPadVibrationMode.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/libs/tests/GuestPadVibrationMode.cpp b/core/libs/tests/GuestPadVibrationMode.cpp
index 3b82071a1f..4b54861ff0 100644
--- a/core/libs/tests/GuestPadVibrationMode.cpp
+++ b/core/libs/tests/GuestPadVibrationMode.cpp
@@ -22,5 +22,10 @@ int main() {
     Require(handle > 0);
     Require(scePadSetVibrationMode(handle, 0) == PAD_ERROR_INVALID_ARG);
     Require(scePadSetVibrationMode(handle, 1) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 2) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 3) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 4) == PAD_ERROR_INVALID_ARG);
+    Require(scePadSetVibrationMode(handle, 5) == PAD_OK);
+    Require(scePadSetVibrationMode(handle, 6) == PAD_ERROR_INVALID_ARG);
     Require(scePadClose_nid_postfix(handle) == PAD_OK);
 }

From ee5b94745ed8833409893590384cd64cd7972392 Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 22:54:00 -0500
Subject: [PATCH 215/218] test(libSceIme): cover unsupported type validation in
 FilterText

---
 core/libs/tests/GuestImeFilterText.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/libs/tests/GuestImeFilterText.cpp b/core/libs/tests/GuestImeFilterText.cpp
index f2f6cf3e11..7c15604512 100644
--- a/core/libs/tests/GuestImeFilterText.cpp
+++ b/core/libs/tests/GuestImeFilterText.cpp
@@ -61,6 +61,7 @@ void CheckArguments() {
     Require(Run(0, 5, 16, {u'a'}).code == kInvalidParam, "type 5");
     Require(Run(0, 0xff, 16, {u'a'}).code == kInvalidParam, "type 0xff");
     Require(Run(0, 0x104, 16, {u'a'}).code == kInvalidParam, "type 0x104");
+    Require(Run(0, 0x200, 16, {u'a'}).code == kInvalidParam, "type 0x200");
 }
 
 void CheckSimpleTypes() {

From 203aa9789619f2668d9d15233a458aaf6cb32dae Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 22:55:06 -0500
Subject: [PATCH 216/218] test(libSceSigninDialog): cover argument validation
 order across dialog states

---
 core/libs/tests/GuestSigninDialog.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/libs/tests/GuestSigninDialog.cpp b/core/libs/tests/GuestSigninDialog.cpp
index 0082e506f1..7baf28dae6 100644
--- a/core/libs/tests/GuestSigninDialog.cpp
+++ b/core/libs/tests/GuestSigninDialog.cpp
@@ -25,8 +25,10 @@ int main() {
     std::memset(result, 0x5a, sizeof(result));
 
     Require(sceSigninDialogTerminate() == kErrNotInitialized);
+    Require(sceSigninDialogOpen(nullptr) == kErrNotInitialized);
     Require(sceSigninDialogOpen(&param) == kErrNotInitialized);
     Require(sceSigninDialogClose() == kErrNotInitialized);
+    Require(sceSigninDialogGetResult(nullptr) == kErrNotInitialized);
     Require(sceSigninDialogGetResult(result) == kErrNotInitialized);
     Require(sceSigninDialogGetStatus() == kStatusNone);
     Require(sceSigninDialogUpdateStatus() == kStatusNone);
@@ -36,6 +38,7 @@ int main() {
     Require(sceSigninDialogGetStatus() == kStatusInitialized);
 
     Require(sceSigninDialogOpen(nullptr) == kErrArgNull);
+    Require(sceSigninDialogGetResult(nullptr) == kErrNotFinished);
     Require(sceSigninDialogGetResult(result) == kErrNotFinished);
 
     Require(sceSigninDialogOpen(&param) == 0);

From fb74715bc64709fb3d35eef68ec50d10a06d890f Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 22:55:29 -0500
Subject: [PATCH 217/218] test(libSceLoginDialog): cover null parameter and
 result argument validation

---
 core/libs/tests/GuestLoginDialog.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/libs/tests/GuestLoginDialog.cpp b/core/libs/tests/GuestLoginDialog.cpp
index 6f919c7cc8..9b567297b0 100644
--- a/core/libs/tests/GuestLoginDialog.cpp
+++ b/core/libs/tests/GuestLoginDialog.cpp
@@ -26,8 +26,10 @@ int main() {
     LoginDialogResult result{-1, -1, {11, 22, 33, 44, 55, 66, 77, 88}};
 
     Require(sceLoginDialogTerminate() == kErrNotInitialized);
+    Require(sceLoginDialogOpen(nullptr) == kErrArgNull);
     Require(sceLoginDialogOpen(&param) == kErrNotInitialized);
     Require(sceLoginDialogClose() == kErrNotInitialized);
+    Require(sceLoginDialogGetResult(nullptr) == kErrArgNull);
     Require(sceLoginDialogGetResult(&result) == kErrNotInitialized);
     Require(sceLoginDialogGetStatus() == kStatusNone);
     Require(sceLoginDialogUpdateStatus() == kStatusNone);
@@ -38,6 +40,7 @@ int main() {
     Require(sceLoginDialogUpdateStatus() == kStatusInitialized);
 
     Require(sceLoginDialogOpen(nullptr) == kErrArgNull);
+    Require(sceLoginDialogGetResult(nullptr) == kErrArgNull);
     Require(sceLoginDialogGetResult(&result) == kErrNotFinished);
     Require(result.result == 1 && result.errorCode == static_cast<int>(0x81340007u));
 

From d23602540f33bb6ff4c756062c2d0adf9ee93c0a Mon Sep 17 00:00:00 2001
From: al3w0f205 <miguel.alejandro.figueroa@gmail.com>
Date: Sun, 25 Oct 2026 23:22:59 -0500
Subject: [PATCH 218/218] test(libSceMbus): cover thread parameter reserved
 validation in sceDeviceServiceInitialize

---
 core/libs/tests/GuestMbus.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/libs/tests/GuestMbus.cpp b/core/libs/tests/GuestMbus.cpp
index 4050f1d452..29ef46dc7e 100644
--- a/core/libs/tests/GuestMbus.cpp
+++ b/core/libs/tests/GuestMbus.cpp
@@ -26,6 +26,11 @@ int main() {
     param.reserved = 1;
     Require(sceDeviceServiceInitialize(3, &param) == invalidArgument, "reserved field accepted");
     param.reserved = 0;
+    DeviceServiceThreadParam threadParam{};
+    threadParam.reserved = 1;
+    param.threadParam = &threadParam;
+    Require(sceDeviceServiceInitialize(3, &param) == invalidArgument, "threadParam reserved field accepted");
+    param.threadParam = nullptr;
     Require(sceDeviceServiceInitialize(3, &param) == 0, "default parameter initialization failed");
     Require(sceDeviceServiceInitialize(3, 0) == 0, "initialization failed");
     Require(sceDeviceServiceGetGeneration() == 0, "the device set started at another generation");